Edit tour

Windows Analysis Report
2yylp1mMbi.exe

Overview

General Information

Sample name:	2yylp1mMbi.exe renamed because original name is a hash value
Original sample name:	9efd5e60fd358a4bed2382d3815783ae.exe
Analysis ID:	1447006
MD5:	9efd5e60fd358a4bed2382d3815783ae
SHA1:	fe4d3df285adc723191609513e4731cc8b4451c6
SHA256:	379d64cc4cd6991eca9102ffac6209174ae16062ad9af636830a1a4cbb956a04
Tags:	32AgentTeslaexetrojan
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2yylp1mMbi.exe (PID: 7476 cmdline: "C:\Users\user\Desktop\2yylp1mMbi.exe" MD5: 9EFD5E60FD358A4BED2382D3815783AE)

RegSvcs.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\2yylp1mMbi.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "nwammuoocha@worlorderbillions.top", "Password": "vqpF.#;cCodu                                   "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2869754788.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eaf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f21:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3403d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34119:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3423f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 2yylp1mMbi.exe PID: 7476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2yylp1mMbi.exe PID: 7476	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7492	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7492	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eaf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f21:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3403d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34119:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3423f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.2yylp1mMbi.exe.21e0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2yylp1mMbi.exe.21e0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.2yylp1mMbi.exe.21e0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x320af:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32121:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x321ab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3223d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x322a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32319:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x323af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3243f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33eaf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33f21:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33fab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3403d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x340a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34119:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x341af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3423f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 185.244.151.84, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7492, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.worlorderbillions.top

Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "nwammuoocha@worlorderbillions.top", "Password": "vqpF.#;cCodu "}

Multi AV Scanner detection for domain / URL

Source: worlorderbillions.top	Virustotal: Detection: 11%	Perma Link
Source: mail.worlorderbillions.top	Virustotal: Detection: 13%	Perma Link
Source: http://worlorderbillions.top	Virustotal: Detection: 11%	Perma Link
Source: http://mail.worlorderbillions.top	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: 2yylp1mMbi.exe	ReversingLabs: Detection: 31%
Source: 2yylp1mMbi.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for sample

Source: 2yylp1mMbi.exe

Joe Sandbox ML: detected

Source: 2yylp1mMbi.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: 2yylp1mMbi.exe, 00000000.00000003.1622873283.0000000004090000.00000004.00001000.00020000.00000000.sdmp, 2yylp1mMbi.exe, 00000000.00000003.1621673028.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2yylp1mMbi.exe, 00000000.00000003.1622873283.0000000004090000.00000004.00001000.00020000.00000000.sdmp, 2yylp1mMbi.exe, 00000000.00000003.1621673028.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00854696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00854696
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0085C9C7
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085C93C FindFirstFileW,FindClose,	0_2_0085C93C
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0085F200
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0085F35D
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0085F65E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00853A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00853A2B
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00853D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00853D4E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0085BF27

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.244.151.84:587

Source: Joe Sandbox View	IP Address: 185.244.151.84 185.244.151.84
Source: Joe Sandbox View	IP Address: 185.244.151.84 185.244.151.84

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.244.151.84:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008625E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_008625E2

Source: global traffic

DNS traffic detected: DNS query: mail.worlorderbillions.top

Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.worlorderbillions.top
Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://worlorderbillions.top
Source: 2yylp1mMbi.exe, 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, gmBpn1ecBmQ.cs

.Net Code: ouKZnILwf

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0086425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0086425A

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00864458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00864458

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

0_2_0086425A

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00850219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00850219

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0087CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0087CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.2yylp1mMbi.exe.21e0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: This is a third-party compiled AutoIt script.	0_2_007F3B4C
Source: 2yylp1mMbi.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 2yylp1mMbi.exe, 00000000.00000000.1614146292.00000000008A5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_05e6abd9-b
Source: 2yylp1mMbi.exe, 00000000.00000000.1614146292.00000000008A5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ed66b4bc-f
Source: 2yylp1mMbi.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a0e55465-9
Source: 2yylp1mMbi.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0519f1f0-6

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008540B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_008540B1

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00848858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00848858

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0085545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0085545F

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007FE800	0_2_007FE800
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081DBB5	0_2_0081DBB5
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007FE060	0_2_007FE060
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0087804A	0_2_0087804A
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00804140	0_2_00804140
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00812405	0_2_00812405
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00826522	0_2_00826522
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00870665	0_2_00870665
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0082267E	0_2_0082267E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081283A	0_2_0081283A
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00806843	0_2_00806843
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008289DF	0_2_008289DF
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00826A94	0_2_00826A94
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00870AE2	0_2_00870AE2
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00808A0E	0_2_00808A0E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0084EB07	0_2_0084EB07
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00858B13	0_2_00858B13
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081CD61	0_2_0081CD61
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00827006	0_2_00827006
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00803190	0_2_00803190
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0080710E	0_2_0080710E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007F1287	0_2_007F1287
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008133C7	0_2_008133C7
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081F419	0_2_0081F419
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00805680	0_2_00805680
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008116C4	0_2_008116C4
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008058C0	0_2_008058C0
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008178D3	0_2_008178D3
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00811BB8	0_2_00811BB8
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00829D05	0_2_00829D05
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007FFE40	0_2_007FFE40
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00811FD0	0_2_00811FD0
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081BFE6	0_2_0081BFE6
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_021D3660	0_2_021D3660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010A9390	1_2_010A9390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010A9B50	1_2_010A9B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010A4A98	1_2_010A4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010A3E80	1_2_010A3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010ACE90	1_2_010ACE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_010A41C8	1_2_010A41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0599DD08	1_2_0599DD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0599BCF8	1_2_0599BCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05998B90	1_2_05998B90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05999AE0	1_2_05999AE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05994FF0	1_2_05994FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05993F48	1_2_05993F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_059956D0	1_2_059956D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05990040	1_2_05990040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_05992AF8	1_2_05992AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0623A178	1_2_0623A178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0623BC58	1_2_0623BC58

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: String function: 007F7F41 appears 35 times
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: String function: 00810D27 appears 70 times
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: String function: 00818B40 appears 42 times

Source: 2yylp1mMbi.exe, 00000000.00000003.1622509367.0000000004013000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2yylp1mMbi.exe
Source: 2yylp1mMbi.exe, 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameda505e73-ce6a-4c37-8e7a-d349dd39df37.exe4 vs 2yylp1mMbi.exe
Source: 2yylp1mMbi.exe, 00000000.00000003.1621773702.00000000041BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 2yylp1mMbi.exe

Source: 2yylp1mMbi.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.2yylp1mMbi.exe.21e0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@2/1

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0085A2D5 GetLastError,FormatMessageW,

0_2_0085A2D5

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00848713 AdjustTokenPrivileges,CloseHandle,		0_2_00848713
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00848CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00848CC3

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0085B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0085B59E

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0086F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0086F121

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008686D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_008686D0

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_007F4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

File created: C:\Users\user\AppData\Local\Temp\autA19A.tmp

Jump to behavior

Source: 2yylp1mMbi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2yylp1mMbi.exe	ReversingLabs: Detection: 31%
Source: 2yylp1mMbi.exe	Virustotal: Detection: 38%

Source: unknown	Process created: C:\Users\user\Desktop\2yylp1mMbi.exe "C:\Users\user\Desktop\2yylp1mMbi.exe"
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2yylp1mMbi.exe"
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2yylp1mMbi.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 2yylp1mMbi.exe

Static file information: File size 1051136 > 1048576

Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2yylp1mMbi.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 2yylp1mMbi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: 2yylp1mMbi.exe, 00000000.00000003.1622873283.0000000004090000.00000004.00001000.00020000.00000000.sdmp, 2yylp1mMbi.exe, 00000000.00000003.1621673028.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 2yylp1mMbi.exe, 00000000.00000003.1622873283.0000000004090000.00000004.00001000.00020000.00000000.sdmp, 2yylp1mMbi.exe, 00000000.00000003.1621673028.0000000003EF0000.00000004.00001000.00020000.00000000.sdmp

Source: 2yylp1mMbi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2yylp1mMbi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2yylp1mMbi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2yylp1mMbi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2yylp1mMbi.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0086C304 LoadLibraryA,GetProcAddress,

0_2_0086C304

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007FC590 push eax; retn 007Fh	0_2_007FC599
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00858719 push FFFFFF8Bh; iretd	0_2_0085871B
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081E94F push edi; ret	0_2_0081E951
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081EA68 push esi; ret	0_2_0081EA6A
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00818B85 push ecx; ret	0_2_00818B98
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081EC43 push esi; ret	0_2_0081EC45
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081ED2C push edi; ret	0_2_0081ED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0623FB10 push es; iretd	1_2_0623FB1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0623FB44 push es; iretd	1_2_0623FB48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0623FBCD push es; iretd	1_2_0623FBDC

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_007F4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_007F4A35
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_008755FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_008755FD

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008133C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008133C7

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1398			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8428			Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99609

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

API coverage: 4.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00854696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00854696
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0085C9C7
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085C93C FindFirstFileW,FindClose,	0_2_0085C93C
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0085F200
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0085F35D
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0085F65E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00853A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00853A2B
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00853D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00853D4E
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0085BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0085BF27

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007F4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99868	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97836	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97725	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97032	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96907	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96782	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94954	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94829	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94704	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94454	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94329	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94204	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94079	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 93954	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	API call chain: ExitProcess graph end node			graph_0-98469
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	API call chain: ExitProcess graph end node			graph_0-98535

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008641FD BlockInput,

0_2_008641FD

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007F3B4C

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00825CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00825CCC

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0086C304 LoadLibraryA,GetProcAddress,

0_2_0086C304

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_021D34F0 mov eax, dword ptr fs:[00000030h]	0_2_021D34F0
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_021D3550 mov eax, dword ptr fs:[00000030h]	0_2_021D3550
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_021D1ED0 mov eax, dword ptr fs:[00000030h]	0_2_021D1ED0

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008481F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_008481F7

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0081A395
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_0081A364 SetUnhandledExceptionFilter,		0_2_0081A364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: DD2008

Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00848C93 LogonUserW,

0_2_00848C93

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007F3B4C

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_007F4A35

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00854EC9 mouse_event,

0_2_00854EC9

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\2yylp1mMbi.exe"

Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

0_2_008481F7

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00854C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00854C03

Source: 2yylp1mMbi.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 2yylp1mMbi.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0081886B cpuid

0_2_0081886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_008250D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008250D7

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_00832230 GetUserNameW,

0_2_00832230

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_0082418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0082418A

Source: C:\Users\user\Desktop\2yylp1mMbi.exe

Code function: 0_2_007F4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007F4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2869754788.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2yylp1mMbi.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7492, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: 2yylp1mMbi.exe	Binary or memory string: WIN_81
Source: 2yylp1mMbi.exe	Binary or memory string: WIN_XP
Source: 2yylp1mMbi.exe	Binary or memory string: WIN_XPe
Source: 2yylp1mMbi.exe	Binary or memory string: WIN_VISTA
Source: 2yylp1mMbi.exe	Binary or memory string: WIN_7
Source: 2yylp1mMbi.exe	Binary or memory string: WIN_8
Source: 2yylp1mMbi.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2yylp1mMbi.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7492, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2yylp1mMbi.exe.21e0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2869754788.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2yylp1mMbi.exe PID: 7476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7492, type: MEMORYSTR

Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00866596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00866596
Source: C:\Users\user\Desktop\2yylp1mMbi.exe	Code function: 0_2_00866A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00866A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	121 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	141 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
2yylp1mMbi.exe	32%	ReversingLabs
2yylp1mMbi.exe	38%	Virustotal	Browse
2yylp1mMbi.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
worlorderbillions.top	12%	Virustotal		Browse
mail.worlorderbillions.top	13%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://worlorderbillions.top	12%	Virustotal		Browse
http://mail.worlorderbillions.top	100%	Avira URL Cloud	phishing
http://worlorderbillions.top	0%	Avira URL Cloud	safe
http://mail.worlorderbillions.top	13%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
worlorderbillions.top	185.244.151.84	true	false	12%, Virustotal, Browse	unknown
mail.worlorderbillions.top	unknown	unknown	true	13%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sectigo.com/CPS0	RegSvcs.exe, 00000001.00000002.2871284290.0000000006262000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.worlorderbillions.top	RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://account.dyn.com/	2yylp1mMbi.exe, 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://worlorderbillions.top	RegSvcs.exe, 00000001.00000002.2869754788.0000000002FD6000.00000004.00000800.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.151.84	worlorderbillions.top	Netherlands		60117	HSAE	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447006
Start date and time:	2024-05-24 08:22:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2yylp1mMbi.exe renamed because original name is a hash value
Original Sample Name:	9efd5e60fd358a4bed2382d3815783ae.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 266
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:22:56	API Interceptor	54x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.244.151.84	https://apiservices.krxd.net/click_tracker/track?kxconfid=whjxbtb0h&_knopii=1&kxcampaignid=P.C.C-Class.W206.L.MI&kxplacementid=module2findmycar&kxbrand=MB&clk=http://WMUHS.penseldraget.com/?email=projectassistant@gheenirrigation.com	Get hash	malicious	HTMLPhisher	Browse	wmuhs.penseldraget.com/?email=projectassistant@gheenirrigation.com&_knopii=1
	https://sites.google.com/view/man-energy-solutions/halaman-muka	Get hash	malicious	HTMLPhisher	Browse	man-energy-solution.duerbcek.com/
	https://sites.google.com/view/asiatic-lloyd-maritime-llp/halaman-muka	Get hash	malicious	HTMLPhisher	Browse	asiatic-lloyd-maritime.duerbcek.com/
	https://sites.google.com/view/dnvlimited/halaman-muka	Get hash	malicious	Unknown	Browse	dnv-limited.duerbcek.com/
	https://veolia-dot-yamm-track.appspot.com/Redirect?ukey=1rYd-S6h21KvcEPO5BLkBWp1KOKV2-Rm-t86fM2DfnMk-177924590&key=YAMMID-18720160&link=http%3A%2F%2Fthrh.tumyphie.com%2F	Get hash	malicious	Unknown	Browse	thrh.tumyphie.com/
	http://mollkiss.mekythkit.online	Get hash	malicious	Unknown	Browse	mollkiss.mekythkit.online/
	Friday_ February 5th_ 2021 64427 a.m._ 20210205064427.64791275BD060468@juidine.com.html	Get hash	malicious	HTMLPhisher	Browse	185.244.151.84/cgi-sys/suspendedpage.cgi
	Thursday, February 4th, 2021 103440 p.m., 20210204223440.464D4D4AD1BFDE50@juidine.com.html	Get hash	malicious	HTMLPhisher	Browse	185.244.151.84/cgi-sys/suspendedpage.cgi
	Adjunto-30.doc	Get hash	malicious	Unknown	Browse	alkamefood.com/y/P/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HSAE	DHL_67329033929228____________________________.exe	Get hash	malicious	AgentTesla	Browse	185.244.151.84
	986eOBuN16.exe	Get hash	malicious	AgentTesla	Browse	185.244.151.84
	fGLzN2VXGA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.244.151.84
	EAP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.244.151.84
	HVC.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.244.151.84
	SecuriteInfo.com.W32.AutoIt.YE.gen.Eldorado.16327.12658.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196
	PDFT_5347480048_9037734883489_________________________.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.244.151.84
	EKP.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	185.244.151.84
	1l76GsiiSU.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196
	PO-TR726276201-00538845 GHM-REFU-2024.exe	Get hash	malicious	AgentTesla	Browse	194.36.191.196

Process:	C:\Users\user\Desktop\2yylp1mMbi.exe
File Type:	ASCII text, with very long lines (28724), with no line terminators
Category:	dropped
Size (bytes):	28724
Entropy (8bit):	3.598081752044728
Encrypted:	false
SSDEEP:	768:ViTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNboE+I026c024vfF3if6o:ViTZ+2QoioGRk6ZklputwjpjBkCiw2RD
MD5:	16C8BBD9EAFAD01EEE22124861290335
SHA1:	370D9F1EC25DAABBFAE9A284D3D0161CB8C1F209
SHA-256:	1702A93C6B6DAD818687DCD11F5C63E5DF6954E20AEA0169E4035E956B1F3563
SHA-512:	8387E1C9FBAAFDC6477EE361689AC93DE260F9897F587A3ED6F6465465B5E77D0074839B58D22D8F779808DA302D674117FF951A0AE3FD52FAA799A2C5B519CB
Malicious:	false
Reputation:	low
Preview:	84F98E0D192B10FD05E7E43AEF7957D5930866ABD5D0DA6FF50x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c0000

C:\Users\user\AppData\Local\Temp\autA19A.tmp

Download File

Process:	C:\Users\user\Desktop\2yylp1mMbi.exe
File Type:	data
Category:	dropped
Size (bytes):	152578
Entropy (8bit):	7.927616254709623
Encrypted:	false
SSDEEP:	3072:065yuo2BEoOxFIUJcIaeEmNMleX8qsG3xgqQYYJLrdOEcUnkQRont9Kl5RpsFl8t:0/2evxFIMaW8IORtrMVqoKbRZ1
MD5:	052A6097B4DE197FBA78753E057FAD1D
SHA1:	EEED1C5ADD09501599407B8BAEFD312D3C578C97
SHA-256:	93BF5CA783D65BEC160189FB1DD8BFFD5B681CB199E6B4573E53F0833B482E1E
SHA-512:	DAF6CDE7E700558DE652A2E52A9E5DD7FCFB541F649635A85A874681D4850195D2D7443251ECFFEDA62A7CC250EF0E73DF61364CFEE5A4044974719C8759D7F7
Malicious:	false
Reputation:	low
Preview:	EA06.....E.U..N.M..f..~..0.M....&.Z.U@.J...0.Q....\...~.(..B...u?..1d.S..[5.a_.Z.S...U4.Y%.I]zAD.Ij..$.Ir.H.Q.... .Hj...V...T.;U..).j...w..4.YZ.U+.Z5V...L+...\m..V...if`.D.aX.....ej..'.X.F.T.ej..+..>...).j-h...Uju@..R.4...Q.`.WqD.G.`..<.F....D~.._Yf.....j.Z....U.$.Y4.....=Z.0.......H.T.o.y..17..%@..N..........?\|....=..d..M2..+.....C.[... ..}.......T.<. .T)4..#.Q.El4I...G..&.:P....H..6.o...x..gS..b..sk;.=....j....7UK.n........`..9.O.y...\|...L...>i~f.V..6./G.a`...3.lfKf......#.Dgw...m6..........l.K.+.^.].M.>.Dv..f.'.N-u...i".B..9\.A..h.........~{~u~{..Y).Z5..<........?.\|..<.....i..."\..].4.(..4..'@..8....s.P.r...]...@..\|..)...cU.....$.......n..$..y.....A...4r.`..3o\|....@;.).....G....c!.h.p..N.....j\.@.V.W.$go..^j.z.".B.S'.ZM.M....6.nz...u..o.Z9J...^...V....7.E.~x.......;Zz.N....v...6SQ.V...4..(.......x..!.z...=...R.G.....]Z.U.U...'...]BAO.V.....4.Ri....f.G.....2.X(....UZ.Tj6..V.:.......9..i..,......SJ]b.4.E(..\|....m. ....L ........"W.e.._.3&...M7.

C:\Users\user\AppData\Local\Temp\autA1D9.tmp

Download File

Process:	C:\Users\user\Desktop\2yylp1mMbi.exe
File Type:	data
Category:	dropped
Size (bytes):	9906
Entropy (8bit):	7.599041196980202
Encrypted:	false
SSDEEP:	192:yyaFcTokxCW/EeiNo/GONuVROF9cfsSEyRZRjxlEu/BHOJLsu+XZ:cFxkUWceiNo3NiWeLblEu/d4sbXZ
MD5:	23DC35A2D71E10C6C4E63ECC56A52A09
SHA1:	40F59D66E87F0C4E635D19EE4D0E55AAB037058D
SHA-256:	C2419AB111F1CF194E243111FE1C9F4DD28D60507A58D0C4D560024566E23A18
SHA-512:	0F676D9DE1E86445628574D58DB734E00B0860DC865757A2D85872FE046368E3261CE83871A4F7ADAFEFCB7B3DC08194D8C8AE8DF06E538AD0504AA3A4C8C179
Malicious:	false
Reputation:	low
Preview:	EA06..p4.M(...aD..fT)..D.Mh.z,.gA....5.......B.Mh..%.mF.Mf....qb.....-..c.L...$.m5...k..c0.M....k8.X.3i...l..%.o2....A8.6,.........3k....e.N&s0.oNf.)...k.K$.eb....5..f.........6.0.o.p....l39....V0...S..$.if...6....f.I...@.....i8........X@.4.1..........$.P...0z.5..$}3Y.....=5..`d....!d..V...7f.[$..8...\|.I..W.d...\|vI..W.d...\|vK..W.d...\|vK(.W.e...\|vY..W,.O...k.`..X@..9..^.8..F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn.

C:\Users\user\AppData\Local\Temp\gobioid

Download File

Process:	C:\Users\user\Desktop\2yylp1mMbi.exe
File Type:	data
Category:	dropped
Size (bytes):	243200
Entropy (8bit):	6.650965875691894
Encrypted:	false
SSDEEP:	3072:6x3Y+3ibkk2fLMTUbVtU+yrnJhP0PeslMI2IkK9mthbvHy0ernTzCJ7vVZyEhGoU:aowa1e4P0lltw6vm7vVZyEtzqli/I
MD5:	5A18F36C42F0A0D59F2A426DF35266FD
SHA1:	95A71B24331A261C588FCE72BF993EEB24905EA6
SHA-256:	593ADFF2367D9BCB775B72854F46070C825805DB6EF3830528EEA9F5A3FA3636
SHA-512:	8FC678765D39BF993897FACD01016FEE030D3E6EDB749B3FC0FCAB71FD762AA44D0507A31A71A0354008D5C3C2FB3AE5E1477CC0EFC2513CD7AB6B407A4E034B
Malicious:	false
Reputation:	low
Preview:	...XVSDMQE0O.G0.6EJRILZ.USDMUE0O0XG0X6EJRILZXUSDMUE0O0XG0X6.JRIBE.[S.D.d.N\|.fd0_6j";#=4>d.4+^ Dx%UxD0$r "z...d :!Ua=UM.X6EJRIL..US.LVE.?w>G0X6EJRI.ZZTXEFUE.L0XO0X6EJR..YXUsDMU.3O0X.0X.EJRKLZ\USDMUE0K0XG0X6EJrMLZZUSDMUE2Op.G0H6EZRILZHUSTMUE0O0HG0X6EJRILZX..GM.E0O0.D0.3EJRILZXUSDMUE0O0XG0X2EFRILZXUSDMUE0O0XG0X6EJRILZXUSDMUE0O0XG0X6EJRILZXUSDMUe0O8XG0X6EJRILZPuSD.UE0O0XG0X6Ed&,4.XUS@.VE0o0XG.[6EHRILZXUSDMUE0O0xG08.79 LZX.VDMU.3O0^G0X.FJRILZXUSDMUE0.0X..*S)%1ILVXUSDMQE0M0XG.[6EJRILZXUSDMU.0OrXG0X6EJRILZXUSDM..3O0XG0.6EJPIIZ..QD.aD0L0XG1X6CJRILZXUSDMUE0O0XG0X6EJRILZXUSDMUE0O0XG0X6EJRILZXH...xqx%y::1.l...Y..@..,..@qM.KL....D....c8S.yO.Ww...L.../.]V=L....`';)8-.%fC;.H....x.;p..66.?...2h.;U`.\|...{..zJ>....,..'"8kQ?@4"..W#+ .X.TSDMU......._=..dOUFaA<.....J?f..,ILZ<USD?UE0.0XGwX6E%RIL4XUS:MUENO0X.0X6.JRI{ZXUvDMU(0O0\|G0XHEJR.1UW..$&..O0XG0m..z.$.....s...>.&.R`.6....P..B=.G.\|...V..!..[.3Sp..RD6K5Z@4[:xD....yWW@HWB4L<eI{..k.o.a..<....J.;0X6EJR.LZ.USD..E.O0X.0.6..RIL.U.D.U..0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.957720350907904
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2yylp1mMbi.exe
File size:	1'051'136 bytes
MD5:	9efd5e60fd358a4bed2382d3815783ae
SHA1:	fe4d3df285adc723191609513e4731cc8b4451c6
SHA256:	379d64cc4cd6991eca9102ffac6209174ae16062ad9af636830a1a4cbb956a04
SHA512:	0a714db1a7ed40163d74801ef76c69a72fa890fd5cb89dd752c5d8039a6b2aaa448325407ae8eeaf439b3a641bad9ec17de92d3b76e92d75b230f9e15b667697
SSDEEP:	24576:OAHnh+eWsN3skA4RV1Hom2KXMmHaiCk9navOaqrr5:5h+ZkldoPK8YaiCkQvm
TLSH:	7D25AD0273D1C036FFABA2739B6AF64156BC79254123852F13981DB9BD701B2263E763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x664F7AF0 [Thu May 23 17:20:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F5048EF54EDh
jmp 00007F5048EE82A4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F5048EE842Ah
cmp edi, eax
jc 00007F5048EE878Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F5048EE8429h
rep movsb
jmp 00007F5048EE873Ch
cmp ecx, 00000080h
jc 00007F5048EE85F4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F5048EE8430h
bt dword ptr [004BF324h], 01h
jc 00007F5048EE8900h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F5048EE85CDh
test edi, 00000003h
jne 00007F5048EE85DEh
test esi, 00000003h
jne 00007F5048EE85BDh
bt edi, 02h
jnc 00007F5048EE842Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F5048EE8433h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F5048EE8485h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x36340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xff000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x36340	0x36400	95522392698e3ae37de2243e302ea0a5	False	0.8788387456797235	data	7.771390078362094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xff000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x2d5d6	data			1.000355193903581
RT_GROUP_ICON	0xfdd90	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xfde08	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xfde1c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xfde30	0x14	data	English	Great Britain	1.25
RT_VERSION	0xfde44	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0xfdf50	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 08:22:58.569447041 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:22:58.575320959 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:22:58.575418949 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:22:59.752310038 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:22:59.754031897 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:22:59.759047985 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:22:59.966584921 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:22:59.966766119 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:22:59.971812963 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.183696032 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.191369057 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.197350979 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.411556959 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.413234949 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.413321018 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.417999029 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.425863028 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.425896883 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.426018000 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.463552952 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.463754892 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.501966953 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.527162075 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.533354998 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.741019011 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.756344080 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.761373043 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.968976974 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:00.970127106 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:00.975322962 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:01.183813095 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:01.184139013 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:01.196224928 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.593146086 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.593427896 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:03.598433971 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.972127914 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.976921082 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.976933956 CEST	587	49730	185.244.151.84	192.168.2.4
May 24, 2024 08:23:03.977009058 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:03.982279062 CEST	49730	587	192.168.2.4	185.244.151.84
May 24, 2024 08:23:04.028278112 CEST	587	49730	185.244.151.84	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 08:22:57.478163004 CEST	57117	53	192.168.2.4	1.1.1.1
May 24, 2024 08:22:58.474602938 CEST	57117	53	192.168.2.4	1.1.1.1
May 24, 2024 08:22:58.549108028 CEST	53	57117	1.1.1.1	192.168.2.4
May 24, 2024 08:22:58.554071903 CEST	53	57117	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 08:22:57.478163004 CEST	192.168.2.4	1.1.1.1	0x8fdf	Standard query (0)	mail.worlorderbillions.top	A (IP address)	IN (0x0001)	false
May 24, 2024 08:22:58.474602938 CEST	192.168.2.4	1.1.1.1	0x8fdf	Standard query (0)	mail.worlorderbillions.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 08:22:58.549108028 CEST	1.1.1.1	192.168.2.4	0x8fdf	No error (0)	mail.worlorderbillions.top	worlorderbillions.top		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 08:22:58.549108028 CEST	1.1.1.1	192.168.2.4	0x8fdf	No error (0)	worlorderbillions.top		185.244.151.84	A (IP address)	IN (0x0001)	false
May 24, 2024 08:22:58.554071903 CEST	1.1.1.1	192.168.2.4	0x8fdf	No error (0)	mail.worlorderbillions.top	worlorderbillions.top		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 08:22:58.554071903 CEST	1.1.1.1	192.168.2.4	0x8fdf	No error (0)	worlorderbillions.top		185.244.151.84	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 24, 2024 08:22:59.752310038 CEST	587	49730	185.244.151.84	192.168.2.4	220-hosting2.ro.hostsailor.com ESMTP Exim 4.96.2 #2 Fri, 24 May 2024 08:22:59 +0200 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 24, 2024 08:22:59.754031897 CEST	49730	587	192.168.2.4	185.244.151.84	EHLO 226533
May 24, 2024 08:22:59.966584921 CEST	587	49730	185.244.151.84	192.168.2.4	250-hosting2.ro.hostsailor.com Hello 226533 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 24, 2024 08:22:59.966766119 CEST	49730	587	192.168.2.4	185.244.151.84	STARTTLS
May 24, 2024 08:23:00.183696032 CEST	587	49730	185.244.151.84	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	02:22:54
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\2yylp1mMbi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2yylp1mMbi.exe"
Imagebase:	0x7f0000
File size:	1'051'136 bytes
MD5 hash:	9EFD5E60FD358A4BED2382D3815783AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1624930688.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:22:55
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2yylp1mMbi.exe"
Imagebase:	0xa40000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2869754788.0000000002FCE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2868339414.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2869754788.0000000002F81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6%
Total number of Nodes:	2000
Total number of Limit Nodes:	163

Executed Functions

Function 007F3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007F3B7A
IsDebuggerPresent.KERNEL32 ref: 007F3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,008B62F8,008B62E0,?,?), ref: 007F3BFD

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Part of subcall function 00800A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,007F3C26,008B62F8,?,?,?), ref: 00800ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 007F3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008A93F0,00000010), ref: 0082D4BC
SetCurrentDirectoryW.KERNEL32(?,008B62F8,?,?,?), ref: 0082D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,008A5D40,008B62F8,?,?,?), ref: 0082D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0082D581

Part of subcall function 007F3A58: GetSysColorBrush.USER32(0000000F), ref: 007F3A62
Part of subcall function 007F3A58: LoadCursorW.USER32(00000000,00007F00), ref: 007F3A71
Part of subcall function 007F3A58: LoadIconW.USER32(00000063), ref: 007F3A88
Part of subcall function 007F3A58: LoadIconW.USER32(000000A4), ref: 007F3A9A
Part of subcall function 007F3A58: LoadIconW.USER32(000000A2), ref: 007F3AAC
Part of subcall function 007F3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007F3AD2
Part of subcall function 007F3A58: RegisterClassExW.USER32(?), ref: 007F3B28

Part of subcall function 007F39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007F3A15
Part of subcall function 007F39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007F3A36
Part of subcall function 007F39E7: ShowWindow.USER32(00000000,?,?), ref: 007F3A4A
Part of subcall function 007F39E7: ShowWindow.USER32(00000000,?,?), ref: 007F3A53

Part of subcall function 007F43DB: _memset.LIBCMT ref: 007F4401
Part of subcall function 007F43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007F44A6

Strings

runas, xrefs: 0082D575
This is a third-party compiled AutoIt script., xrefs: 0082D4B4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 53f1e166d852165ad11a03ff1dada88319036cd5b8e5069a7bfb31800f1b7583
Instruction ID: 314a02d8e4a6cbf82ff5e168f3915779799b5d453f2a31bf95c972750131f5ec
Opcode Fuzzy Hash: 53f1e166d852165ad11a03ff1dada88319036cd5b8e5069a7bfb31800f1b7583
Instruction Fuzzy Hash: 8E51D23190824CEADF15ABB4DC09AFD7B78FF05340B004165F665A63A2EA7C8A95CB21

Function 007F4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 007F4B2B

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

GetCurrentProcess.KERNEL32(?,0087FAEC,00000000,00000000,?), ref: 007F4BF8
IsWow64Process.KERNEL32(00000000), ref: 007F4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 007F4C45
FreeLibrary.KERNEL32(00000000), ref: 007F4C50
GetSystemInfo.KERNEL32(00000000), ref: 007F4C81
GetSystemInfo.KERNEL32(00000000), ref: 007F4C8D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: f1d01ed1c06b40e992d1114dbd249fe82c45ca726c35d4f58d6fe47a09078b70
Instruction ID: b0e54b0cb94a18f21e21c548121b00ce17e9e43437ee31095aabee759e06955c
Opcode Fuzzy Hash: f1d01ed1c06b40e992d1114dbd249fe82c45ca726c35d4f58d6fe47a09078b70
Instruction Fuzzy Hash: 0791C47154A7C8DFC731CB6894551BBBFE4BF2A310B444D9ED1CA93B42D228E948C729

Function 007F4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007F4EEE,?,?,00000000,00000000), ref: 007F4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007F4EEE,?,?,00000000,00000000), ref: 007F5010
LoadResource.KERNEL32(?,00000000,?,?,007F4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007F4F8F), ref: 0082DD60
SizeofResource.KERNEL32(?,00000000,?,?,007F4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007F4F8F), ref: 0082DD75
LockResource.KERNEL32(007F4EEE,?,?,007F4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007F4F8F,00000000), ref: 0082DD88

Strings

SCRIPT, xrefs: 007F5006

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: a694d8289134951ea0229d8171d9b865715d6cb19d8c955cbe14cd1b8bbe2786
Instruction ID: 963fe5a3578ca8939ff231cf984e6fdaa6dab0e109f9dd969f671d996915a732
Opcode Fuzzy Hash: a694d8289134951ea0229d8171d9b865715d6cb19d8c955cbe14cd1b8bbe2786
Instruction Fuzzy Hash: CE115A75200B04AFD7218B66DC58F677BB9FBC9B11F208168F60AC6261DB71EC408660

Function 00854696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0082E7C1), ref: 008546A6
FindFirstFileW.KERNELBASE(?,?), ref: 008546B7
FindClose.KERNEL32(00000000), ref: 008546C7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 03c0a1d43152835828cc18561905aec53fd208f9643db0bb2ee96c61f736f500
Instruction ID: 3b9749ecca7500538cb441b243b481b78576b3e763010ee014850624c970ddf2
Opcode Fuzzy Hash: 03c0a1d43152835828cc18561905aec53fd208f9643db0bb2ee96c61f736f500
Instruction Fuzzy Hash: 54E0D8314144005B53106738EC4D4EA779CFE1633AF100755FD39C21E1E7B099D48695

Function 007FE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 0083428C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: c4660a52933bcd0b1392f615f645342ef3005e1ed0d7107679477d9375463fc1
Instruction ID: 2e526ddb24433b042a2990fc35c9ef78625c3fdf8a57f9f0359f9292cbb31f4f
Opcode Fuzzy Hash: c4660a52933bcd0b1392f615f645342ef3005e1ed0d7107679477d9375463fc1
Instruction Fuzzy Hash: 27A28374A04209CFDB24CF58C480ABEB7B1FF58314F648169EA16AB361D779ED81CB91

Function 00800B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00800BBB
timeGetTime.WINMM ref: 00800E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00800FB3
TranslateMessage.USER32(?), ref: 00800FC7
DispatchMessageW.USER32(?), ref: 00800FD5
Sleep.KERNEL32(0000000A), ref: 00800FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0080105A
DestroyWindow.USER32 ref: 00801066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00801080
Sleep.KERNEL32(0000000A,?,?), ref: 008352AD
TranslateMessage.USER32(?), ref: 0083608A
DispatchMessageW.USER32(?), ref: 00836098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008360AC

Strings

@GUI_CTRLID, xrefs: 00835364
@TRAY_ID, xrefs: 00835BB9
@COM_EVENTOBJ, xrefs: 0083591A
@GUI_WINHANDLE, xrefs: 008353B9
@GUI_CTRLHANDLE, xrefs: 0083540E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: c075271f49778900ba1c15df03228b7228680bfa1751b81e1d37913e8db20b10
Instruction ID: 36a47702b12be145cbf1d43f7fa4b7b6c167bcaaee86a45a140e0309df161fde
Opcode Fuzzy Hash: c075271f49778900ba1c15df03228b7228680bfa1751b81e1d37913e8db20b10
Instruction Fuzzy Hash: C2B2C270608745DFDB28DF24C889BAAB7E5FF84304F14491DE58AD72A1DB75E884CB82

Function 008593DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008591E9: __time64.LIBCMT ref: 008591F3

Part of subcall function 007F5045: _fseek.LIBCMT ref: 007F505D

__wsplitpath.LIBCMT ref: 008594BE

Part of subcall function 0081432E: __wsplitpath_helper.LIBCMT ref: 0081436E

_wcscpy.LIBCMT ref: 008594D1
_wcscat.LIBCMT ref: 008594E4
__wsplitpath.LIBCMT ref: 00859509
_wcscat.LIBCMT ref: 0085951F
_wcscat.LIBCMT ref: 00859532

Part of subcall function 0085922F: _memmove.LIBCMT ref: 00859268
Part of subcall function 0085922F: _memmove.LIBCMT ref: 00859277

_wcscmp.LIBCMT ref: 00859479

Part of subcall function 008599BE: _wcscmp.LIBCMT ref: 00859AAE
Part of subcall function 008599BE: _wcscmp.LIBCMT ref: 00859AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008596DC
_wcsncpy.LIBCMT ref: 0085974F
DeleteFileW.KERNEL32(?,?), ref: 00859785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0085979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008597AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008597BE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: cb68de7751dfe2bd30af97a33f766f47b2b455f4cd899d92706ba4509baa0f7c
Instruction ID: 3669c56c8e007bb7f3bd0e97916037a8a058753b91091a3c0c4130a03bc82a48
Opcode Fuzzy Hash: cb68de7751dfe2bd30af97a33f766f47b2b455f4cd899d92706ba4509baa0f7c
Instruction Fuzzy Hash: 0BC12DB1900219EADF11DF95CC85AEEB7BDFF54310F0040AAF609E6251EB309A888F65

Function 007F3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007F3074
RegisterClassExW.USER32(00000030), ref: 007F309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007F30AF
InitCommonControlsEx.COMCTL32(?), ref: 007F30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007F30DC
LoadIconW.USER32(000000A9), ref: 007F30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007F3101

Strings

+, xrefs: 007F305D
0, xrefs: 007F3056
TaskbarCreated, xrefs: 007F30A4
AutoIt v3 GUI, xrefs: 007F3090

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: db3150a09babe5ddd399322f4241a54a9a85589a1bdcea8c09e3928a64813a12
Instruction ID: e72d7f8c1d8cc066e79beb18744b49dc76ed6c2ff55f6745d329b47848a3602d
Opcode Fuzzy Hash: db3150a09babe5ddd399322f4241a54a9a85589a1bdcea8c09e3928a64813a12
Instruction Fuzzy Hash: F4317CB1844349EFDB00CFA4DC89AD9BFF0FB09310F14462AE654E62A1E3B94591CF50

Function 007F3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007F3074
RegisterClassExW.USER32(00000030), ref: 007F309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007F30AF
InitCommonControlsEx.COMCTL32(?), ref: 007F30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007F30DC
LoadIconW.USER32(000000A9), ref: 007F30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007F3101

Strings

+, xrefs: 007F305D
0, xrefs: 007F3056
TaskbarCreated, xrefs: 007F30A4
AutoIt v3 GUI, xrefs: 007F3090

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: ef0eabf964af5e6bb4ee546fff0fcd5d6e19ade75b585270732ce64f23eb6844
Instruction ID: 6f6dc03d71756fb5521d7e32b360301df2b674dff60dc3023d47f8c63dddb5da
Opcode Fuzzy Hash: ef0eabf964af5e6bb4ee546fff0fcd5d6e19ade75b585270732ce64f23eb6844
Instruction Fuzzy Hash: 0B21C9B1940258AFDB00DF95EC89B9DBBF4FB08710F00422AF614E62A5E7B54594CF91

Function 007F71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007F4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,008B62F8,?,007F37C0,?), ref: 007F4882

Part of subcall function 0081074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,007F72C5), ref: 00810771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007F7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0082ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0082ED32
RegCloseKey.ADVAPI32(?), ref: 0082ED70
_wcscat.LIBCMT ref: 0082EDC9

Strings

Include, xrefs: 0082ECE8, 0082ED29
\, xrefs: 0082EDEC
\Include\, xrefs: 007F72C5
Software\AutoIt v3\AutoIt, xrefs: 007F72FE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 3092fabaf6f460d949270ea88e8274ad52643725edfc8835206171fe62c4d739
Instruction ID: a96358c14a99a361ffada106da21c7a55e0cd29472cd5c8231a24fbc768cefb8
Opcode Fuzzy Hash: 3092fabaf6f460d949270ea88e8274ad52643725edfc8835206171fe62c4d739
Instruction Fuzzy Hash: 62718271408305DEC714EF69EC859ABBBE8FF98350F40462EF646D32A1DB709989CB52

Function 007F3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007F3A62
LoadCursorW.USER32(00000000,00007F00), ref: 007F3A71
LoadIconW.USER32(00000063), ref: 007F3A88
LoadIconW.USER32(000000A4), ref: 007F3A9A
LoadIconW.USER32(000000A2), ref: 007F3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007F3AD2
RegisterClassExW.USER32(?), ref: 007F3B28

Part of subcall function 007F3041: GetSysColorBrush.USER32(0000000F), ref: 007F3074
Part of subcall function 007F3041: RegisterClassExW.USER32(00000030), ref: 007F309E
Part of subcall function 007F3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007F30AF
Part of subcall function 007F3041: InitCommonControlsEx.COMCTL32(?), ref: 007F30CC
Part of subcall function 007F3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007F30DC
Part of subcall function 007F3041: LoadIconW.USER32(000000A9), ref: 007F30F2
Part of subcall function 007F3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007F3101

Strings

AutoIt v3, xrefs: 007F3B17
0, xrefs: 007F3B06
#, xrefs: 007F3B0D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 8e96eec4eea6835eb43b9771ae18a13d247eb04568c9e0519046af119f3c0fc1
Instruction ID: e90d088144e74abfa05fd292e0fa4c18cd328c12dcd258f4f408b3e676ac731c
Opcode Fuzzy Hash: 8e96eec4eea6835eb43b9771ae18a13d247eb04568c9e0519046af119f3c0fc1
Instruction Fuzzy Hash: 91212E71D00308AFEB159FA5EC09BAD7FF5FB08711F00422AF604A63A1E7B95A649F54

Function 007F3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007F36D2
KillTimer.USER32(?,00000001), ref: 007F36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007F371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007F372A
CreatePopupMenu.USER32 ref: 007F373E
PostQuitMessage.USER32(00000000), ref: 007F375F

Strings

TaskbarCreated, xrefs: 007F3725

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 61999b893cdc260fc78707e093f8956cfedb9783e82ab78c02e97c81fbcb8627
Instruction ID: 87130c732c998868d4fb8310d17326b935ca4ef75513a2f8b6498bb4aa92a9dd
Opcode Fuzzy Hash: 61999b893cdc260fc78707e093f8956cfedb9783e82ab78c02e97c81fbcb8627
Instruction Fuzzy Hash: 0F4107B120424DEBDF147B68EC4DB7A3755FB04351F140229F706D63E2EA6C9D649272

Function 007F3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 007F380D
CMDLINE, xrefs: 007F3834
/AutoIt3OutputDebug, xrefs: 007F38A4
/AutoIt3ExecuteScript, xrefs: 007F38CE
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 007F37C0
/AutoIt3ExecuteLine, xrefs: 007F38B9
/ErrorStdOut, xrefs: 007F388F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: a8db50f958b5a0e863d0cb1194dde31df829f56e25d6aea468cefd1a210f3da8
Instruction ID: 4d484a0f2475eb5da4836f5b88233777c5851d14058081eebc9f7732e2f3d992
Opcode Fuzzy Hash: a8db50f958b5a0e863d0cb1194dde31df829f56e25d6aea468cefd1a210f3da8
Instruction Fuzzy Hash: D8A14D7181022DDADB04EFA4DC99AFEB778FF14300F040129F616A7291EB789A49CB61

Function 021D2640 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 021D2711
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 021D2937

Memory Dump Source

Source File: 00000000.00000002.1624918168.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction ID: b70bdea4d6a8140c87f4bc65121813775676dbbec243974f85d5180a243a1fbe
Opcode Fuzzy Hash: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
Instruction Fuzzy Hash: 17A11974E40209EBDB14CFA4C894BEEB7B5FF48305F2081A9E525BB281D7759A41CF94

Function 007F39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007F3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007F3A36
ShowWindow.USER32(00000000,?,?), ref: 007F3A4A
ShowWindow.USER32(00000000,?,?), ref: 007F3A53

Strings

AutoIt v3, xrefs: 007F3A0D, 007F3A12, 007F3A13
edit, xrefs: 007F3A30

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: da0194db42f4dcf1ee2fb70b980a801b441794a5623d7c8f1378fa90988c5cc2
Instruction ID: 81e6fb7727f5beeeab3d28b55c82492cf24b0161f7c30fad0db637de4b5c861f
Opcode Fuzzy Hash: da0194db42f4dcf1ee2fb70b980a801b441794a5623d7c8f1378fa90988c5cc2
Instruction Fuzzy Hash: EBF0DA716412907EFA3117276C4DE773F7DF7C6F60F00422ABA04A2275D6A95861DAB0

Function 021D2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 021D2300: Sleep.KERNELBASE(000001F4), ref: 021D2311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 021D2533

Strings

ILZXUSDMUE0O0XG0X6EJR, xrefs: 021D2596, 021D2599

Memory Dump Source

Source File: 00000000.00000002.1624918168.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateFileSleep
String ID: ILZXUSDMUE0O0XG0X6EJR
API String ID: 2694422964-1389684777
Opcode ID: 68fccddc9e9e4d201e7d657e60949ffa90c7a5c9d44d939b8a05005a6a6d6eea
Instruction ID: f208c10ad4c68db8ec805929d1c375c3e40e8369c1258a9043eda1bf54dd8864
Opcode Fuzzy Hash: 68fccddc9e9e4d201e7d657e60949ffa90c7a5c9d44d939b8a05005a6a6d6eea
Instruction Fuzzy Hash: 55518371D44249EBEF15DBA4C864BEFBB75AF09304F004199E6187B2C1D7790B44CB65

Function 007F410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0082D5EC

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

_memset.LIBCMT ref: 007F418D
_wcscpy.LIBCMT ref: 007F41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007F41F1

Strings

Line: , xrefs: 0082D615

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 93dc483e1d22c54e4529aa527b3d671241ce8414072fb078ee882f808a0b83ca
Instruction ID: b02d0979bee5f656711c286378049bf4ee63cb170225ea38341dfcfcafbe6bca
Opcode Fuzzy Hash: 93dc483e1d22c54e4529aa527b3d671241ce8414072fb078ee882f808a0b83ca
Instruction Fuzzy Hash: 7731A47100831C9BE725EB64DC4ABEB77ECBF45300F10461EF295922A1EB7C9658C792

Function 0081564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 008156AB
_memcpy_s.LIBCMT ref: 0081571D
__read_nolock.LIBCMT ref: 0081577B
__filbuf.LIBCMT ref: 0081579E
_memset.LIBCMT ref: 008157E2

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 2603aa811d4ed8b08f16e910e5b05231de67812b2c1877d62f527095aa2a9d45
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: AE518470A00B09DBDB249F69D8855EE77A9FF90324F648A29F835D62D0D7709DD08B81

Function 007F69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 007F4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,008B62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007F4F6F

_free.LIBCMT ref: 0082E68C
_free.LIBCMT ref: 0082E6D3

Part of subcall function 007F6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007F6D0D

Strings

Bad directive syntax error, xrefs: 0082E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0082E462

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 8b40d191e623a0992c9979aaa592f5a95e885480908588ec8bda59bfd1962e85
Instruction ID: 064be85897e11348fb6bf63bc72c50c517c9bdaa3fec34241a8d70bbe3007e95
Opcode Fuzzy Hash: 8b40d191e623a0992c9979aaa592f5a95e885480908588ec8bda59bfd1962e85
Instruction Fuzzy Hash: E691AB7191022DEFCF04EFA8D8859EDB7B4FF18314B04842AF915EB291EB34A945CB64

Function 007F35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,007F35A1,SwapMouseButtons,00000004,?), ref: 007F35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,007F35A1,SwapMouseButtons,00000004,?,?,?,?,007F2754), ref: 007F35F5
RegCloseKey.KERNELBASE(00000000,?,?,007F35A1,SwapMouseButtons,00000004,?,?,?,?,007F2754), ref: 007F3617

Strings

Control Panel\Mouse, xrefs: 007F35D2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 464198c90f9fdb727c8c41e0833ff9a1001e57e39bf31a38b22a43f2be3980dc
Instruction ID: 281020f3e7ae71316ec100f57ab18e4c60db9afa2130e0b1e0a06277f83b2c11
Opcode Fuzzy Hash: 464198c90f9fdb727c8c41e0833ff9a1001e57e39bf31a38b22a43f2be3980dc
Instruction Fuzzy Hash: EC113371610208BADF208F65D884EBEBBA8EF04740F008469BA09D7310E271DE409BA0

Function 021D1300 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 021D1B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 021D1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 021D1B73

Memory Dump Source

Source File: 00000000.00000002.1624918168.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 3931a71949ad18c1e99a17d065577d6672d6e72815fa24470ca2440fcab5fd1c
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: CC621A30A54658DBEB24CFA4C840BDEB372EF58300F1095A9D11DEB394E77A9E81CB59

Function 008597E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 007F5045: _fseek.LIBCMT ref: 007F505D

Part of subcall function 008599BE: _wcscmp.LIBCMT ref: 00859AAE
Part of subcall function 008599BE: _wcscmp.LIBCMT ref: 00859AC1

_free.LIBCMT ref: 0085992C
_free.LIBCMT ref: 00859933
_free.LIBCMT ref: 0085999E

Part of subcall function 00812F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00819C64), ref: 00812FA9
Part of subcall function 00812F95: GetLastError.KERNEL32(00000000,?,00819C64), ref: 00812FBB

_free.LIBCMT ref: 008599A6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: d4d9322262bd9bc662cd45ab6df2ef241338a8ac39714417a757b7591b6d4029
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: AB515DB1904218EFDF249F64DC85AAEBBB9FF48310F0004AEF649A7241DB355A94CF59

Function 0081493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008149D0
__flush.LIBCMT ref: 008149F0
__write.LIBCMT ref: 00814A23
__flsbuf.LIBCMT ref: 00814A51

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 8749060ac6f1664cf27c013120a770c9ebbe70cb4db8b6246ed6b6697066e48a
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: E041D571A0071A9BDF28CEA9D8809EF7BAEFF84360B24913DE855C7650D7719DC18B44

Function 007F73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0082EE62
GetOpenFileNameW.COMDLG32(?), ref: 0082EEAC

Part of subcall function 007F48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007F48A1,?,?,007F37C0,?), ref: 007F48CE

Part of subcall function 008109D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008109F4

Strings

X, xrefs: 0082EE7A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: f08714e14bce21c2213217243b10512a783d59bd7b7fd2a1cbf28741984615ab
Instruction ID: ca1e5de8774023862061de50af41a52d7c6559173bfe87af84dc9bfa63c2a11f
Opcode Fuzzy Hash: f08714e14bce21c2213217243b10512a783d59bd7b7fd2a1cbf28741984615ab
Instruction Fuzzy Hash: 0B219271A0425C9BDB15DB94D8497EE7BF8EF49310F004019E608E7341DBB85989CF91

Function 0085901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00859036
__fread_nolock.LIBCMT ref: 0085904B

Strings

EA06, xrefs: 0085907D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: e3e7357fd63081cf17955798a55825fd885633d168ada44b28b6168e7c7d7367
Instruction ID: 10eda43f15438d9dc34c02d01b00ed55471abdd5f5b8911e5ccd8cdd9329cc17
Opcode Fuzzy Hash: e3e7357fd63081cf17955798a55825fd885633d168ada44b28b6168e7c7d7367
Instruction Fuzzy Hash: FE01F971C04618AEDB28C7A8C856EFE7BFCEF05301F00459AF592D2181E575A608C760

Function 00859B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00859B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00859B99

Strings

aut, xrefs: 00859B93

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e3472b497e4260fca5c4399723ba060c28cd0f0d522d1395516ec745d5d6a5b8
Instruction ID: a5e6f294ac2509618651aae2e9d242fd4277b3940a1c4ba9bd0c00da9441b2bf
Opcode Fuzzy Hash: e3472b497e4260fca5c4399723ba060c28cd0f0d522d1395516ec745d5d6a5b8
Instruction Fuzzy Hash: ACD05E7954030DABDB10DB90DC0EFAA772CF704700F0042A1BF68D21A3EEB499D88B95

Function 0086CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611960dc7e14c0f374bced40d2cb82a189a0f5bc44000c5e5dbb7d8642936e12
Instruction ID: aa7656959c087d9036485e8bde91d1265075c680a8a03d943e54dda6ea54a762
Opcode Fuzzy Hash: 611960dc7e14c0f374bced40d2cb82a189a0f5bc44000c5e5dbb7d8642936e12
Instruction Fuzzy Hash: C4F13470A087059FC714DF28C484A6ABBE5FF88314F15892EF9999B352DB70E945CF82

Function 007FF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 008103A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008103D3
Part of subcall function 008103A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 008103DB
Part of subcall function 008103A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008103E6
Part of subcall function 008103A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008103F1
Part of subcall function 008103A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 008103F9
Part of subcall function 008103A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00810401

Part of subcall function 00806259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007FFA90), ref: 008062B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007FFB2D
OleInitialize.OLE32(00000000), ref: 007FFBAA
CloseHandle.KERNEL32(00000000), ref: 008349F2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 7f73b6e8d48833404d120a49f06ad8168234f9e7f545eb58b83ad1fe802063ba
Instruction ID: e6d9c8d6ac4308c48e7f7594bff826d4f308d3571d60a0a48e3fc6a07de971c4
Opcode Fuzzy Hash: 7f73b6e8d48833404d120a49f06ad8168234f9e7f545eb58b83ad1fe802063ba
Instruction Fuzzy Hash: DE81C9B1901A408EC394EF69EC456667BE4FB88318710873AD218C7372FB3D4469CF69

Function 007F43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007F44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 007F44C3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 1d92a84501e68426b2abb11fdf5a2232e2e4f9eecf15a1d1201c954ef3994bb1
Instruction ID: ae8d81aa3af5e61c96a69d956121a2cecbf0628bac32eec481203b717e089ac6
Opcode Fuzzy Hash: 1d92a84501e68426b2abb11fdf5a2232e2e4f9eecf15a1d1201c954ef3994bb1
Instruction Fuzzy Hash: 0E3161715047459FD721DF24D8847A7BBF8FB48308F000A2EF69A93351E779A948CB92

Function 0081594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00815963

Part of subcall function 0081A3AB: __NMSG_WRITE.LIBCMT ref: 0081A3D2
Part of subcall function 0081A3AB: __NMSG_WRITE.LIBCMT ref: 0081A3DC

__NMSG_WRITE.LIBCMT ref: 0081596A

Part of subcall function 0081A408: GetModuleFileNameW.KERNEL32(00000000,008B43BA,00000104,?,00000001,00000000), ref: 0081A49A
Part of subcall function 0081A408: ___crtMessageBoxW.LIBCMT ref: 0081A548

Part of subcall function 008132DF: ___crtCorExitProcess.LIBCMT ref: 008132E5
Part of subcall function 008132DF: ExitProcess.KERNEL32 ref: 008132EE

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

RtlAllocateHeap.NTDLL(01420000,00000000,00000001,00000000,?,?,?,00811013,?), ref: 0081598F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: d10370267d78eb5ccdba7197c9d1d34f654cbe0030aefc0d56cf6f3117f9a691
Instruction ID: 6ddd24a5854343461a72dcb3290692ee748e07a12ebe9fe386615e39e3aa62e4
Opcode Fuzzy Hash: d10370267d78eb5ccdba7197c9d1d34f654cbe0030aefc0d56cf6f3117f9a691
Instruction Fuzzy Hash: 9F01AD31201B19DEE6252B28F843AEA774CFF81B30F10012AF401DA292DAB09DC18263

Function 00859B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,008597D2,?,?,?,?,?,00000004), ref: 00859B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,008597D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00859B5B
CloseHandle.KERNEL32(00000000,?,008597D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00859B62

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: e0df0c3c8349a5d25fe627f265182fd7256b05dc55db1ee4c871e652f8bc746a
Instruction ID: 9bffff5a5b8830f912049c9c5a2a742b25ccaf57ad635876f11c176a6ab6d470
Opcode Fuzzy Hash: e0df0c3c8349a5d25fe627f265182fd7256b05dc55db1ee4c871e652f8bc746a
Instruction Fuzzy Hash: A8E08632581224F7E7221B65EC0DFCA7B58FB05771F104120FB58A90E187B1655197A8

Function 00858F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00858FA5

Part of subcall function 00812F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00819C64), ref: 00812FA9
Part of subcall function 00812F95: GetLastError.KERNEL32(00000000,?,00819C64), ref: 00812FBB

_free.LIBCMT ref: 00858FB6
_free.LIBCMT ref: 00858FC8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 48b1d54b1194ae5642cd71cdc09b9e9fcd979e85f70db0bfd577a681dfd6c85d
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 83E012E160D7018ADE34A57CBD44AD357EEFF4C352B18081EB849EB142DE24E8968124

Function 007FAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0083002B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 8846568fc07da1d7bc4e854585a3afd1c6b8be29e5541861724abb4375b61c35
Instruction ID: 7981ecae1b46f090b324045b99b7e5bfb3048186dd34facb78bcb424ae440a69
Opcode Fuzzy Hash: 8846568fc07da1d7bc4e854585a3afd1c6b8be29e5541861724abb4375b61c35
Instruction Fuzzy Hash: 9D2239B4508249DFC724DF14C494B6AB7E1FF84304F15895DEA9A8B362DB39EC85CB82

Function 007F4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007F4E1A

Strings

EA06, xrefs: 0082DCF5

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 9d161b4f36a1435fd16e226aaa8aef78328aeab25755d8b8b8577a88a7a9ff65
Instruction ID: 311b3eb344bf118e6b1c6044801600e9bb9cc0595f7cd08a5fba9e0ffcc51e36
Opcode Fuzzy Hash: 9d161b4f36a1435fd16e226aaa8aef78328aeab25755d8b8b8577a88a7a9ff65
Instruction Fuzzy Hash: 39417C61A0425C9BDF219B64C8557BF7FA6BF05300F684064EB82DB382C6298D8483A1

Function 007F492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 007F4992

Part of subcall function 008135AC: __lock.LIBCMT ref: 008135B2
Part of subcall function 008135AC: DecodePointer.KERNEL32(00000001,?,007F49A7,008481BC), ref: 008135BE
Part of subcall function 008135AC: EncodePointer.KERNEL32(?,?,007F49A7,008481BC), ref: 008135C9

Part of subcall function 007F4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 007F4A73
Part of subcall function 007F4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007F4A88

Part of subcall function 007F3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007F3B7A
Part of subcall function 007F3B4C: IsDebuggerPresent.KERNEL32 ref: 007F3B8C
Part of subcall function 007F3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,008B62F8,008B62E0,?,?), ref: 007F3BFD
Part of subcall function 007F3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 007F3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007F49D2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 8a88fa615d386f5e5461048bf880953c815d8df2d85d3dcd8a074b08bccd547a
Instruction ID: 5afc2a93533ef5609a9759110840f78a7fd60b745731a6d089fa9cd897010959
Opcode Fuzzy Hash: 8a88fa615d386f5e5461048bf880953c815d8df2d85d3dcd8a074b08bccd547a
Instruction Fuzzy Hash: AB11AC719183059BD300DF29DC0996ABFE8FF94710F00861EF254933A1DBB89954CB96

Function 007F5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,007F5981,?,?,?,?), ref: 007F5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,007F5981,?,?,?,?), ref: 0082E19C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 867f0c2a42699a5d69c2508ecd0b0c764038ee604066292a8b88f04d89dd91a6
Instruction ID: 7cf611fc56ee626e6c39dd717c12b45cfe81f00da476c3c5383292f5c71071e6
Opcode Fuzzy Hash: 867f0c2a42699a5d69c2508ecd0b0c764038ee604066292a8b88f04d89dd91a6
Instruction Fuzzy Hash: 7B019270244708BEF3250E24DC8AF763A9CFB01768F108328BBE55E2E0C6B45E958B64

Function 00810FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0081594C: __FF_MSGBANNER.LIBCMT ref: 00815963
Part of subcall function 0081594C: __NMSG_WRITE.LIBCMT ref: 0081596A
Part of subcall function 0081594C: RtlAllocateHeap.NTDLL(01420000,00000000,00000001,00000000,?,?,?,00811013,?), ref: 0081598F

std::exception::exception.LIBCMT ref: 0081102C
__CxxThrowException@8.LIBCMT ref: 00811041

Part of subcall function 008187DB: RaiseException.KERNEL32(?,?,?,008ABAF8,00000000,?,?,?,?,00811046,?,008ABAF8,?,00000001), ref: 00818830

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: be9b767a8529ab4bef271ce6edbe9e7b2128cea775e6b9368ace8ddefc483742
Instruction ID: c04cb2e17dd2473c86a9e46ca8e3de0b09620e901ff80f57f6c2c9d70d7756c8
Opcode Fuzzy Hash: be9b767a8529ab4bef271ce6edbe9e7b2128cea775e6b9368ace8ddefc483742
Instruction Fuzzy Hash: 62F0A43590065DE6CB20BA9CEC0A9DFBBECFF05750F100425FA04D6691DFB19EC48692

Function 0081582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0081585C
__lock_file.LIBCMT ref: 0081587D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 573946e140c5177aec3bad72cdccf84cec5fbacdacb582d9e76f03c793077f22
Instruction ID: 7626552eef094af0d1d547df7001066af1391d5e731f837b888781474bc58033
Opcode Fuzzy Hash: 573946e140c5177aec3bad72cdccf84cec5fbacdacb582d9e76f03c793077f22
Instruction Fuzzy Hash: 12018471800608EBCF12AF6DDC029DF7B69FF81760F144225B824DB1A1DB318AA1DB92

Function 008155D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

__lock_file.LIBCMT ref: 0081561B

Part of subcall function 00816E4E: __lock.LIBCMT ref: 00816E71

__fclose_nolock.LIBCMT ref: 00815626

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 2fa7b4ee21a598774402aa89bf2eb5ce7c1ca19d0e3520db9fd123c676564d47
Instruction ID: 4d2f8d7f15624ba55b07d613183bb946cb0b233a57e24d7b4e7876a88553f3a8
Opcode Fuzzy Hash: 2fa7b4ee21a598774402aa89bf2eb5ce7c1ca19d0e3520db9fd123c676564d47
Instruction Fuzzy Hash: 2EF09671804A04DAD7206B7D98037DE7799FF91334F654205A415EB1C1CF7C49819B96

Function 021D12FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 021D1B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 021D1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 021D1B73

Memory Dump Source

Source File: 00000000.00000002.1624918168.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: e094c9afbb76b39eaa87ce4e1a248d21aa64c0ba113f6554417d8fe1e9781896
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: 1112CD24E24658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4E81CF5A

Function 00802123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad3bcdc391d18aaa80ebfb3c3d27e1af0eacdc2fa37ff9f1f7ba05f7b082aaa
Instruction ID: 1f0e2b3ad9869f1e7a6eb0a0fe71778d4a70abeddd64002856fba0609ae797fc
Opcode Fuzzy Hash: 2ad3bcdc391d18aaa80ebfb3c3d27e1af0eacdc2fa37ff9f1f7ba05f7b082aaa
Instruction Fuzzy Hash: 3B517D35600618EBCF14EB68C999BBD77A5FF85314F148068FA16EB392DA34AD10CB51

Function 007F5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 007F5CF6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0ef0d2168241020228022fe3436c0e84dce6c0b44e58d794d828c8aae5e92067
Instruction ID: 4211b1ba4025f90435042e8f0654371e87948fc5be3e57a36f7fb26d75746e48
Opcode Fuzzy Hash: 0ef0d2168241020228022fe3436c0e84dce6c0b44e58d794d828c8aae5e92067
Instruction Fuzzy Hash: A6314D71A00B1AEFCB18DF2DC484A6DB7B5FF48320F148629DA1993710D775B9A0DBA0

Function 008300D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 008300E1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b8ee57d48992606625661010acb45d5bbeb770cc09cce2575cddf902235241bd
Instruction ID: 884b090099824f534fb7e2b15a1f87d3ddfca3de1188b51c921e1719e9395e06
Opcode Fuzzy Hash: b8ee57d48992606625661010acb45d5bbeb770cc09cce2575cddf902235241bd
Instruction Fuzzy Hash: 6341F6B4904345DFDB24DF14C494B2ABBE0FF45318F19889CE9998B362C335E885CB92

Function 007F5B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007F5B61

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a52255fea813044d7e92f7eb3a1101cafe8c303ff9e6477b44a6e3b3c7ad4986
Instruction ID: f9ba8efa12310483b6948897c5d246719d581e0e7a6c491b390fbaf488ccbf13
Opcode Fuzzy Hash: a52255fea813044d7e92f7eb3a1101cafe8c303ff9e6477b44a6e3b3c7ad4986
Instruction Fuzzy Hash: 6D212470A00A2CEBDF109F55F88567A7FF8FF15340F21846AEA85C1911EB7194E0DB5A

Function 007F4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F4D13: FreeLibrary.KERNEL32(00000000,?), ref: 007F4D4D

Part of subcall function 0081548B: __wfsopen.LIBCMT ref: 00815496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,008B62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007F4F6F

Part of subcall function 007F4CC8: FreeLibrary.KERNEL32(00000000), ref: 007F4D02

Part of subcall function 007F4DD0: _memmove.LIBCMT ref: 007F4E1A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 2606b20e33f70d50a606f77e8f86aaa0a4255b04cd7209cd5caafa7b66681fca
Instruction ID: 60a6c33ca34c4a9d93b9a6527725a6208bf5b108775494cb55dfb29ca2400237
Opcode Fuzzy Hash: 2606b20e33f70d50a606f77e8f86aaa0a4255b04cd7209cd5caafa7b66681fca
Instruction Fuzzy Hash: 7211C43260070DEBCB10AF74D80ABBE77E9EF40711F108429F745E63C2DA799A459760

Function 008301AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 008301BB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 0b0073c1a5274df6c8924723942a324838baab008dba6c95c0866aa34ba55e67
Instruction ID: 9e04520b543486b1ee3ce2e866fd4b46a62292ad07017ed5c08a3edfa97236b5
Opcode Fuzzy Hash: 0b0073c1a5274df6c8924723942a324838baab008dba6c95c0866aa34ba55e67
Instruction Fuzzy Hash: 362115B4908345DFCB14DF54C445B6ABBE0FF88304F058968EA9987762D735E849CB93

Function 007F5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,007F5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 007F5D76

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ae8d09bcd4d39e14a5cf48744c50fef4cea471fdc624902eaed551b75a54404f
Instruction ID: 5f0f7cd02665785ce9c281bba7b562179456cfd89b87c938b3641a2dd50394f6
Opcode Fuzzy Hash: ae8d09bcd4d39e14a5cf48744c50fef4cea471fdc624902eaed551b75a54404f
Instruction Fuzzy Hash: B8113631201B099FD3308F15C888B62B7E9FF45760F10C92EE6AA86B51D7B8E945CF60

Function 007F5BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0082E141

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 327c95574f60e5010daba2857bec39af6c2e223ed2d997c94b99b88fa264bf6e
Instruction ID: 6ccf6af93a8b0302625193ff5af2103d438195cfb1c623ce3a222559186850de
Opcode Fuzzy Hash: 327c95574f60e5010daba2857bec39af6c2e223ed2d997c94b99b88fa264bf6e
Instruction Fuzzy Hash: AC01DFB9600946AFC305DB2CC842D26FBA9FF8A3103108119F919C7702DB30EC21CBE1

Function 00810941 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008109F4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: c82232e901ec1c359836da6d4e0a0198b13dc91f96b44cd73dfe674bee6a3b41
Instruction ID: 5b587f859e7b951e5a60767f031a083a0e8b0244ba34ac4f8fce6804356c20bc
Opcode Fuzzy Hash: c82232e901ec1c359836da6d4e0a0198b13dc91f96b44cd73dfe674bee6a3b41
Instruction Fuzzy Hash: E3F0A4F35493888FC3128BA4DC44BA43BE9FE5322470A01D9DD55CB223E7E14D98DB60

Function 00814A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00814AD6

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 016bdcccbab0eaf904cfab9212be834143068646a67b4b3d258222553f143201
Instruction ID: 44baec0ee18731fc940369b60f25017195f115cc7ca8f5961b3f696bf9bd372f
Opcode Fuzzy Hash: 016bdcccbab0eaf904cfab9212be834143068646a67b4b3d258222553f143201
Instruction Fuzzy Hash: B7F0AF31940219EBDF61AF788C063DE36A9FF00335F158514B424EA1D2DB788AD2DF92

Function 007F4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,008B62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007F4FDE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d04998c64790500d1dc8adc2354f962e5ccaccf2ca34b2f5581c7600e581a8f7
Instruction ID: c0d1d952106c4e5c64152768e1c667c6c9c292057cdff84cc715082e98836bfb
Opcode Fuzzy Hash: d04998c64790500d1dc8adc2354f962e5ccaccf2ca34b2f5581c7600e581a8f7
Instruction Fuzzy Hash: A6F01571105716CFCB349F64E494863BBF5BF143293288A3EE2DA82B10C735A880DB50

Function 008109D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008109F4

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 935af3723e9bd0d99d360f56a7d1a87f72a04446fbec3b266939169b83a43964
Instruction ID: d235d6be488e71dec4949d773f78879435c6c3e3ed0a5738d156ec4b85c29ed5
Opcode Fuzzy Hash: 935af3723e9bd0d99d360f56a7d1a87f72a04446fbec3b266939169b83a43964
Instruction Fuzzy Hash: 81E08636A0422857C720D6589C09FFA77ADEF886A0F0401B5FD0CD7219DA649C818691

Function 00859129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0085914B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 58e1154f3b30e9764bd1db0942fdf5516e1258a29d652a8a1f9c75f805717608
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 84E092B0114B009FD7348A24D8507E373E0FB06316F00081CF6DAC3341EB62B8458B59

Function 007F5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0082E16B,?,?,00000000), ref: 007F5DBF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: aea8c2d28797c0ed70afe71ab3cad554a1a2eadb0172c96178e46913b476ab8d
Instruction ID: 7ef7dab09cd7e9cbc3f75bf0847747c28931ae66242aa942509a34f10a20dd87
Opcode Fuzzy Hash: aea8c2d28797c0ed70afe71ab3cad554a1a2eadb0172c96178e46913b476ab8d
Instruction Fuzzy Hash: 89D0C77464420CBFE710DB81DC46FA9777CE705710F500194FE0456690D6B27D508795

Function 0081548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00815496

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 420f9f21576c61eb5e2fc44a5cf22f269cacff7531b8a305af48e1ea023038e8
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 63B09B7544010C77DE011D45EC02A553B1D9B40674F404010FB0C18161957395A0558D

Function 0085D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0085D46A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3df47df5bc5a04bce9f3af9703497e7606ada3704790000a7df66c4442e59f49
Instruction ID: 9d1ff45aaa45570226c1a22333740f6aab24141d49807f073956c10c377e79af
Opcode Fuzzy Hash: 3df47df5bc5a04bce9f3af9703497e7606ada3704790000a7df66c4442e59f49
Instruction Fuzzy Hash: 68714D30204705CFC714EF28C495A6AB7E0FF88355F04496DFE969B3A2DB74A949CB52

Function 00810E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00810EF7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 1388fb1e2d5372d28ec8590222380b2fdc0facdebd4d70a2e98780c52907e2ad
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5331D3B0A00109DBC718DF59D8809A9F7AAFF59300B648AA5E409CB751DBB1EDC1CFC0

Function 021D2300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 021D2311

Memory Dump Source

Source File: 00000000.00000002.1624918168.00000000021D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 021D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_21d0000_2yylp1mMbi.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 5debf4ce417c73b70d84f01b424485a5ba952afbea370523e9e74663584f1e2a
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 25E0BF7498010DEFDB00EFB8D54969E7BB4EF04301F100561FD0192281D73099508A62

Non-executed Functions

Function 0087CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0087CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0087CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0087CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0087CF00
SendMessageW.USER32 ref: 0087CF29
_wcsncpy.LIBCMT ref: 0087CFA1
GetKeyState.USER32(00000011), ref: 0087CFC2
GetKeyState.USER32(00000009), ref: 0087CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0087CFE5
GetKeyState.USER32(00000010), ref: 0087CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0087D018
SendMessageW.USER32 ref: 0087D03F
SendMessageW.USER32(?,00001030,?,0087B602), ref: 0087D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0087D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0087D16E
SetCapture.USER32(?), ref: 0087D177
ClientToScreen.USER32(?,?), ref: 0087D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0087D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0087D203
ReleaseCapture.USER32 ref: 0087D20E
GetCursorPos.USER32(?), ref: 0087D248
ScreenToClient.USER32(?,?), ref: 0087D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0087D2B1
SendMessageW.USER32 ref: 0087D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0087D31C
SendMessageW.USER32 ref: 0087D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0087D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0087D37B
GetCursorPos.USER32(?), ref: 0087D39B
ScreenToClient.USER32(?,?), ref: 0087D3A8
GetParent.USER32(?), ref: 0087D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0087D431
SendMessageW.USER32 ref: 0087D462
ClientToScreen.USER32(?,?), ref: 0087D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0087D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0087D51A
SendMessageW.USER32 ref: 0087D53D
ClientToScreen.USER32(?,?), ref: 0087D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0087D5C3

Part of subcall function 007F25DB: GetWindowLongW.USER32(?,000000EB), ref: 007F25EC

GetWindowLongW.USER32(?,000000F0), ref: 0087D65F

Strings

F, xrefs: 0087D543
@GUI_DRAGID, xrefs: 0087D1AA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: c0544e6ff0a8a0ba2d9417e5548d9305e1747e2673facb71e5437612ff21073d
Instruction ID: 3316d224f71736f90805f3bf79cbf32c9550a8c3fce18c2c2aaf6b74eb507ab2
Opcode Fuzzy Hash: c0544e6ff0a8a0ba2d9417e5548d9305e1747e2673facb71e5437612ff21073d
Instruction Fuzzy Hash: 6C429C71204341AFD721CF28C888EAABBE5FF48314F14862DF699D72A5D731D991CB92

Function 0087804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0087873F

Strings

%d/%02d/%02d, xrefs: 00878478

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 4631f9d0c6afa2ce38fd9772f40d3a302fa9c819cd3a3aa45ac8638770028cc0
Instruction ID: 20d639959bd40feda140b211716c6cc5c5b703be1a2484bff786f4113ef911b5
Opcode Fuzzy Hash: 4631f9d0c6afa2ce38fd9772f40d3a302fa9c819cd3a3aa45ac8638770028cc0
Instruction Fuzzy Hash: E2129071540208EBEB258F69CC4DFAA7BA8FF45754F108129F91EDA2A5EF70C981CB10

Function 0080710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008075C2
_memset.LIBCMT ref: 008076B1
_memmove.LIBCMT ref: 00807C4B
_memmove.LIBCMT ref: 00807E4F

Strings

DEFINE, xrefs: 008425AF
[:>:]], xrefs: 0080760A
Q\E, xrefs: 008081C1
\b(?<=\w), xrefs: 00843C41
\b(?=\w), xrefs: 00843C34
[:<:]], xrefs: 008075F1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: c96e878f8ca2e4ea0ee633dd907cb54d57c1d5e0e25a7a6166dc710c25897c7c
Instruction ID: 53df9e2ede2006403a2c6311047b348bc6933d441256ffc7ed63496bea9d05e7
Opcode Fuzzy Hash: c96e878f8ca2e4ea0ee633dd907cb54d57c1d5e0e25a7a6166dc710c25897c7c
Instruction Fuzzy Hash: 61938F71E0421DDBDB24CF98C881BADB7B1FF48714F65816AE945EB281E770AE81CB50

Function 007F4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 007F4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0082DA8E
IsIconic.USER32(?), ref: 0082DA97
ShowWindow.USER32(?,00000009), ref: 0082DAA4
SetForegroundWindow.USER32(?), ref: 0082DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0082DAC4
GetCurrentThreadId.KERNEL32 ref: 0082DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0082DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0082DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0082DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0082DAF8
SetForegroundWindow.USER32(?), ref: 0082DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0082DB10
keybd_event.USER32(00000012,00000000), ref: 0082DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0082DB25
keybd_event.USER32(00000012,00000000), ref: 0082DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0082DB33
keybd_event.USER32(00000012,00000000), ref: 0082DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0082DB42
keybd_event.USER32(00000012,00000000), ref: 0082DB47
SetForegroundWindow.USER32(?), ref: 0082DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0082DB71

Strings

Shell_TrayWnd, xrefs: 0082DA89

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1a507842e9518405e7a0b563b4a45a309db1ebe581ce971b8b5aff290cfb5809
Instruction ID: 6f9d519807523b5baabc808f8dadd759565223c0657430cd7cb277259103ac53
Opcode Fuzzy Hash: 1a507842e9518405e7a0b563b4a45a309db1ebe581ce971b8b5aff290cfb5809
Instruction Fuzzy Hash: B7313571A443287BEB216F629C49F7F7E6CFB44B60F114025FB05EA1D1D6709980AAA0

Function 00848858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00848CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00848D0D
Part of subcall function 00848CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00848D3A
Part of subcall function 00848CC3: GetLastError.KERNEL32 ref: 00848D47

_memset.LIBCMT ref: 0084889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 008488ED
CloseHandle.KERNEL32(?), ref: 008488FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00848915
GetProcessWindowStation.USER32 ref: 0084892E
SetProcessWindowStation.USER32(00000000), ref: 00848938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00848952

Part of subcall function 00848713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00848851), ref: 00848728
Part of subcall function 00848713: CloseHandle.KERNEL32(?,?,00848851), ref: 0084873A

Strings

winsta0, xrefs: 00848910
, xrefs: 008488AA
default, xrefs: 0084894D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 59f2e31cf796aea989a73e3ca42f539b800f8f861c3f2385dafb35cb638893ba
Instruction ID: 07ea38417cce92393f76f535730fdb1c16026472095b5bc7a44d3dd1bfd3c7fc
Opcode Fuzzy Hash: 59f2e31cf796aea989a73e3ca42f539b800f8f861c3f2385dafb35cb638893ba
Instruction Fuzzy Hash: 2381487190021DEFDF11DFA4DC49AEEBBB8FF04344F08412AF914E6261DB718A54AB62

Function 0086425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0087F910), ref: 00864284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00864292
GetClipboardData.USER32(0000000D), ref: 0086429A
CloseClipboard.USER32 ref: 008642A6
GlobalLock.KERNEL32(00000000), ref: 008642C2
CloseClipboard.USER32 ref: 008642CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 008642E1
IsClipboardFormatAvailable.USER32(00000001), ref: 008642EE
GetClipboardData.USER32(00000001), ref: 008642F6
GlobalLock.KERNEL32(00000000), ref: 00864303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00864337
CloseClipboard.USER32 ref: 00864447

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 2cc759787f02f5c7ea2a7a881c33fd06ac82ae9ca0683143c0b352e9bafac979
Instruction ID: 52b83fe4593634e4090147dbd5ad38b70f8c6ea8579f9f036b7a829608bea17c
Opcode Fuzzy Hash: 2cc759787f02f5c7ea2a7a881c33fd06ac82ae9ca0683143c0b352e9bafac979
Instruction Fuzzy Hash: 6451AF71208305ABD300EF65EC9AF7E77A8FF94B00F114529F65AD22A2DF70D9448B62

Function 0085C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0085C9F8
FindClose.KERNEL32(00000000), ref: 0085CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0085CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0085CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0085CAAF
__swprintf.LIBCMT ref: 0085CAFB
__swprintf.LIBCMT ref: 0085CB3E

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

__swprintf.LIBCMT ref: 0085CB92

Part of subcall function 008138D8: __woutput_l.LIBCMT ref: 00813931

__swprintf.LIBCMT ref: 0085CBE0

Part of subcall function 008138D8: __flsbuf.LIBCMT ref: 00813953
Part of subcall function 008138D8: __flsbuf.LIBCMT ref: 0081396B

__swprintf.LIBCMT ref: 0085CC2F
__swprintf.LIBCMT ref: 0085CC7E
__swprintf.LIBCMT ref: 0085CCCD

Strings

%02d, xrefs: 0085CB86, 0085CB90, 0085CBDE, 0085CC2D, 0085CC7C, 0085CCCB
%4d%02d%02d%02d%02d%02d, xrefs: 0085CAF5
%4d, xrefs: 0085CB38

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: b3a41c07bd3170a0eca40235314330e053097fcbf046972cf14b7a89777b40d5
Instruction ID: f5f0b816144ea03955ec27b1f04be32c1500f8083abbd6096724930ea12f9194
Opcode Fuzzy Hash: b3a41c07bd3170a0eca40235314330e053097fcbf046972cf14b7a89777b40d5
Instruction Fuzzy Hash: BBA132B1518309EBC704EF54C889EBFB7ECFF94704F404929B695D6291EA34DA48CB62

Function 0085F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0085F221
_wcscmp.LIBCMT ref: 0085F236
_wcscmp.LIBCMT ref: 0085F24D
GetFileAttributesW.KERNEL32(?), ref: 0085F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0085F279
FindNextFileW.KERNEL32(00000000,?), ref: 0085F291
FindClose.KERNEL32(00000000), ref: 0085F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0085F2B8
_wcscmp.LIBCMT ref: 0085F2DF
_wcscmp.LIBCMT ref: 0085F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0085F308
SetCurrentDirectoryW.KERNEL32(008AA5A0), ref: 0085F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0085F330
FindClose.KERNEL32(00000000), ref: 0085F33D
FindClose.KERNEL32(00000000), ref: 0085F34F

Strings

*.*, xrefs: 0085F2B3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 35119868a549f237797030a96b5612c261f41da9d401f63be582793ebbf4190d
Instruction ID: 6fbe0fd9fcb4826f1cb589ca4803355330ce886419d4714fd6192ba9c6f7aa67
Opcode Fuzzy Hash: 35119868a549f237797030a96b5612c261f41da9d401f63be582793ebbf4190d
Instruction Fuzzy Hash: FE31C3765002196AEF10DBB5DC4CADE73ACFF09362F104175EA18D32A2EB34DA89CA54

Function 00870AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00870BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0087F910,00000000,?,00000000,?,?), ref: 00870C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00870C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00870D1D
RegCloseKey.ADVAPI32(?), ref: 0087103D
RegCloseKey.ADVAPI32(00000000), ref: 0087104A

Strings

REG_QWORD, xrefs: 00870F8B
REG_MULTI_SZ, xrefs: 00870E05
REG_DWORD, xrefs: 00870F0E
REG_SZ, xrefs: 00870D5B
REG_EXPAND_SZ, xrefs: 00870CBA
REG_BINARY, xrefs: 00870FD8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 884f57111df8f712c3e934776a203cbfcb82318b0a2d3b79c6a8f2dc4a32a34a
Instruction ID: fe8e8512898a35706fc2018dc444ac110308c4c1f5eaa09f3be071f04ef00046
Opcode Fuzzy Hash: 884f57111df8f712c3e934776a203cbfcb82318b0a2d3b79c6a8f2dc4a32a34a
Instruction Fuzzy Hash: 21024875204605DFCB14EF18C885A2AB7E5FF89714F04885DFA8A9B762CB34ED41CB82

Function 0085F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0085F37E
_wcscmp.LIBCMT ref: 0085F393
_wcscmp.LIBCMT ref: 0085F3AA

Part of subcall function 008545C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 008545DC

FindNextFileW.KERNEL32(00000000,?), ref: 0085F3D9
FindClose.KERNEL32(00000000), ref: 0085F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0085F400
_wcscmp.LIBCMT ref: 0085F427
_wcscmp.LIBCMT ref: 0085F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0085F450
SetCurrentDirectoryW.KERNEL32(008AA5A0), ref: 0085F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0085F478
FindClose.KERNEL32(00000000), ref: 0085F485
FindClose.KERNEL32(00000000), ref: 0085F497

Strings

*.*, xrefs: 0085F3FB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: a280b57d8a4dec98162ad623bc2b4c691207de32ff2ce0c1c9a4492ed37deb0b
Instruction ID: 3aa9d11db8a8c6b9b7dea0941f720cbb0df74f17eea4f7c39a6fd03b24080ed8
Opcode Fuzzy Hash: a280b57d8a4dec98162ad623bc2b4c691207de32ff2ce0c1c9a4492ed37deb0b
Instruction Fuzzy Hash: 0B3107315012196FDF109BA4EC88ADE77ACFF09365F1001B5EE14E31A2DB34DA89CA58

Function 008481F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0084874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00848766
Part of subcall function 0084874A: GetLastError.KERNEL32(?,0084822A,?,?,?), ref: 00848770
Part of subcall function 0084874A: GetProcessHeap.KERNEL32(00000008,?,?,0084822A,?,?,?), ref: 0084877F
Part of subcall function 0084874A: HeapAlloc.KERNEL32(00000000,?,0084822A,?,?,?), ref: 00848786
Part of subcall function 0084874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0084879D

Part of subcall function 008487E7: GetProcessHeap.KERNEL32(00000008,00848240,00000000,00000000,?,00848240,?), ref: 008487F3
Part of subcall function 008487E7: HeapAlloc.KERNEL32(00000000,?,00848240,?), ref: 008487FA
Part of subcall function 008487E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00848240,?), ref: 0084880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0084825B
_memset.LIBCMT ref: 00848270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0084828F
GetLengthSid.ADVAPI32(?), ref: 008482A0
GetAce.ADVAPI32(?,00000000,?), ref: 008482DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008482F9
GetLengthSid.ADVAPI32(?), ref: 00848316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00848325
HeapAlloc.KERNEL32(00000000), ref: 0084832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0084834D
CopySid.ADVAPI32(00000000), ref: 00848354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00848385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008483AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008483BF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 03e668dffdc9a4fcb6b0db06e869f2725b61ad8fdbe3ea781e3ecf9a143c47ea
Instruction ID: 30460dead3b6bc01e14ed230570f64f300afeed7a50dacb230f428257ef1f41d
Opcode Fuzzy Hash: 03e668dffdc9a4fcb6b0db06e869f2725b61ad8fdbe3ea781e3ecf9a143c47ea
Instruction Fuzzy Hash: 7D613771900619EFDF10DFA9DC88AEEBBB9FF04700F148169E915E7291DB319A45CB60

Function 00806843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF), xrefs: 00841533
LF), xrefs: 008416DD
ANY), xrefs: 00841717
LIMIT_MATCH=, xrefs: 008415A9
UTF16), xrefs: 00841508
UCP), xrefs: 00841546
NO_START_OPT), xrefs: 00841588
ANYCRLF), xrefs: 00841734
CR), xrefs: 008416C0
LIMIT_RECURSION=, xrefs: 00841635
BSR_UNICODE), xrefs: 00841771
NO_AUTO_POSSESS), xrefs: 00841567
BSR_ANYCRLF), xrefs: 00841757
CRLF), xrefs: 008416FA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: dcc14bd75d8ea9eb4b2af100539245027ceaef81a07efab731afc032ec530cb2
Instruction ID: b576fa57e0ec5a186715ded52925454f6ecabfcc44dbd3d2989efebb182b68cf
Opcode Fuzzy Hash: dcc14bd75d8ea9eb4b2af100539245027ceaef81a07efab731afc032ec530cb2
Instruction Fuzzy Hash: 0A728171E00219DBDF64CF58C8847AEBBB5FF48314F14816AE949EB280EB709D91CB91

Function 0082418A Relevance: 18.3, APIs: 12, Instructions: 273timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 008241AF

Part of subcall function 00819E4B: __mtinitlocknum.LIBCMT ref: 00819E5D
Part of subcall function 00819E4B: EnterCriticalSection.KERNEL32(00000000,?,00819CBC,0000000D), ref: 00819E76

____lc_codepage_func.LIBCMT ref: 008241F6
__getenv_helper_nolock.LIBCMT ref: 00824217
_free.LIBCMT ref: 0082424A

Part of subcall function 00812F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00819C64), ref: 00812FA9
Part of subcall function 00812F95: GetLastError.KERNEL32(00000000,?,00819C64), ref: 00812FBB

_strlen.LIBCMT ref: 00824251
__malloc_crt.LIBCMT ref: 00824258
_strlen.LIBCMT ref: 00824276
__invoke_watson.LIBCMT ref: 00824299
_free.LIBCMT ref: 008242A8
GetTimeZoneInformation.KERNEL32(008B4AF8,00000000,00000000,00000000,00000000,00000000,008AC070,00000030,00823F3B,008AC050,00000008,008170B8), ref: 008242B9
WideCharToMultiByte.KERNEL32(?,00000000,008B4AFC,000000FF,?,0000003F,00000000,?), ref: 00824332
WideCharToMultiByte.KERNEL32(?,00000000,008B4B50,000000FF,FFFFFFFE,0000003F,00000000,?), ref: 0082436B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ByteCharMultiWide_free_strlen$CriticalEnterErrorFreeHeapInformationLastSectionTimeZone____lc_codepage_func__getenv_helper_nolock__invoke_watson__lock__malloc_crt__mtinitlocknum
String ID:
API String ID: 2302051780-0
Opcode ID: f3fc9898a6d1f6e207ddd665bfed97c7051a0b026ffe28bc9ade07807f41dce4
Instruction ID: 45e4d99ed1b4ccceb04d0e10e7e15bfedc1af69f41f217fc793e51989a853e74
Opcode Fuzzy Hash: f3fc9898a6d1f6e207ddd665bfed97c7051a0b026ffe28bc9ade07807f41dce4
Instruction Fuzzy Hash: 19A19070904229DEDF15EFA9E846BADBBB8FF05710F14211AF424E7291D77489C2CB25

Function 00870665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008710A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00870038,?,?), ref: 008710BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00870737

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 008707D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0087086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00870AAD
RegCloseKey.ADVAPI32(00000000), ref: 00870ABA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: ec3e65b0ca14e49f19ac498b921044352c6f84d2f6952b68c10f66028766c16b
Instruction ID: 1c1fed52f89b26ffc8cc67be2018033e3b94caa512440027a198c51af8e520d3
Opcode Fuzzy Hash: ec3e65b0ca14e49f19ac498b921044352c6f84d2f6952b68c10f66028766c16b
Instruction Fuzzy Hash: C4E14971204214EFCB14DF29C885E6ABBE8FF89714F04C56DF54ADB2A6DA30E941CB52

Function 00850219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00850241
GetAsyncKeyState.USER32(000000A0), ref: 008502C2
GetKeyState.USER32(000000A0), ref: 008502DD
GetAsyncKeyState.USER32(000000A1), ref: 008502F7
GetKeyState.USER32(000000A1), ref: 0085030C
GetAsyncKeyState.USER32(00000011), ref: 00850324
GetKeyState.USER32(00000011), ref: 00850336
GetAsyncKeyState.USER32(00000012), ref: 0085034E
GetKeyState.USER32(00000012), ref: 00850360
GetAsyncKeyState.USER32(0000005B), ref: 00850378
GetKeyState.USER32(0000005B), ref: 0085038A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7a547699b20befe37924450f4cc77215a82119357210892e69ddfe28d65cb644
Instruction ID: a40d40f3414c2e09df6b091f76faa087fce36a937e0efa3cd8ac5f6241fdacd3
Opcode Fuzzy Hash: 7a547699b20befe37924450f4cc77215a82119357210892e69ddfe28d65cb644
Instruction Fuzzy Hash: 2C4157245047C96AFF315B64C8083E5BAA1FB11346F48419DDDC5D66C2DB9499CC8F92

Function 008686D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

CoInitialize.OLE32 ref: 00868718
CoUninitialize.OLE32 ref: 00868723
CoCreateInstance.OLE32(?,00000000,00000017,00882BEC,?), ref: 00868783
IIDFromString.OLE32(?,?), ref: 008687F6
VariantInit.OLEAUT32(?), ref: 00868890
VariantClear.OLEAUT32(?), ref: 008688F1

Strings

NULL Pointer assignment, xrefs: 008687C8
Invalid parameter, xrefs: 0086880F
Failed to create object, xrefs: 0086878E, 00868844

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 5818fa2d19c9e6cf33f0349f8ed1f22083cfe2921196b1aba9196303b0234d52
Instruction ID: 71dc8b886bd5bb06bd95acee1546f47ef10469616754e579acc76c04f7adb0f3
Opcode Fuzzy Hash: 5818fa2d19c9e6cf33f0349f8ed1f22083cfe2921196b1aba9196303b0234d52
Instruction Fuzzy Hash: DF616A70608305DFD710DF24C849A6ABBE8FF49714F114A29FA99DB291CB74ED48CB92

Function 00864458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0086447F
EmptyClipboard.USER32 ref: 00864485
GlobalAlloc.KERNEL32(00000002,?), ref: 0086449A
CloseClipboard.USER32 ref: 00864539

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 8752d2b8f15a3c315c47bc89293a34edc73651823a8de3f542560564623016e3
Instruction ID: e152a51a8977aacc58035219b9f809a7f5b9acf8d35902ecd65994c633cb93b4
Opcode Fuzzy Hash: 8752d2b8f15a3c315c47bc89293a34edc73651823a8de3f542560564623016e3
Instruction Fuzzy Hash: A1217A352052249FDB11AF25EC0DB6D77A8FF14710F11802AFA0ADB2B2DB74E850CB55

Function 00853A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007F48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007F48A1,?,?,007F37C0,?), ref: 007F48CE

Part of subcall function 00854CD3: GetFileAttributesW.KERNEL32(?,00853947), ref: 00854CD4

FindFirstFileW.KERNEL32(?,?), ref: 00853ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00853B87
MoveFileW.KERNEL32(?,?), ref: 00853B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00853BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00853BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00853BF5

Strings

\*.*, xrefs: 00853A8A, 00853A93, 00853AA8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 17c3d7d8c1d5a7979303564e642b2da7c611717e782aef55a2be919b746f398a
Instruction ID: ef6ac1ea055104226bc981b767a5edd5db5466ac6181615ddd9bbcf657b1d068
Opcode Fuzzy Hash: 17c3d7d8c1d5a7979303564e642b2da7c611717e782aef55a2be919b746f398a
Instruction Fuzzy Hash: CE517B3180514C9ACB15EBA0CD968FDB778BF14311F2441A9E946B7292EF246F0DCBA1

Function 0085F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0085F6AB
Sleep.KERNEL32(0000000A), ref: 0085F6DB
_wcscmp.LIBCMT ref: 0085F6EF
_wcscmp.LIBCMT ref: 0085F70A
FindNextFileW.KERNEL32(?,?), ref: 0085F7A8
FindClose.KERNEL32(00000000), ref: 0085F7BE

Strings

*.*, xrefs: 0085F690

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 99846553c0da02e6de1ed2b56c127d0f00f3246d6c25ce3ef2f66047697b708d
Instruction ID: 69f674212825e270c9858c625e013fc9e8e9410ea57b535f15266125faa93a1e
Opcode Fuzzy Hash: 99846553c0da02e6de1ed2b56c127d0f00f3246d6c25ce3ef2f66047697b708d
Instruction Fuzzy Hash: 6D41627190021E9FDF15DF64CC49AEEBBB4FF09311F144566EA15E2292EB349E88CB90

Function 00804140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 008044DB
VUUU, xrefs: 00837B0C
VUUU, xrefs: 008044ED
VUUU, xrefs: 00804520
ERCP, xrefs: 0080421F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 9243af4c70a475bb24f4855b6ca9aa44ef71b1e58c1e90dbc5dfb368826c0582
Instruction ID: 0f78dcd7e32e45a295b5cb1135e6fd5f762de13ab31d437d68a46b339a12b4cf
Opcode Fuzzy Hash: 9243af4c70a475bb24f4855b6ca9aa44ef71b1e58c1e90dbc5dfb368826c0582
Instruction Fuzzy Hash: AFA29EB0E4421ACBDF74CF58C9907ADB7B1FB94314F2495AAD956E7280E7309E85CB80

Function 008058C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00805A05
_memmove.LIBCMT ref: 00805A55
_memmove.LIBCMT ref: 00805ABB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 87a0bd82b18259f253f62b15dd723b405d47dba5d944e7ef9c521ee68858f84a
Instruction ID: 13128a629852d0d3c3bc84afddeec935c819f86cdc43f0f51f4c474fc103b445
Opcode Fuzzy Hash: 87a0bd82b18259f253f62b15dd723b405d47dba5d944e7ef9c521ee68858f84a
Instruction Fuzzy Hash: 5E126670A0060DDFDF14DFA8D985AAEB7B5FF48300F104629E506E6291EB35AA51CB61

Function 0085545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00848CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00848D0D
Part of subcall function 00848CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00848D3A
Part of subcall function 00848CC3: GetLastError.KERNEL32 ref: 00848D47

ExitWindowsEx.USER32(?,00000000), ref: 0085549B

Strings

SeShutdownPrivilege, xrefs: 0085546B
@, xrefs: 0085548E
, xrefs: 00855489

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: c79d05ecb30f6e803322ca6c5b393d3013915c38fafc26243ce14da958d97c81
Instruction ID: 7574db6651ad3cb2fad41c9a2dd148a65cf026bcd59f5224971cb8926dae9415
Opcode Fuzzy Hash: c79d05ecb30f6e803322ca6c5b393d3013915c38fafc26243ce14da958d97c81
Instruction Fuzzy Hash: F5017BB1654B096AF7385278DC6ABBA7258FB04353F200070FD0BD61D3DA904CC88198

Function 00866596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 008665EF
WSAGetLastError.WSOCK32(00000000), ref: 008665FE
bind.WSOCK32(00000000,?,00000010), ref: 0086661A
listen.WSOCK32(00000000,00000005), ref: 00866629
WSAGetLastError.WSOCK32(00000000), ref: 00866643
closesocket.WSOCK32(00000000,00000000), ref: 00866657

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: b94ca7072d040708ce638aba230a472a0e178ca3256fa284a3e555195860b24e
Instruction ID: 096b307d789e8aad1cd3bfa0bd4973c941127a900fe4dd6661c5f68b878e1c00
Opcode Fuzzy Hash: b94ca7072d040708ce638aba230a472a0e178ca3256fa284a3e555195860b24e
Instruction Fuzzy Hash: FF219E302002189FCB10EF68D849B7EB7A9FF45320F158169EA5AE73D2DB70AD51CB52

Function 00805680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00810FF6: std::exception::exception.LIBCMT ref: 0081102C
Part of subcall function 00810FF6: __CxxThrowException@8.LIBCMT ref: 00811041

_memmove.LIBCMT ref: 0084062F
_memmove.LIBCMT ref: 00840744
_memmove.LIBCMT ref: 008407EB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 0cb56911de8d53d5d6aafd2440256fe12aebf61a044b8c7938af324c61ad00e4
Instruction ID: 138ae608ad0aee5084e105f802c4ca6fe3c98f7ef715f8213e66f4a4503c75a2
Opcode Fuzzy Hash: 0cb56911de8d53d5d6aafd2440256fe12aebf61a044b8c7938af324c61ad00e4
Instruction Fuzzy Hash: B5028CB0E00209DBDF04DF68D985AAFBBB5FF44300F158069E906DB295EB359A51CF92

Function 007F1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 007F19FA
GetSysColor.USER32(0000000F), ref: 007F1A4E
SetBkColor.GDI32(?,00000000), ref: 007F1A61

Part of subcall function 007F1290: DefDlgProcW.USER32(?,00000020,?), ref: 007F12D8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 2914bff4968b7264e73a4c48aadc4056d59c3486f5488b267565f7094222a183
Instruction ID: 1190ae28a7ea8647fa4814a8b9e33d0038e51e5050fb59cdad11badf8f9d888b
Opcode Fuzzy Hash: 2914bff4968b7264e73a4c48aadc4056d59c3486f5488b267565f7094222a183
Instruction Fuzzy Hash: 96A178B010259CFAD628AB389C58D7F379CFB42351F94821AF312D6396DE2CDC5192B2

Function 00866A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008680A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008680CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00866AB1
WSAGetLastError.WSOCK32(00000000), ref: 00866ADA
bind.WSOCK32(00000000,?,00000010), ref: 00866B13
WSAGetLastError.WSOCK32(00000000), ref: 00866B20
closesocket.WSOCK32(00000000,00000000), ref: 00866B34

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 9573c4b9b03c9b1ba2dd93897b2cf216ad63486a1c93491b0c2601516c77b24e
Instruction ID: 69eb44a965f566837b98fae71f4d104792e2b0554ff1b170969a4d63f5b70e94
Opcode Fuzzy Hash: 9573c4b9b03c9b1ba2dd93897b2cf216ad63486a1c93491b0c2601516c77b24e
Instruction Fuzzy Hash: 8C419675600218DFEB10AF64DC8AF7E77A9EB44714F058058FB59AB3D2DA749D008792

Function 008755FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0087564C
IsWindowEnabled.USER32 ref: 0087565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00875667
IsIconic.USER32 ref: 00875675
IsZoomed.USER32 ref: 00875683

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: e93eb9b8c670ece1c31f11aebb7fbfeeec7b4698e6643ea3e884dc2162d9c8d5
Instruction ID: 1c45bbed53f8f79eeb701f8cf778523b19a72135206ce894cdd8c79368b4794e
Opcode Fuzzy Hash: e93eb9b8c670ece1c31f11aebb7fbfeeec7b4698e6643ea3e884dc2162d9c8d5
Instruction Fuzzy Hash: 52110431300A14AFE7216F26DC48B2F7798FF64760B448028FA0ED3245CBB4E941CAA5

Function 0086C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00831D88,?), ref: 0086C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0086C324

Strings

kernel32.dll, xrefs: 0086C30D
GetSystemWow64DirectoryW, xrefs: 0086C31E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: caa1dd73130ec9bc6e867a788c840dffe84c689183c913d07f1c22e7227616d3
Instruction ID: 05c1b43a60afd3f5ae005c7538f464cff556d5ffeae971cd068b3118416a7c31
Opcode Fuzzy Hash: caa1dd73130ec9bc6e867a788c840dffe84c689183c913d07f1c22e7227616d3
Instruction Fuzzy Hash: 5DE08C70200713CFDB204B26D808A5676D4FF08314F80C439E999C2311E778D880CA60

Function 00803190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 7f6fab43e4229edb232c2115f9529aeb3115ed8e2c45156b9f70bdeee844675b
Instruction ID: 6568487bc5d8a448507193f1de656aa209ea84ed38af601da7ad3ecb31e3b606
Opcode Fuzzy Hash: 7f6fab43e4229edb232c2115f9529aeb3115ed8e2c45156b9f70bdeee844675b
Instruction Fuzzy Hash: E22255B16083059FD764DF28C891B6AB7E8FF84304F10492DFA96D7291DB71EA44CB92

Function 0086F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0086F151
Process32FirstW.KERNEL32(00000000,?), ref: 0086F15F

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Process32NextW.KERNEL32(00000000,?), ref: 0086F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0086F22E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 17e7c747ea9706463a2e9ecd4a9a1d7dd5857b27e70d5dec6b3a6bcb0b5ccc28
Instruction ID: 1ba0d76c7aa19987e963fb29f6a909605683858119b25b72cca8f5aec6239f55
Opcode Fuzzy Hash: 17e7c747ea9706463a2e9ecd4a9a1d7dd5857b27e70d5dec6b3a6bcb0b5ccc28
Instruction Fuzzy Hash: AF516A71508705DBD310EF24DC89A6BBBE8FF98710F10492DF69597292EB74E908CB92

Function 008540B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 008540D1
_memset.LIBCMT ref: 008540F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00854144
CloseHandle.KERNEL32(00000000), ref: 0085414D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: ef5b0d0b4b0b5b61d335d1fcda23e36ccbea2984b28617edce4677fd71e4f0bc
Instruction ID: 2bb06a19bb6df1e7a245aac8f4bff6f27b66f125656265d02a0ff2e90f7bfd40
Opcode Fuzzy Hash: ef5b0d0b4b0b5b61d335d1fcda23e36ccbea2984b28617edce4677fd71e4f0bc
Instruction Fuzzy Hash: 5611AB759012287AD7309BA59C4DFABBB7CFF44764F1041E6F908D7180D6744EC48BA4

Function 0084EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0084EB19

Strings

|, xrefs: 0084EB49
(, xrefs: 0084EB5F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: f2b3af650a265ce06d15af52843d69e4782fdce4b6a2033761dd539a0a87dea5
Instruction ID: c4d3cf7452571dcc4bdd0753724c07ec812dd3bf195c67210b5e2749fd78cc42
Opcode Fuzzy Hash: f2b3af650a265ce06d15af52843d69e4782fdce4b6a2033761dd539a0a87dea5
Instruction Fuzzy Hash: 69323775A007099FD728CF29C48196AB7F1FF48320B15C56EE59ADB3A2DB70E981CB40

Function 008625E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 008626D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0086270C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: f81cc08e17e8d3cee4766e90de3a586b3885aac044fbc2e19baa2076cb8c6337
Instruction ID: c7d00685f0eab9e268720ecaa0651ab03a2819b24558104e692604f38d3cf766
Opcode Fuzzy Hash: f81cc08e17e8d3cee4766e90de3a586b3885aac044fbc2e19baa2076cb8c6337
Instruction Fuzzy Hash: 9141F971904A09BFEB20DE98DC85EBB77BCFB50728F1140AAF605E6140EA719D81D764

Function 0085B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0085B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0085B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0085B655

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: e0a9f50897dbcc1c13538e7656c165f09d08f5454be4f63dddfc288d12178d62
Instruction ID: 97a3bd24f55bff67d2b8bf70af26546558b1bb0d55f6eb0c25d57fd234fef2a3
Opcode Fuzzy Hash: e0a9f50897dbcc1c13538e7656c165f09d08f5454be4f63dddfc288d12178d62
Instruction Fuzzy Hash: 58213035A00618EFCB00EF65D884AEDBBB8FF49315F1480A9EA05EB351DB31A955CF51

Function 00848CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00810FF6: std::exception::exception.LIBCMT ref: 0081102C
Part of subcall function 00810FF6: __CxxThrowException@8.LIBCMT ref: 00811041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00848D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00848D3A
GetLastError.KERNEL32 ref: 00848D47

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 18fc5c48d6c1c26607709875dad2e371e8ed5678bf9495a6ba473d1f1f6cda7c
Instruction ID: 68514efe2462816e533109fcc01d977a62672ad9cbaf64c3984846b185be38b9
Opcode Fuzzy Hash: 18fc5c48d6c1c26607709875dad2e371e8ed5678bf9495a6ba473d1f1f6cda7c
Instruction Fuzzy Hash: 3F1194B1814209AFD728DF69DC85D6BB7BCFF44710B10852EF55997241DF70EC818A60

Function 00854C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00854C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00854C43
FreeSid.ADVAPI32(?), ref: 00854C53

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c9dfa819e0fa9a70869f4ef953d29dc6e18f08645679b13d5d478d78a4b9a3e8
Instruction ID: 558af4e47e6b20716b22efb6028f43a2a69805a1cbeeffe2f799c83aab7cb9aa
Opcode Fuzzy Hash: c9dfa819e0fa9a70869f4ef953d29dc6e18f08645679b13d5d478d78a4b9a3e8
Instruction Fuzzy Hash: 87F03C75911208BBDB04DFE09C89AADB7B8FB08201F004469AA05E2282D7709A448B50

Function 007FE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91accc0c8dc4ecb6b73d87599a1d158b80695cf6e8b12cd6ee7e5ebec456cfc
Instruction ID: cf1873e3b5fe2a815c399e288e00de0ec9f0f9d7395e620ce1613b764121c498
Opcode Fuzzy Hash: e91accc0c8dc4ecb6b73d87599a1d158b80695cf6e8b12cd6ee7e5ebec456cfc
Instruction Fuzzy Hash: 9422A070A00219CFDB24DF58C484ABEB7F1FF48310F148569EA56AB361E778A985CB91

Function 0085C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0085C966
FindClose.KERNEL32(00000000), ref: 0085C996

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1acbc33a08c134aa2397daf356b98e5b49c3703ae22163409cfcb494e4fff82e
Instruction ID: 26aadb43f47b9020974a7b4557c6f9666b05e8c70a6c9ede076b5ab332032f70
Opcode Fuzzy Hash: 1acbc33a08c134aa2397daf356b98e5b49c3703ae22163409cfcb494e4fff82e
Instruction Fuzzy Hash: FC1170316106049FD710DF29C849A2AB7E9FF84324F00851EF9A9D7391DB34A804CF81

Function 0085A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0086977D,?,0087FB84,?), ref: 0085A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0086977D,?,0087FB84,?), ref: 0085A314

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 2dbd24d1a86a7824cb261201d72480a0cbb633bc514673e47b11eed2d9d2e920
Instruction ID: 9285637918cbe06ce4b07848102e2b4565fbf96f49186049920da8f4abfcc594
Opcode Fuzzy Hash: 2dbd24d1a86a7824cb261201d72480a0cbb633bc514673e47b11eed2d9d2e920
Instruction Fuzzy Hash: 71F0823554422DABDB109FA4DC8DFFA776DFF08761F004265B908D6291D6309944CBA1

Function 00848713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00848851), ref: 00848728
CloseHandle.KERNEL32(?,?,00848851), ref: 0084873A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 96c0d00c61e0cc3798f915ab1d3cde632685cefc710b6fb3000116191ba83f6f
Instruction ID: e2335a63c524e193cf9c7a2e32fb65f5eb6b45bc84fabbe2200ba937f7ac8670
Opcode Fuzzy Hash: 96c0d00c61e0cc3798f915ab1d3cde632685cefc710b6fb3000116191ba83f6f
Instruction Fuzzy Hash: 98E0B676410A10EEEB256B65FC09DB77BADFF04350B24882DF69AC0475DB62ACD0DB10

Function 0081A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00818F97,?,?,?,00000001), ref: 0081A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0081A3A3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7b73c48f410e1c9a407906608766cc35365062ca2ef467b106847175165025d4
Instruction ID: c1a257123f8d19b487a91ff27c5317320eb46139adf4fb5b23a2c80dccd36a85
Opcode Fuzzy Hash: 7b73c48f410e1c9a407906608766cc35365062ca2ef467b106847175165025d4
Instruction Fuzzy Hash: DAB09231054208ABCA006B92EC0DB883F68FB54AAAF404020F70D84266CB6294908A91

Function 0081F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ab33f5ff8ec11338a7c4e457ca1f416de5a665e268a6c52c44cd291bcad287
Instruction ID: 541225d82b4119de189b136b88cf8cc84c31356657744f9bca233ae0a067f4cd
Opcode Fuzzy Hash: 17ab33f5ff8ec11338a7c4e457ca1f416de5a665e268a6c52c44cd291bcad287
Instruction Fuzzy Hash: 7132E032D69F054DD7239638D862325A25DFFB63D4F25D737E82AB59A6EB28C4C34200

Function 0082267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55fe01e6c4e6bf54b5f7ddff47de49e29d2f09756225eaac03bbab7270527a77
Instruction ID: 4a180dc2e9afcc1afcf2b613e314e4170b98cff0962221ba104435c9a735fdc7
Opcode Fuzzy Hash: 55fe01e6c4e6bf54b5f7ddff47de49e29d2f09756225eaac03bbab7270527a77
Instruction Fuzzy Hash: 12B1EE30D2AF514DE62396399831336BA4CBFBB2D5F91D71BFC2674E62EB2185834241

Function 00858B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00858B25

Part of subcall function 0081543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,008591F8,00000000,?,?,?,?,008593A9,00000000,?), ref: 00815443
Part of subcall function 0081543A: __aulldiv.LIBCMT ref: 00815463

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: d59491525fbff9db2371a46d14e5b9154faea65608bf8bf95bd772f0d64dba39
Instruction ID: 2d092c488d8def1f67a7b1581361c4226b11ea5bb7980e4c97924f395cc1ac65
Opcode Fuzzy Hash: d59491525fbff9db2371a46d14e5b9154faea65608bf8bf95bd772f0d64dba39
Instruction Fuzzy Hash: AE21E472635610CBC729CF29D841A52B3E5FFA4321B288F6DD4E5CB2D0CA74B949CB94

Function 008641FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00864218

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 05a94a51bd532a8a3e54f9fd10b2a5994d916f37231ac46fc3d20c0ab18ae49e
Instruction ID: ed17d5663f76b3ad3aa7ae50766dc6eb565d687d87e420c781e888c90ada1ddc
Opcode Fuzzy Hash: 05a94a51bd532a8a3e54f9fd10b2a5994d916f37231ac46fc3d20c0ab18ae49e
Instruction Fuzzy Hash: E7E048312441189FC710DF59D444A9AF7E8FF54760F118015FF4AD7352DA74E840CBA0

Function 00854EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00854EEC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 77a5c3ef0ce435592e317451552225ff23ad932a201adad690d42cdee7bc041e
Instruction ID: 643981d75f2a1ad66ca300f9e56ff869293c23568fbae82580c26fa8a8f9d1b2
Opcode Fuzzy Hash: 77a5c3ef0ce435592e317451552225ff23ad932a201adad690d42cdee7bc041e
Instruction Fuzzy Hash: 04D09E9916060979EF588B249C5FF771209F3007AFFD4758AB902C90C2D8D16CED6031

Function 00848C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,008488D1), ref: 00848CB3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 3a73ed92d42e61229c0fc240fac2486ff8d417a5677a69308adab74b485c0973
Instruction ID: 0504ad2dda82f862a970121c62496ea7b4243755c9de790ff1f098a8662a94b0
Opcode Fuzzy Hash: 3a73ed92d42e61229c0fc240fac2486ff8d417a5677a69308adab74b485c0973
Instruction Fuzzy Hash: 21D05E3226490EABEF018EA4DC05EAE3B69EB04B01F408111FE15C61A1C775D835AB60

Function 00832230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00832242

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 309a72c3a91bb11de8ec7d7ca3c65a68df349a92aaeb590a8f284a4b421f2315
Instruction ID: ca75b50c01483f76beaa474af002230e4390c018abee036f844fc907832dd71e
Opcode Fuzzy Hash: 309a72c3a91bb11de8ec7d7ca3c65a68df349a92aaeb590a8f284a4b421f2315
Instruction Fuzzy Hash: 7BC04CF180010DDBDF05DB90D98CDEEB7BCBB04314F144055A105F2101D7749B448A71

Function 0081A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0081A36A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 13592c9bad7be0fe96023b3119b0de69c60fdedd5be9bffd43a1769f9d554146
Instruction ID: 248b50170d1a3f56d7b8164c5a767bdc6ef957ddf81053bda6a1fb96aeb890fe
Opcode Fuzzy Hash: 13592c9bad7be0fe96023b3119b0de69c60fdedd5be9bffd43a1769f9d554146
Instruction Fuzzy Hash: A0A0113000020CAB8A002B82EC08888BFACEB002A8B008020FA0C802228B32A8A08A80

Function 00808A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a295dd7bb955af1415e4f7e5581d750e648aff7d4d484bc10c61cb80b6cd763
Instruction ID: f91bade4fa99b63c48cf4186c54625a219d185a4517cf640c7bb5522649758e3
Opcode Fuzzy Hash: 8a295dd7bb955af1415e4f7e5581d750e648aff7d4d484bc10c61cb80b6cd763
Instruction Fuzzy Hash: C522063060561DCBEFA88B18C89467DB7B1FB42314F69847AD882CB6D2DB349DC1DB61

Function 00812405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 63f63cc3553745f2bcec86193d3cba15d8aed369b7f54dc4604c22d3bc230dfc
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 16C1B3322050930ADF2D863994745BEBAE9FEA27B171A075DE4B3CB4C4EF20D5B5D620

Function 0081283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: c3a4d4be2c37dba2e67bd9d6a6e99ddff33f9ab20c43467cc188ee99124aa66d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 9EC1A4322091A309DF2D463994345BEBBE5BFA27B131A076DE4B2DB5C4EF20D5B49620

Function 00811BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0aa2172b0cdcf40c9e51e28740b3f9a910c033d567957923e77ad0a721521238
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 09C1A33220519309DF2D463994385BEBBE9FEA27B131A076DE5B3CB4C4EF20D5A5D610

Function 00867B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00867B70
DeleteObject.GDI32(00000000), ref: 00867B82
DestroyWindow.USER32 ref: 00867B90
GetDesktopWindow.USER32 ref: 00867BAA
GetWindowRect.USER32(00000000), ref: 00867BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00867CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00867D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867D4A
GetClientRect.USER32(00000000,?), ref: 00867D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00867D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867DF8
GlobalFree.KERNEL32(00000000), ref: 00867E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00882CAC,00000000), ref: 00867E2B
GlobalFree.KERNEL32(00000000), ref: 00867E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00867E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00867E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00867EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0086808F

Strings

AutoIt v3, xrefs: 00867D42
static, xrefs: 00867D8A, 00867EE1
DISPLAY, xrefs: 00867EF2
, xrefs: 00868015

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 676fc19512dabbb091eb8f81807f30e151baf67ac447f64f523fd25165d332e2
Instruction ID: b6c0e2dd4045f92203935cbbed48728fe139cfcb9c679a29c7c337ab268c2717
Opcode Fuzzy Hash: 676fc19512dabbb091eb8f81807f30e151baf67ac447f64f523fd25165d332e2
Instruction Fuzzy Hash: 8D024871900109EFDB14DF65CC89EAE7BB9FB48314F158168FA19EB2A1DB74AD40CB60

Function 008737F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0087F910), ref: 008738AF
IsWindowVisible.USER32(?), ref: 008738D3

Strings

UNCHECK, xrefs: 00873B0B
SHOWDROPDOWN, xrefs: 00873968
ADDSTRING, xrefs: 0087399E
GETSELECTED, xrefs: 00873B2B
GETLINE, xrefs: 00873C23
GETCURRENTLINE, xrefs: 00873B75
GETCURRENTSELECTION, xrefs: 00873A6B
TABLEFT, xrefs: 0087390F
GETLINECOUNT, xrefs: 00873B4E
SETCURRENTSELECTION, xrefs: 00873A3E
GETCURRENTCOL, xrefs: 00873BB0
TABRIGHT, xrefs: 00873925
SELECTSTRING, xrefs: 00873A8E
DELSTRING, xrefs: 008739D1
SENDCOMMANDID, xrefs: 00873C62
ISENABLED, xrefs: 008738F3
EDITPASTE, xrefs: 00873BE7
CHECK, xrefs: 00873AF5
ISVISIBLE, xrefs: 008738BF
FINDSTRING, xrefs: 008739FE
HIDEDROPDOWN, xrefs: 00873988
ISCHECKED, xrefs: 00873AC1
CURRENTTAB, xrefs: 00873945

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: eab274836888bfa3846f4e4fd2371bad4eba457c1c72051ae98795664f9510e1
Instruction ID: a7d1b96a4038bfae57aee6162aacfb86a11ea420a3b207fc7626f82d32ad9fbd
Opcode Fuzzy Hash: eab274836888bfa3846f4e4fd2371bad4eba457c1c72051ae98795664f9510e1
Instruction Fuzzy Hash: AFD1B430204309CBCB14EF54C845AAA7BA5FF95354F008458B98ADB3A7CB74EE4ADB43

Function 0087A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0087A89F
GetSysColorBrush.USER32(0000000F), ref: 0087A8D0
GetSysColor.USER32(0000000F), ref: 0087A8DC
SetBkColor.GDI32(?,000000FF), ref: 0087A8F6
SelectObject.GDI32(?,?), ref: 0087A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0087A930
GetSysColor.USER32(00000010), ref: 0087A938
CreateSolidBrush.GDI32(00000000), ref: 0087A93F
FrameRect.USER32(?,?,00000000), ref: 0087A94E
DeleteObject.GDI32(00000000), ref: 0087A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0087A9A0
FillRect.USER32(?,?,?), ref: 0087A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0087A9FD

Part of subcall function 0087AB60: GetSysColor.USER32(00000012), ref: 0087AB99
Part of subcall function 0087AB60: SetTextColor.GDI32(?,?), ref: 0087AB9D
Part of subcall function 0087AB60: GetSysColorBrush.USER32(0000000F), ref: 0087ABB3
Part of subcall function 0087AB60: GetSysColor.USER32(0000000F), ref: 0087ABBE
Part of subcall function 0087AB60: GetSysColor.USER32(00000011), ref: 0087ABDB
Part of subcall function 0087AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0087ABE9
Part of subcall function 0087AB60: SelectObject.GDI32(?,00000000), ref: 0087ABFA
Part of subcall function 0087AB60: SetBkColor.GDI32(?,00000000), ref: 0087AC03
Part of subcall function 0087AB60: SelectObject.GDI32(?,?), ref: 0087AC10
Part of subcall function 0087AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0087AC2F
Part of subcall function 0087AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0087AC46
Part of subcall function 0087AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0087AC5B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 44519164c4db58e181f7c6fade6f33155a41ae7bf2b9494e50af8259158aa1c3
Instruction ID: 60b54c0179a26ad06d860040e50d9bd5abfc5f4bcf19fc6825e80420fec29354
Opcode Fuzzy Hash: 44519164c4db58e181f7c6fade6f33155a41ae7bf2b9494e50af8259158aa1c3
Instruction Fuzzy Hash: 00A18F72008301EFD7159F65DC0CA6FBBA9FF88325F104A29FA6AD61A5D731D884CB52

Function 007F2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 007F2CA2
DeleteObject.GDI32(00000000), ref: 007F2CE8
DeleteObject.GDI32(00000000), ref: 007F2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 007F2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 007F2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0082C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0082C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0082CAED

Part of subcall function 007F1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007F2036,?,00000000,?,?,?,?,007F16CB,00000000,?), ref: 007F1B9A

SendMessageW.USER32(?,00001053), ref: 0082CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0082CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0082CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0082CB62

Strings

0, xrefs: 0082C981

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: dff27058778c40ece5d0244658bbcb01b2050a0ed47d494068fe84d7c7731435
Instruction ID: 5863c2d62c88906abbab5fa28ef1eed23a45f7454c651d59f63fe5ecf54b2354
Opcode Fuzzy Hash: dff27058778c40ece5d0244658bbcb01b2050a0ed47d494068fe84d7c7731435
Instruction Fuzzy Hash: D3127C30604225EFDB14CF24D898BBDBBE5FF05310F544569EA99DB262C735E882CB61

Function 008677BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 008677F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 008678B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 008678EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00867900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00867946
GetClientRect.USER32(00000000,?), ref: 00867952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00867996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 008679A5
GetStockObject.GDI32(00000011), ref: 008679B5
SelectObject.GDI32(00000000,00000000), ref: 008679B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 008679C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008679D2
DeleteDC.GDI32(00000000), ref: 008679DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00867A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00867A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00867A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00867A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00867A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00867AAE
GetStockObject.GDI32(00000011), ref: 00867AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00867AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00867ACE

Strings

AutoIt v3, xrefs: 0086793E
static, xrefs: 00867990, 00867AA8
DISPLAY, xrefs: 0086799B
msctls_progress32, xrefs: 00867A4F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9225798070e1132c01fb44fc4f2f5d5573613cbf9fda64c3ac2b4f5725f5e9d9
Instruction ID: 0962676266a600fd7586b88ddf5a105cf542198112cb94e937849eeabc0d1de3
Opcode Fuzzy Hash: 9225798070e1132c01fb44fc4f2f5d5573613cbf9fda64c3ac2b4f5725f5e9d9
Instruction Fuzzy Hash: E7A16C71A40209BFEB149BA5DC4AFAA7BB9FB44710F004224BB18E72E1D774AD40CB64

Function 0085AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0085AF89
GetDriveTypeW.KERNEL32(?,0087FAC0,?,\\.\,0087F910), ref: 0085B066
SetErrorMode.KERNEL32(00000000,0087FAC0,?,\\.\,0087F910), ref: 0085B1C4

Strings

ATAPI, xrefs: 0085B138
FileBackedVirtual, xrefs: 0085B193
RAMDisk, xrefs: 0085B090
SATA, xrefs: 0085B177
Fixed, xrefs: 0085B0AE
Virtual, xrefs: 0085B18C
USB, xrefs: 0085B15B
iSCSI, xrefs: 0085B169
Network, xrefs: 0085B0A4
ATA, xrefs: 0085B13F
CDROM, xrefs: 0085B09A
SCSI, xrefs: 0085B131
Removable, xrefs: 0085B0B8
SSA, xrefs: 0085B14D
Fibre, xrefs: 0085B154
RAID, xrefs: 0085B162
MMC, xrefs: 0085B185
1394, xrefs: 0085B146
SSD, xrefs: 0085B0F1
PhysicalDrive, xrefs: 0085B012
Unknown, xrefs: 0085B086, 0085B12A
\\.\, xrefs: 0085AFDB
SAS, xrefs: 0085B170

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 6176c4d3daa4ca5c2e708b3f921abb9992b3c8a0841f35284365f8a591732d7a
Instruction ID: 833fbc5f6983af911ac81f728ece54f954072ed5cea4669a2fd7a40a2e3dc08d
Opcode Fuzzy Hash: 6176c4d3daa4ca5c2e708b3f921abb9992b3c8a0841f35284365f8a591732d7a
Instruction Fuzzy Hash: CF51D2306C4B09EBCB48DB10C99297E73B2FB253477204015ED2AE7B91DB399D49DB52

Function 007F6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007F6A91
__wcsnicmp.LIBCMT ref: 007F6AA9
__wcsnicmp.LIBCMT ref: 007F6AC1
__wcsnicmp.LIBCMT ref: 007F6AD9
__wcsnicmp.LIBCMT ref: 007F6AF1
__wcsnicmp.LIBCMT ref: 007F6B09
__wcsnicmp.LIBCMT ref: 007F6B21
__wcsnicmp.LIBCMT ref: 007F6B35
__wcsnicmp.LIBCMT ref: 007F6B76
__wcsnicmp.LIBCMT ref: 007F6B8A
__wcsnicmp.LIBCMT ref: 007F6B9E
__wcsnicmp.LIBCMT ref: 007F6BB2

Strings

#pragma compile, xrefs: 007F6A8B
#include, xrefs: 007F6B03
#notrayicon, xrefs: 007F6AA3
#ce, xrefs: 007F6BAC
#cs, xrefs: 007F6B2F, 007F6B84
Cannot parse #include, xrefs: 0082E819
#comments-end, xrefs: 007F6B98
Bad directive syntax error, xrefs: 0082E743
#include-once, xrefs: 007F6AEB
#OnAutoItStartRegister, xrefs: 007F6AD3
#comments-start, xrefs: 007F6B1B, 007F6B70
Unterminated group of comments, xrefs: 0082E82C
#requireadmin, xrefs: 007F6ABB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 9c9baab2af493bd07ab8bd401fb65cd5e29d312362e607b2d31386379e591ed0
Instruction ID: bb5cbde396bae6d6efd1ccb7a329afb9385664e881fbebcbbc805ef30e6bb6e7
Opcode Fuzzy Hash: 9c9baab2af493bd07ab8bd401fb65cd5e29d312362e607b2d31386379e591ed0
Instruction Fuzzy Hash: 7F813DB0600619FBCB24AF64DD92FBE7758FF15300F148025FB45EA382EB68DA91C255

Function 0087AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0087AB99
SetTextColor.GDI32(?,?), ref: 0087AB9D
GetSysColorBrush.USER32(0000000F), ref: 0087ABB3
GetSysColor.USER32(0000000F), ref: 0087ABBE
CreateSolidBrush.GDI32(?), ref: 0087ABC3
GetSysColor.USER32(00000011), ref: 0087ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0087ABE9
SelectObject.GDI32(?,00000000), ref: 0087ABFA
SetBkColor.GDI32(?,00000000), ref: 0087AC03
SelectObject.GDI32(?,?), ref: 0087AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0087AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0087AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0087AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0087ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0087ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0087ACEC
DrawFocusRect.USER32(?,?), ref: 0087ACF7
GetSysColor.USER32(00000011), ref: 0087AD05
SetTextColor.GDI32(?,00000000), ref: 0087AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0087AD21
SelectObject.GDI32(?,0087A869), ref: 0087AD38
DeleteObject.GDI32(?), ref: 0087AD43
SelectObject.GDI32(?,?), ref: 0087AD49
DeleteObject.GDI32(?), ref: 0087AD4E
SetTextColor.GDI32(?,?), ref: 0087AD54
SetBkColor.GDI32(?,?), ref: 0087AD5E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: fe258e46d6f6deae236f72052abe3aaf4458148bfc058118bf21916fc3d8a455
Instruction ID: ac8e090c3486f921f06af920be8b597bcdd1f708c12da95fcdfb8d00271873a4
Opcode Fuzzy Hash: fe258e46d6f6deae236f72052abe3aaf4458148bfc058118bf21916fc3d8a455
Instruction Fuzzy Hash: 30617D71900218FFDB159FA5DC48AAE7B79FF48320F108125FA19AB2A5D771D980CB90

Function 00878C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00878D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00878D45
CharNextW.USER32(0000014E), ref: 00878D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00878DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00878DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00878DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00878DF9
SetWindowTextW.USER32(?,0000014E), ref: 00878E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00878E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00878E8C
_memset.LIBCMT ref: 00878EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00878EFA
_memset.LIBCMT ref: 00878F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00878F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00878FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00879088
InvalidateRect.USER32(?,00000000,00000001), ref: 008790AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008790F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00879121
DrawMenuBar.USER32(?), ref: 00879130
SetWindowTextW.USER32(?,0000014E), ref: 00879158

Strings

0, xrefs: 008790C2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 69c54facd075358d664352f97a98bd7bdcda339747289134e78d83eb83e4d231
Instruction ID: b5ce35f3446d05fc8cc7244541166e9900c32d7cab4c957d6155c967c8a892b9
Opcode Fuzzy Hash: 69c54facd075358d664352f97a98bd7bdcda339747289134e78d83eb83e4d231
Instruction Fuzzy Hash: D2E1AD70900209EADF209F65CC88AEE7BB9FF05714F148155FA1DEA299DB74CA81CF60

Function 00874B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00874C51
GetDesktopWindow.USER32 ref: 00874C66
GetWindowRect.USER32(00000000), ref: 00874C6D
GetWindowLongW.USER32(?,000000F0), ref: 00874CCF
DestroyWindow.USER32(?), ref: 00874CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00874D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00874D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00874D68
SendMessageW.USER32(?,00000421,?,?), ref: 00874D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00874D90
IsWindowVisible.USER32(?), ref: 00874DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00874DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00874DDF
GetWindowRect.USER32(?,?), ref: 00874DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00874E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00874E37
CopyRect.USER32(?,?), ref: 00874E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00874EB9

Strings

(, xrefs: 00874E2A
tooltips_class32, xrefs: 00874D1D
0, xrefs: 00874BFC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 36248196a5adb867f357024d05464c7f03ecafbfab13e0dac2488c9be9f6c3a4
Instruction ID: c467f5336c111a8aaf50647cb6e545fa5c3336de1f9ce97e4f7a877291930c1a
Opcode Fuzzy Hash: 36248196a5adb867f357024d05464c7f03ecafbfab13e0dac2488c9be9f6c3a4
Instruction Fuzzy Hash: EEB14771608340AFDB04DF65C848B6ABBE4FF88714F00891DF6999B2A6D775EC44CB92

Function 007F27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007F28BC
GetSystemMetrics.USER32(00000007), ref: 007F28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007F28EF
GetSystemMetrics.USER32(00000008), ref: 007F28F7
GetSystemMetrics.USER32(00000004), ref: 007F291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007F2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007F2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007F297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007F2990
GetClientRect.USER32(00000000,000000FF), ref: 007F29AE
GetStockObject.GDI32(00000011), ref: 007F29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 007F29D5

Part of subcall function 007F2344: GetCursorPos.USER32(?), ref: 007F2357
Part of subcall function 007F2344: ScreenToClient.USER32(008B67B0,?), ref: 007F2374
Part of subcall function 007F2344: GetAsyncKeyState.USER32(00000001), ref: 007F2399
Part of subcall function 007F2344: GetAsyncKeyState.USER32(00000002), ref: 007F23A7

SetTimer.USER32(00000000,00000000,00000028,007F1256), ref: 007F29FC

Strings

AutoIt v3 GUI, xrefs: 007F2974

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 592d942e562861d72913513efc700cc249775b9933d6926f67ef0ded9d37efd7
Instruction ID: 8022df7ae2e88556fc47ecd0cf9dc2e97757b5673c403a5912acd31b2ee7b136
Opcode Fuzzy Hash: 592d942e562861d72913513efc700cc249775b9933d6926f67ef0ded9d37efd7
Instruction Fuzzy Hash: FCB14B7160021AEFDB14DFA8DC49BAE7BA5FB08314F108629FA15E7391DB78D891CB50

Function 00874069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008740F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008741B6

Strings

ISSELECTED, xrefs: 008741C1
GETSELECTED, xrefs: 008742E4
VIEWCHANGE, xrefs: 00874375
GETSUBITEMCOUNT, xrefs: 00874141
GETTEXT, xrefs: 0087415F
SELECTCLEAR, xrefs: 00874235
SELECTINVERT, xrefs: 00874286
GETITEMCOUNT, xrefs: 00874128
GETSELECTEDCOUNT, xrefs: 00874199
SELECT, xrefs: 00874250
DESELECT, xrefs: 008742A4
FINDITEM, xrefs: 00874329
SELECTALL, xrefs: 0087421D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: eee34913b68a5b0ed70be1ee0a8b5297b80ae02291aef8522af2faa3451ec422
Instruction ID: 641048893e9d7d5316c699b1a3695d62d623ccbbb604cabcc3d0b34ce4d9174c
Opcode Fuzzy Hash: eee34913b68a5b0ed70be1ee0a8b5297b80ae02291aef8522af2faa3451ec422
Instruction Fuzzy Hash: 1DA1BE30214209DBCB14EF24C841A7AB7A5FF84314F108968BA9EDB7D6EB74EC45CB52

Function 008652F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00865309
LoadCursorW.USER32(00000000,00007F8A), ref: 00865314
LoadCursorW.USER32(00000000,00007F00), ref: 0086531F
LoadCursorW.USER32(00000000,00007F03), ref: 0086532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00865335
LoadCursorW.USER32(00000000,00007F01), ref: 00865340
LoadCursorW.USER32(00000000,00007F81), ref: 0086534B
LoadCursorW.USER32(00000000,00007F88), ref: 00865356
LoadCursorW.USER32(00000000,00007F80), ref: 00865361
LoadCursorW.USER32(00000000,00007F86), ref: 0086536C
LoadCursorW.USER32(00000000,00007F83), ref: 00865377
LoadCursorW.USER32(00000000,00007F85), ref: 00865382
LoadCursorW.USER32(00000000,00007F82), ref: 0086538D
LoadCursorW.USER32(00000000,00007F84), ref: 00865398
LoadCursorW.USER32(00000000,00007F04), ref: 008653A3
LoadCursorW.USER32(00000000,00007F02), ref: 008653AE
GetCursorInfo.USER32(?), ref: 008653BE
GetLastError.KERNEL32(00000001,00000000), ref: 008653E9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 0b9b1329551c5f0992913fefd1023fbf4291cd5e7ac4e599cfe113ae007be6be
Instruction ID: eca97f3999af2a45fc2aa59e346d50c77d6e4523a400065c1efc9aa66680438b
Opcode Fuzzy Hash: 0b9b1329551c5f0992913fefd1023fbf4291cd5e7ac4e599cfe113ae007be6be
Instruction Fuzzy Hash: D9417370E043196ADB109FBA8C4996EFFF8FF51B50F10452FA509E7291DAB89400CE65

Function 0084AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0084AAA5
__swprintf.LIBCMT ref: 0084AB46
_wcscmp.LIBCMT ref: 0084AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0084ABAE
_wcscmp.LIBCMT ref: 0084ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0084AC21
GetDlgCtrlID.USER32(?), ref: 0084AC73
GetWindowRect.USER32(?,?), ref: 0084ACA9
GetParent.USER32(?), ref: 0084ACC7
ScreenToClient.USER32(00000000), ref: 0084ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0084AD48
_wcscmp.LIBCMT ref: 0084AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0084AD82
_wcscmp.LIBCMT ref: 0084AD96

Part of subcall function 0081386C: _iswctype.LIBCMT ref: 00813874

Strings

%s%u, xrefs: 0084AB40

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 145e00d7737de9c0b76c2f742b3130c041e09047327205778305f840ccb4a190
Instruction ID: 36c253639d2ad62f130841ee3ebac1233fc1105b970e3dee9da7f5de6cf8040e
Opcode Fuzzy Hash: 145e00d7737de9c0b76c2f742b3130c041e09047327205778305f840ccb4a190
Instruction Fuzzy Hash: 94A1D17164430AAFDB18DF64C884BEAB7E8FF04355F004629FA99CA191D730E955CB92

Function 0084B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0084B3DB
_wcscmp.LIBCMT ref: 0084B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0084B414
CharUpperBuffW.USER32(?,00000000), ref: 0084B431
_wcscmp.LIBCMT ref: 0084B44F
_wcsstr.LIBCMT ref: 0084B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0084B498
_wcscmp.LIBCMT ref: 0084B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0084B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0084B518
_wcscmp.LIBCMT ref: 0084B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0084B550
GetWindowRect.USER32(00000004,?), ref: 0084B5B9

Strings

ThumbnailClass, xrefs: 0084B4A3, 0084B523
@, xrefs: 0084B3BC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 7f61d831b394cfb847d6194e7bd9244a46d60fc0fbe81af78a362ce8d54a87cb
Instruction ID: 5711ef35c8d648f071ba1d69c9579340e6a2f98f3dc46b01e42287a36381ee6b
Opcode Fuzzy Hash: 7f61d831b394cfb847d6194e7bd9244a46d60fc0fbe81af78a362ce8d54a87cb
Instruction Fuzzy Hash: FF819E710083099BDB04DF15C885FAABBE8FF54314F08856AFE89DA196DB34DD85CBA1

Function 0084B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0084B23F

Strings

ACTIVE, xrefs: 0084B21A
[REGEXPTITLE:, xrefs: 0084B267
[LAST, xrefs: 0084B2EC
ALL, xrefs: 0084B2D3
HANDLE=, xrefs: 0084B238
[HANDLE:, xrefs: 0084B24B
CLASSNAME=, xrefs: 0084B27C
[ACTIVE, xrefs: 0084B22C
REGEXP=, xrefs: 0084B254
LAST, xrefs: 0084B204
[ALL, xrefs: 0084B2E5
[CLASS:, xrefs: 0084B28F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0b1dd17ea7e7dbb41392c9ab32c858a84a4a61604b72cd1016ea7ecbbb8fc91e
Instruction ID: ef68455a901ba15ec6ff801ba8a21b023d52077ee7e7aaaa2743e92a1b347fa6
Opcode Fuzzy Hash: 0b1dd17ea7e7dbb41392c9ab32c858a84a4a61604b72cd1016ea7ecbbb8fc91e
Instruction Fuzzy Hash: 11318C3060821DA6EB14EE64CD43AEE76A8FF21750F600129F591F16D2EBA9AE04C562

Function 0084C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0084C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0084C4E6
SetWindowTextW.USER32(?,?), ref: 0084C4FD
GetDlgItem.USER32(?,000003EA), ref: 0084C512
SetWindowTextW.USER32(00000000,?), ref: 0084C518
GetDlgItem.USER32(?,000003E9), ref: 0084C528
SetWindowTextW.USER32(00000000,?), ref: 0084C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0084C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0084C569
GetWindowRect.USER32(?,?), ref: 0084C572
SetWindowTextW.USER32(?,?), ref: 0084C5DD
GetDesktopWindow.USER32 ref: 0084C5E3
GetWindowRect.USER32(00000000), ref: 0084C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0084C636
GetClientRect.USER32(?,?), ref: 0084C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0084C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0084C693

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 48f18232b77a408df9448baf4190b14c4582856d501dd18bccbe135af3a91f97
Instruction ID: 4be0ea61f376f5163790094f5a1fd6ae38a050c5069be79f62b0ad7cdcacad3a
Opcode Fuzzy Hash: 48f18232b77a408df9448baf4190b14c4582856d501dd18bccbe135af3a91f97
Instruction Fuzzy Hash: 7D517A70900709AFDB20DFA9DE89B6EBBF9FF14705F004928E686E25A1D774E944CB50

Function 0087A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087A4C8
DestroyWindow.USER32(?,?), ref: 0087A542

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0087A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0087A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0087A5F1
DestroyWindow.USER32(00000000), ref: 0087A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007F0000,00000000), ref: 0087A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0087A663
GetDesktopWindow.USER32 ref: 0087A67C
GetWindowRect.USER32(00000000), ref: 0087A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0087A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0087A6B3

Part of subcall function 007F25DB: GetWindowLongW.USER32(?,000000EB), ref: 007F25EC

Strings

0, xrefs: 0087A4DE
tooltips_class32, xrefs: 0087A5B5, 0087A643

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 626fb37abd40aacbc94d86c322aaf502bc093b4c0f2de2320f6c64b556f87d24
Instruction ID: 5d593b6e34e2790a39b08e80fce5980e0e89bd0456713c5ad71ec3bdaaf0e1ec
Opcode Fuzzy Hash: 626fb37abd40aacbc94d86c322aaf502bc093b4c0f2de2320f6c64b556f87d24
Instruction Fuzzy Hash: 0C71CF71140205AFD725CF28CC49F6A7BE5FB98704F18852CFA99C72A1D774E952CB12

Function 0087C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

DragQueryPoint.SHELL32(?,?), ref: 0087C917

Part of subcall function 0087ADF1: ClientToScreen.USER32(?,?), ref: 0087AE1A
Part of subcall function 0087ADF1: GetWindowRect.USER32(?,?), ref: 0087AE90
Part of subcall function 0087ADF1: PtInRect.USER32(?,?,0087C304), ref: 0087AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0087C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0087C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0087C9AE
_wcscat.LIBCMT ref: 0087C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0087C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0087CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0087CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0087CA47
DragFinish.SHELL32(?), ref: 0087CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0087CB41

Strings

@GUI_DRAGFILE, xrefs: 0087CAF0
@GUI_DROPID, xrefs: 0087CA6E
@GUI_DRAGID, xrefs: 0087CAB9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 8b28099b873e37d56a5dab5f2910799000754fee5cad1033b9ff072a42899596
Instruction ID: 4c4a5a825d246d88a431ff4dde31163bed8b9a00eab619bf9b27f44ad0ba2eb5
Opcode Fuzzy Hash: 8b28099b873e37d56a5dab5f2910799000754fee5cad1033b9ff072a42899596
Instruction Fuzzy Hash: D4615A71108304AFC701DF64D889DAFBBE8FF99710F004A2DF695962A1EB74DA49CB52

Function 00874619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008746AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008746F6

Strings

GETTEXT, xrefs: 00874849
EXPAND, xrefs: 008747A8
UNCHECK, xrefs: 008748D2
GETSELECTED, xrefs: 00874806
CHECK, xrefs: 00874716
EXISTS, xrefs: 0087475F
GETITEMCOUNT, xrefs: 008747D8
GETTOTALCOUNT, xrefs: 008746DD
COLLAPSE, xrefs: 0087473C
ISCHECKED, xrefs: 00874879
SELECT, xrefs: 008748A7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 2ff69282ba77dde015143ce2fc8f792521a6f2b220ebe70fa7e52fe0d4980b38
Instruction ID: b83f08270535f9b4f662cee904015cd9af940f6c1fdd89148b3e89db4bebbbf9
Opcode Fuzzy Hash: 2ff69282ba77dde015143ce2fc8f792521a6f2b220ebe70fa7e52fe0d4980b38
Instruction Fuzzy Hash: DD91A130204309CBCB14EF14C851A6AB7A5FF95354F00846CFA9A9B7A2DB74ED49CB42

Function 0087BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0087BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00876D80,?), ref: 0087BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0087BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0087BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0087BC7D
FreeLibrary.KERNEL32(?), ref: 0087BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0087BC99
DestroyIcon.USER32(?), ref: 0087BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0087BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0087BCD1

Part of subcall function 0081313D: __wcsicmp_l.LIBCMT ref: 008131C6

Strings

.icl, xrefs: 0087BAE4
.exe, xrefs: 0087BB04
.dll, xrefs: 0087BB27

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: adc40e45830baf95cece578303ac0c78b3f1f50cd8983d8fcc9aaaa611a2db5d
Instruction ID: 267d896b1a5f9bd66862d4c2976908ac468e87d7a18199aa3b54712e651111ae
Opcode Fuzzy Hash: adc40e45830baf95cece578303ac0c78b3f1f50cd8983d8fcc9aaaa611a2db5d
Instruction Fuzzy Hash: C461CE71500219FAEB14DF65CC86BBA77ACFF08720F10811AFA19D61D5DB74E990CBA0

Function 0085A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

CharLowerBuffW.USER32(?,?), ref: 0085A636
GetDriveTypeW.KERNEL32 ref: 0085A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0085A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0085A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0085A730

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Strings

wait, xrefs: 0085A6ED
closed, xrefs: 0085A64A, 0085A653
close, xrefs: 0085A63C
open , xrefs: 0085A692
type cdaudio alias cd wait, xrefs: 0085A6AE
close cd wait, xrefs: 0085A71B
set cd door , xrefs: 0085A6D1
open, xrefs: 0085A65D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 75e7d22cf449a5d96f1fdbaa29907e0d8f18daa44cf0ab10d305c931bcc8eeae
Instruction ID: a1cce7baa0aea8c84b15f2ef69161be630fa5bcf40039c3d561e177461745534
Opcode Fuzzy Hash: 75e7d22cf449a5d96f1fdbaa29907e0d8f18daa44cf0ab10d305c931bcc8eeae
Instruction Fuzzy Hash: 42516B711042089FC704EF10C88596AB7E8FF98758F04896CF99697351DB35EE0ACB52

Function 0085A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0085A47A
__swprintf.LIBCMT ref: 0085A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0085A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0085A4FE
_memset.LIBCMT ref: 0085A51D
_wcsncpy.LIBCMT ref: 0085A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0085A58E
CloseHandle.KERNEL32(00000000), ref: 0085A599
RemoveDirectoryW.KERNEL32(?), ref: 0085A5A2
CloseHandle.KERNEL32(00000000), ref: 0085A5AC

Strings

:, xrefs: 0085A4BD
\, xrefs: 0085A4B2
\??\%s, xrefs: 0085A496

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 763d0249c46b93ccf907f915171fe13ce024602859e2c1509e79a46b0cdf1916
Instruction ID: c0dbfcdc45bfc5ab194ab7d807dc7d7f72b451475587cfba8051d40764d30754
Opcode Fuzzy Hash: 763d0249c46b93ccf907f915171fe13ce024602859e2c1509e79a46b0cdf1916
Instruction Fuzzy Hash: CF31B0B1500109ABDB21DFA1DC88FEB77BCFF88701F1041B6FA08D2165EB7096888B25

Function 0082AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0082AB7B
___wtomb_environ.LIBCMT ref: 0082AB9D

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

__malloc_crt.LIBCMT ref: 0082ABC5
__malloc_crt.LIBCMT ref: 0082ABE2
_free.LIBCMT ref: 0082AC19
__recalloc_crt.LIBCMT ref: 0082AC52
__recalloc_crt.LIBCMT ref: 0082AC97
_strlen.LIBCMT ref: 0082ACC3
__calloc_crt.LIBCMT ref: 0082ACCD
_strlen.LIBCMT ref: 0082ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0082AD0A
_free.LIBCMT ref: 0082AD24
_free.LIBCMT ref: 0082AD31
_free.LIBCMT ref: 0082AD43
__invoke_watson.LIBCMT ref: 0082AD5D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 53f936cfac1a40479dc98b164138d42699c5534ddc0b1e668049253a77c4c028
Instruction ID: 8b84a032d6d77e94e2fe9f36bc3468070845278f2210aa668905031f35e17cfc
Opcode Fuzzy Hash: 53f936cfac1a40479dc98b164138d42699c5534ddc0b1e668049253a77c4c028
Instruction Fuzzy Hash: C161D1B2900225EFDB285F28F842BA977ADFF11731F244655E801DB292DB3589C1CB93

Function 0085DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0085DC7B
_wcscat.LIBCMT ref: 0085DC93
_wcscat.LIBCMT ref: 0085DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0085DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0085DCCE
GetFileAttributesW.KERNEL32(?), ref: 0085DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0085DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0085DD12

Strings

*.*, xrefs: 0085DD51

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 3b5947d37a378f54b714c587ea4ec707c99f397d5a785e916f040989c0666261
Instruction ID: eb4e42f4f39fbfffd93aff3b854665fb42befd4192ba17bfb54096d28f31a96e
Opcode Fuzzy Hash: 3b5947d37a378f54b714c587ea4ec707c99f397d5a785e916f040989c0666261
Instruction Fuzzy Hash: 28817D715043459FCB34EF24C8859AAB7E9FB88315F15882AFD89C7251E634ED88CB52

Function 0087C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0087C4EC
GetFocus.USER32 ref: 0087C4FC
GetDlgCtrlID.USER32(00000000), ref: 0087C507
_memset.LIBCMT ref: 0087C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0087C65D
GetMenuItemCount.USER32(?), ref: 0087C67D
GetMenuItemID.USER32(?,00000000), ref: 0087C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0087C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0087C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0087C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0087C779

Strings

0, xrefs: 0087C62A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 754c2b9a852af2cda29ae3d6bc54097a629e907a6a5a9eba3e7d024008976720
Instruction ID: e757aa3db876773449ee0f53064e3f12a4d790c86a1d54f1817e293a29b4147a
Opcode Fuzzy Hash: 754c2b9a852af2cda29ae3d6bc54097a629e907a6a5a9eba3e7d024008976720
Instruction Fuzzy Hash: 0D818D702083059FD714CF19C884AABBBE8FF98354F04852DFA99D7295DB31D945CBA2

Function 008483F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0084874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00848766
Part of subcall function 0084874A: GetLastError.KERNEL32(?,0084822A,?,?,?), ref: 00848770
Part of subcall function 0084874A: GetProcessHeap.KERNEL32(00000008,?,?,0084822A,?,?,?), ref: 0084877F
Part of subcall function 0084874A: HeapAlloc.KERNEL32(00000000,?,0084822A,?,?,?), ref: 00848786
Part of subcall function 0084874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0084879D

Part of subcall function 008487E7: GetProcessHeap.KERNEL32(00000008,00848240,00000000,00000000,?,00848240,?), ref: 008487F3
Part of subcall function 008487E7: HeapAlloc.KERNEL32(00000000,?,00848240,?), ref: 008487FA
Part of subcall function 008487E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00848240,?), ref: 0084880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00848458
_memset.LIBCMT ref: 0084846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0084848C
GetLengthSid.ADVAPI32(?), ref: 0084849D
GetAce.ADVAPI32(?,00000000,?), ref: 008484DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008484F6
GetLengthSid.ADVAPI32(?), ref: 00848513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00848522
HeapAlloc.KERNEL32(00000000), ref: 00848529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0084854A
CopySid.ADVAPI32(00000000), ref: 00848551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00848582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008485A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008485BC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 0105209d78e9aacbb7f5802c88fbae4b8886a8db83c862bc837c06619c1aef02
Instruction ID: 3159548d606555ecd2a3eb153e932ffb541a345e0f5427cd180e0c1fbba19b72
Opcode Fuzzy Hash: 0105209d78e9aacbb7f5802c88fbae4b8886a8db83c862bc837c06619c1aef02
Instruction Fuzzy Hash: 9E61347190021AEFDF00DFA9DC49AAEBBB9FF04300F148169E919E6291DB31DA45DF60

Function 0086762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008676A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 008676AE
CreateCompatibleDC.GDI32(?), ref: 008676BA
SelectObject.GDI32(00000000,?), ref: 008676C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0086771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00867757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0086777B
SelectObject.GDI32(00000006,?), ref: 00867783
DeleteObject.GDI32(?), ref: 0086778C
DeleteDC.GDI32(00000006), ref: 00867793
ReleaseDC.USER32(00000000,?), ref: 0086779E

Strings

(, xrefs: 00867723

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 6c5254bfff1875f62ec7a16ca73ded2e43ec2f8823fa3ab30a7b93361413c5a1
Instruction ID: 9a35379ab06075c3d3dabd8b49190556bfeb3ed0d09c2c437f17e460647e2c02
Opcode Fuzzy Hash: 6c5254bfff1875f62ec7a16ca73ded2e43ec2f8823fa3ab30a7b93361413c5a1
Instruction Fuzzy Hash: 1A515A75904609EFCB15CFA9DC88EAEBBB9FF48710F148429FA49D7211D731A840CBA0

Function 0085A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0087FB78), ref: 0085A0FC

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0085A11E
__swprintf.LIBCMT ref: 0085A177
__swprintf.LIBCMT ref: 0085A190
_wprintf.LIBCMT ref: 0085A246
_wprintf.LIBCMT ref: 0085A264

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 0085A241
"%s" (%d) : ==> %s:, xrefs: 0085A25F
Error: , xrefs: 0085A20E
^ ERROR, xrefs: 0085A1E8
Line %d (File "%s"):, xrefs: 0085A171, 0085A18A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 2d1b839cb1ffa5d24ea488382304b43341d59abbf888d512edef460d5ae6eb35
Instruction ID: b122845930c5cf96fee40208fcea7afa3aa23eacc76ebdd051c12cd88c057847
Opcode Fuzzy Hash: 2d1b839cb1ffa5d24ea488382304b43341d59abbf888d512edef460d5ae6eb35
Instruction Fuzzy Hash: B551413190450DEADF19EBA0CD86EEEB779FF04301F104265F615A22A2EB396F58CB51

Function 007F6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00810B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,007F6C6C,?,00008000), ref: 00810BB7

Part of subcall function 007F48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007F48A1,?,?,007F37C0,?), ref: 007F48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007F6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 007F6E5A

Part of subcall function 007F59CD: _wcscpy.LIBCMT ref: 007F5A05

Part of subcall function 0081387D: _iswctype.LIBCMT ref: 00813885

Strings

Bad directive syntax error, xrefs: 0082EBC6
AU3!, xrefs: 007F6CC1
>>>AUTOIT SCRIPT<<<, xrefs: 0082E8BF
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0082E84A
EA06, xrefs: 0082E87B
Unterminated string, xrefs: 0082EC0D
Error opening the file, xrefs: 0082E866, 0082E8E1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: ea702504b48e9128862e7094bccf36119448501f0127ea741ace7c1449266f03
Instruction ID: 10072b86eb3ac4f1d29ae6c77fbd22401cc1c553aed6268e0a97c8916469e078
Opcode Fuzzy Hash: ea702504b48e9128862e7094bccf36119448501f0127ea741ace7c1449266f03
Instruction Fuzzy Hash: BA027831108344DFC724EF24C885AAFBBE5FF99314F04491DF696972A2DB349989CB52

Function 007F45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F45F9
GetMenuItemCount.USER32(008B6890), ref: 0082D7CD
GetMenuItemCount.USER32(008B6890), ref: 0082D87D
GetCursorPos.USER32(?), ref: 0082D8C1
SetForegroundWindow.USER32(00000000), ref: 0082D8CA
TrackPopupMenuEx.USER32(008B6890,00000000,?,00000000,00000000,00000000), ref: 0082D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0082D8E9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: d0ca9019c7f3dc28f00a29b791794e4f86d5e7e369b73b2a5a6e7b098e99e5b7
Instruction ID: bae0a142b2b8a2cc6264e204a5fe742b5411dfe6aec82e3fdac782430c4f93fb
Opcode Fuzzy Hash: d0ca9019c7f3dc28f00a29b791794e4f86d5e7e369b73b2a5a6e7b098e99e5b7
Instruction Fuzzy Hash: 6B71D570605219BFFB209F15EC89FAABF64FF05354F204216F618E62D1C7B59890DB91

Function 008710A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00870038,?,?), ref: 008710BC

Strings

HKCC, xrefs: 0087118A
HKEY_CURRENT_CONFIG, xrefs: 00871179
HKCU, xrefs: 008711AC
HKEY_USERS, xrefs: 008711BD
HKLM, xrefs: 0087113A
HKU, xrefs: 008711CE
HKEY_CURRENT_USER, xrefs: 0087119B
HKEY_LOCAL_MACHINE, xrefs: 00871125
HKCR, xrefs: 00871164
HKEY_CLASSES_ROOT, xrefs: 0087114F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 8952d762d7dc0056f1689839f6909c54b4d047a2da64753b84d75ca42cc0634a
Instruction ID: 50b169c2172fc9ba84561eac07c05d6acdcd8238879190f05fea5702f0406fa1
Opcode Fuzzy Hash: 8952d762d7dc0056f1689839f6909c54b4d047a2da64753b84d75ca42cc0634a
Instruction Fuzzy Hash: 8B41713011024ECBDF10EF98EC956EA3724FF12300F508514ED99DBA56DB74E99ACB61

Function 00855569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Part of subcall function 007F7A84: _memmove.LIBCMT ref: 007F7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 008555D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 008555E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008555F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0085560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0085561C

Strings

close PlayMe, xrefs: 008555E3, 00855610
open , xrefs: 00855581
play PlayMe wait, xrefs: 00855606
play PlayMe, xrefs: 00855617
alias PlayMe, xrefs: 008555AB
status PlayMe mode, xrefs: 008555CD

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: d25803242a9edbe54449b867fa145f38a6da87852db70d5c44016f38393ad7fd
Instruction ID: afebbab8c3667f66e5df5fd7c8821115c2b822038abc6832fbc7a6b600bd1185
Opcode Fuzzy Hash: d25803242a9edbe54449b867fa145f38a6da87852db70d5c44016f38393ad7fd
Instruction Fuzzy Hash: 1311B23065016DB9EB28B6A1CC5ADFFBB7CFF92B40F400469B911E26D1EF684D09C5A1

Function 008548F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0085490E
gethostname.WSOCK32(?,00000100), ref: 00854928
gethostbyname.WSOCK32(?), ref: 00854935
_wcscpy.LIBCMT ref: 0085495D
_memmove.LIBCMT ref: 00854970
inet_ntoa.WSOCK32(?), ref: 0085497B
_strcat.LIBCMT ref: 00854989
_wcscpy.LIBCMT ref: 008549A0
WSACleanup.WSOCK32 ref: 008549AE
_wcscpy.LIBCMT ref: 008549BC

Strings

0.0.0.0, xrefs: 00854957

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: fff91d165784222587e181a02dd9cdeb6399ed87fbd09f461d1d7574f5407d82
Instruction ID: 218814a6e7e358985ced8d156a06ab8c8345964b0228c381fff75fcde38bca06
Opcode Fuzzy Hash: fff91d165784222587e181a02dd9cdeb6399ed87fbd09f461d1d7574f5407d82
Instruction Fuzzy Hash: 3611D532904114ABCB24EB25EC0AEDB7BACFF01715F040175F949D6166EF70DAC58752

Function 00855217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0085521C

Part of subcall function 00810719: timeGetTime.WINMM(?,75C0B400,00800FF9), ref: 0081071D

Sleep.KERNEL32(0000000A), ref: 00855248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0085526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0085528E
SetActiveWindow.USER32 ref: 008552AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 008552BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 008552DA
Sleep.KERNEL32(000000FA), ref: 008552E5
IsWindow.USER32 ref: 008552F1
EndDialog.USER32(00000000), ref: 00855302

Strings

BUTTON, xrefs: 00855280

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: c610813b161a61515bc994214764fc4340b303e3c451c6e6bc98b89011d98680
Instruction ID: aa148e4c912e2075a9f40489df92593015691201dee9b5382c45fb205e8efb84
Opcode Fuzzy Hash: c610813b161a61515bc994214764fc4340b303e3c451c6e6bc98b89011d98680
Instruction Fuzzy Hash: 0A21A470104704AFE7115B71EC9CA263B69FB55787F040534F909C26B2DB65AC98DB22

Function 0085D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

CoInitialize.OLE32(00000000), ref: 0085D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0085D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0085D8FC
CoCreateInstance.OLE32(00882D7C,00000000,00000001,008AA89C,?), ref: 0085D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0085D9B7
CoTaskMemFree.OLE32(?,?), ref: 0085DA0F
_memset.LIBCMT ref: 0085DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0085DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0085DAAB
CoTaskMemFree.OLE32(00000000), ref: 0085DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0085DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0085DAEB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 77ec6260931362a18561d1f22826aa3ac0542ff45dd8c6a80bd92db9501c901a
Instruction ID: ba7fb5b36822d3564705d4adbeaacbd915aa57eae6e0060e21c755e194735f5f
Opcode Fuzzy Hash: 77ec6260931362a18561d1f22826aa3ac0542ff45dd8c6a80bd92db9501c901a
Instruction Fuzzy Hash: 67B1FB75A00219EFDB14DFA4C888EAEBBB9FF48305B048469F909EB251DB30ED45CB51

Function 0085052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008505A7
SetKeyboardState.USER32(?), ref: 00850612
GetAsyncKeyState.USER32(000000A0), ref: 00850632
GetKeyState.USER32(000000A0), ref: 00850649
GetAsyncKeyState.USER32(000000A1), ref: 00850678
GetKeyState.USER32(000000A1), ref: 00850689
GetAsyncKeyState.USER32(00000011), ref: 008506B5
GetKeyState.USER32(00000011), ref: 008506C3
GetAsyncKeyState.USER32(00000012), ref: 008506EC
GetKeyState.USER32(00000012), ref: 008506FA
GetAsyncKeyState.USER32(0000005B), ref: 00850723
GetKeyState.USER32(0000005B), ref: 00850731

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 8e5160b1579816357aec11c256e614915227a7e318645c24615cbf1d5237b48d
Instruction ID: 28b2d80bbae0fd1d4a6c8932b60a3b2559bd3e2c5399e67b4794be0ff927ccfb
Opcode Fuzzy Hash: 8e5160b1579816357aec11c256e614915227a7e318645c24615cbf1d5237b48d
Instruction Fuzzy Hash: EA51D960A0478819FF35DBA484547EABFF4FF11381F0845999DC29A1C2EA649A8CCF52

Function 0084C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0084C746
GetWindowRect.USER32(00000000,?), ref: 0084C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0084C7B6
GetDlgItem.USER32(?,00000002), ref: 0084C7C1
GetWindowRect.USER32(00000000,?), ref: 0084C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0084C827
GetDlgItem.USER32(?,000003E9), ref: 0084C835
GetWindowRect.USER32(00000000,?), ref: 0084C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0084C889
GetDlgItem.USER32(?,000003EA), ref: 0084C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0084C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0084C8C1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d94494f079f9598051aa62c0327f449d8261559562ebe680c5f9b3d357e7b191
Instruction ID: 8b1681c06622f0427e22b2a9988d06e5628af7d9c0589e6eea5359c92f86adcc
Opcode Fuzzy Hash: d94494f079f9598051aa62c0327f449d8261559562ebe680c5f9b3d357e7b191
Instruction Fuzzy Hash: 96516371B00209ABDB08CFA9DD89A6DBBB9FB98711F14813DF619D7291D770DD408B10

Function 007F201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007F1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007F2036,?,00000000,?,?,?,?,007F16CB,00000000,?), ref: 007F1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007F20D3
KillTimer.USER32(-00000001,?,?,?,?,007F16CB,00000000,?,?,007F1AE2,?,?), ref: 007F216E
DestroyAcceleratorTable.USER32(00000000), ref: 0082BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007F16CB,00000000,?,?,007F1AE2,?,?), ref: 0082BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007F16CB,00000000,?,?,007F1AE2,?,?), ref: 0082BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007F16CB,00000000,?,?,007F1AE2,?,?), ref: 0082BF5A
DeleteObject.GDI32(00000000), ref: 0082BF6C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 527f72e9ccb1c2c2c4ed398aa69d9e892497a9dc3fd06e6f2a7058121cee49c4
Instruction ID: e59f81b8111b6433c6e08619ccfa6134b4cc1c0b091732d5932d8dfdd2828511
Opcode Fuzzy Hash: 527f72e9ccb1c2c2c4ed398aa69d9e892497a9dc3fd06e6f2a7058121cee49c4
Instruction Fuzzy Hash: B261AB32101618DFCB359F15DD48B3AB7F1FF44312F108628E64686A66CB79A8A2DF54

Function 007F21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 007F25DB: GetWindowLongW.USER32(?,000000EB), ref: 007F25EC

GetSysColor.USER32(0000000F), ref: 007F21D3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: a9c3fa9a9ca94f5ec78d7d759a73338dc72cc990fc10df42a74b21d71ecbb5b6
Instruction ID: 6548cf7ab5aaa3cec8df645610f48280d26e287f7b85240e892f4b1735832f11
Opcode Fuzzy Hash: a9c3fa9a9ca94f5ec78d7d759a73338dc72cc990fc10df42a74b21d71ecbb5b6
Instruction Fuzzy Hash: A441A031100554EBDB215F28EC88BB93B65FB06331F594265FF698A2E7C7358C82DB21

Function 0085AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0087F910), ref: 0085AB76
GetDriveTypeW.KERNEL32(00000061,008AA620,00000061), ref: 0085AC40
_wcscpy.LIBCMT ref: 0085AC6A

Strings

network, xrefs: 0085ABD4
unknown, xrefs: 0085AC01
all, xrefs: 0085AB7C
cdrom, xrefs: 0085AB92
removable, xrefs: 0085ABA8
ramdisk, xrefs: 0085ABEA
fixed, xrefs: 0085ABBE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 7c8736aa465be9616b29c2b5f4806949b49bfba0818d30d5660ec95ff77d69ce
Instruction ID: cb5eefe83401d3aeae0dc5747ff85387b929e9991561aa223a7aa93a7594a503
Opcode Fuzzy Hash: 7c8736aa465be9616b29c2b5f4806949b49bfba0818d30d5660ec95ff77d69ce
Instruction Fuzzy Hash: F951BD301083059BC718EF18C8C5AAAB7A5FF80315F104A2DFA96D76A2DB35DD4DCA53

Function 007F9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 007F99C2
__swprintf.LIBCMT ref: 007F9A0C
__i64tow.LIBCMT ref: 0082FA0F

Strings

True, xrefs: 0082F9D0
False, xrefs: 0082F9D7
0x%p, xrefs: 0082F9F1
%.15g, xrefs: 007F9A06

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 2bffa7611306faa868e19ba46abf23a7a2e62784e6d55e904ea90788cc720364
Instruction ID: 5d37c39d02734195077b4da2b17942f2b280d0677d5be6b41722c1ccefe6e8b0
Opcode Fuzzy Hash: 2bffa7611306faa868e19ba46abf23a7a2e62784e6d55e904ea90788cc720364
Instruction Fuzzy Hash: D7419671504619AADB24EF38E842F7677F8FF49300F20447EE749D6392EA75A981CB11

Function 008773C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008773D9
CreateMenu.USER32 ref: 008773F4
SetMenu.USER32(?,00000000), ref: 00877403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00877490
IsMenu.USER32(?), ref: 008774A6
CreatePopupMenu.USER32 ref: 008774B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008774DD
DrawMenuBar.USER32 ref: 008774E5

Strings

F, xrefs: 008774D1
0, xrefs: 008773CF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 237170056beacf4e140a91efe4b7cfafaea0bf8e3d71d8fb3bc9707e36820745
Instruction ID: 2d190fafdde13d4dfb7b85bca2beab189947e079ca536f38f35980ec335ff4e3
Opcode Fuzzy Hash: 237170056beacf4e140a91efe4b7cfafaea0bf8e3d71d8fb3bc9707e36820745
Instruction Fuzzy Hash: 0C413675A00209EFDB10DF64D888A9ABBB9FF49310F184028EA59A7361D730E920CB54

Function 0087772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 008777CD
CreateCompatibleDC.GDI32(00000000), ref: 008777D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 008777E7
SelectObject.GDI32(00000000,00000000), ref: 008777EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 008777FA
DeleteDC.GDI32(00000000), ref: 00877803
GetWindowLongW.USER32(?,000000EC), ref: 0087780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00877821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0087782D

Strings

static, xrefs: 00877765

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: c5decdddeb3b46d0e64dfb45c092b14e71896ff10b76d2718970b1d112eac237
Instruction ID: 92e4a1e17e7a1c197a1baba363415d35b08fb53585a04c04cda2b9b1a7fc56f0
Opcode Fuzzy Hash: c5decdddeb3b46d0e64dfb45c092b14e71896ff10b76d2718970b1d112eac237
Instruction Fuzzy Hash: D231AD31104215ABDF129F65DC0CFEA3B69FF0D361F108224FA19E21A5C731D861DBA4

Function 00817040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0081707B

Part of subcall function 00818D68: __getptd_noexit.LIBCMT ref: 00818D68

__gmtime64_s.LIBCMT ref: 00817114
__gmtime64_s.LIBCMT ref: 0081714A
__gmtime64_s.LIBCMT ref: 00817167
__allrem.LIBCMT ref: 008171BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008171D9
__allrem.LIBCMT ref: 008171F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0081720E
__allrem.LIBCMT ref: 00817225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00817243
__invoke_watson.LIBCMT ref: 008172B4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 9606615e0d79a8826f6f7f4cbc859cedb00322a5fa9c586bca7cf0fa69cab9b0
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: C771E5B1A04B16ABE7149E7DDC42B9AB3BCFF14324F14422EF815D7281E770DA808B91

Function 00852A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852A31
GetMenuItemInfoW.USER32(008B6890,000000FF,00000000,00000030), ref: 00852A92
SetMenuItemInfoW.USER32(008B6890,00000004,00000000,00000030), ref: 00852AC8
Sleep.KERNEL32(000001F4), ref: 00852ADA
GetMenuItemCount.USER32(?), ref: 00852B1E
GetMenuItemID.USER32(?,00000000), ref: 00852B3A
GetMenuItemID.USER32(?,-00000001), ref: 00852B64
GetMenuItemID.USER32(?,?), ref: 00852BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00852BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00852C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00852C24

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: f43ddfd405f731821ae8924ec3e6c09a1ee2806f0b7b6ac34cc2e83a1f22f825
Instruction ID: 5f3135493f6af84e25d1e70444a3dadc72d297d04eef6e4f91a636104fc55eef
Opcode Fuzzy Hash: f43ddfd405f731821ae8924ec3e6c09a1ee2806f0b7b6ac34cc2e83a1f22f825
Instruction Fuzzy Hash: 0E6190B0900249EFDB21CF64D888EAE7BB9FB0231AF140559EC41E7252DB31AD59DB21

Function 00877192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00877214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00877217
GetWindowLongW.USER32(?,000000F0), ref: 0087723B
_memset.LIBCMT ref: 0087724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0087725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 008772D6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 38a15509d61b63efecadbee45396cdf30193a6b7a431c6b8304df3ace8c49dd5
Instruction ID: 7d8073154ac7ba406269cfed9e03474f5fcd0d72e1c0359b1956a1f017495fac
Opcode Fuzzy Hash: 38a15509d61b63efecadbee45396cdf30193a6b7a431c6b8304df3ace8c49dd5
Instruction Fuzzy Hash: 25615871A00208AFDB10DFA8CC81EEE77B8FB09714F144169FA19E73A1D774A955DBA0

Function 0084710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00847135
SafeArrayAllocData.OLEAUT32(?), ref: 0084718E
VariantInit.OLEAUT32(?), ref: 008471A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 008471C0
VariantCopy.OLEAUT32(?,?), ref: 00847213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00847227
VariantClear.OLEAUT32(?), ref: 0084723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00847249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00847252
VariantClear.OLEAUT32(?), ref: 00847264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0084726F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f5db97d7b36e15fce7b78b2f3737654bf70096c59d028a68b832b45a45a71fe6
Instruction ID: 3cdfe770b9200301642cd4c5255ca4b3aa568d81ee11e846aaeaa3ac6c9aa0b7
Opcode Fuzzy Hash: f5db97d7b36e15fce7b78b2f3737654bf70096c59d028a68b832b45a45a71fe6
Instruction Fuzzy Hash: 27414F3590411DEFCB10DF69D8489AEBBB9FF08354F008069FA16E7261DB70E985CB91

Function 00865A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00865AA6
inet_addr.WSOCK32(?,?,?), ref: 00865AEB
gethostbyname.WSOCK32(?), ref: 00865AF7
IcmpCreateFile.IPHLPAPI ref: 00865B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00865B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00865B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00865C00
WSACleanup.WSOCK32 ref: 00865C06

Strings

Ping, xrefs: 00865B29

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 75bfbab1eaca0540297d7029050595b35ac6086b5220833cd0b13050dee40cbe
Instruction ID: e4ed2d76b4880799c003dbd9f53f27b706f2012117c4b3a99cdcc78beda465c2
Opcode Fuzzy Hash: 75bfbab1eaca0540297d7029050595b35ac6086b5220833cd0b13050dee40cbe
Instruction Fuzzy Hash: 64516C316047019FD721EF25CC49B2ABBE4FF48760F158929F65ADB2A1DB74E840CB52

Function 0085B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0085B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0085B7B1
GetLastError.KERNEL32 ref: 0085B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0085B828

Strings

READY, xrefs: 0085B801
INVALID, xrefs: 0085B7FA
NOTREADY, xrefs: 0085B7E7
UNKNOWN, xrefs: 0085B7E0
READONLY, xrefs: 0085B7F3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 39efee7f7ff03035b43e27e300a464e20251019a6c09602f0dfc8c7f81976843
Instruction ID: ab739d24f5d0700ce08f42e1e04bd4e6440bf537074ed9668f3eed92fb7bb136
Opcode Fuzzy Hash: 39efee7f7ff03035b43e27e300a464e20251019a6c09602f0dfc8c7f81976843
Instruction Fuzzy Hash: 9F31C134A00208DFDB04EF64C889ABE7BB8FF59745F104029EA15D7292DB759D4AC751

Function 00849471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 008494F6
GetDlgCtrlID.USER32 ref: 00849501
GetParent.USER32 ref: 0084951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00849520
GetDlgCtrlID.USER32(?), ref: 00849529
GetParent.USER32(?), ref: 00849545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00849548

Strings

ComboBox, xrefs: 0084947E
ListBox, xrefs: 008494B3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: f44546dcd4f73a39cd03472e3bb5d5f11a2fd0cd60e1e88a658c5735b7e7d3f3
Instruction ID: d3f6736d42e1780bc7848eaa5e909ba527c9e42fdc525bb792bd275aa8afa9d2
Opcode Fuzzy Hash: f44546dcd4f73a39cd03472e3bb5d5f11a2fd0cd60e1e88a658c5735b7e7d3f3
Instruction Fuzzy Hash: 7621E270D04108ABCF04AB65CCC9DFEBBB4FF55310F104115F661972A6EB799959DA20

Function 0084955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 008495DF
GetDlgCtrlID.USER32 ref: 008495EA
GetParent.USER32 ref: 00849606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00849609
GetDlgCtrlID.USER32(?), ref: 00849612
GetParent.USER32(?), ref: 0084962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00849631

Strings

ComboBox, xrefs: 00849569
ListBox, xrefs: 0084959E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d46e6c223c852907bf002e9d07b98ab18f180ca4440031689fa6e3d781af711f
Instruction ID: 2ea16dfc98ab01eb9e052a2c741019acc12c9c3784da61343d3296aa8c3c0668
Opcode Fuzzy Hash: d46e6c223c852907bf002e9d07b98ab18f180ca4440031689fa6e3d781af711f
Instruction Fuzzy Hash: 5321C470900108BBDF14AB65CCC9EFEBBB8FF54300F104115F661972A6EB799959DA20

Function 00849645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00849651
GetClassNameW.USER32(00000000,?,00000100), ref: 00849666
_wcscmp.LIBCMT ref: 00849678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 008496F3

Strings

SHELLDLL_DefView, xrefs: 00849672
smallicons, xrefs: 008496BB
details, xrefs: 008496A1
list, xrefs: 008496D5
largeicons, xrefs: 00849687

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: af7d6fc6d14b62d3ee4c6e77a00868c248edb2371c9c044da8332169f4743551
Instruction ID: 5c134db23693e8bf957002d95792b07555326573d380038f477256b2d04610f0
Opcode Fuzzy Hash: af7d6fc6d14b62d3ee4c6e77a00868c248edb2371c9c044da8332169f4743551
Instruction Fuzzy Hash: 8A113A3664830BBAFA212624DC0BDE7779CFF21374B200026FA50E44D1FE9599808948

Function 00868BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00868BEC
CoInitialize.OLE32(00000000), ref: 00868C19
CoUninitialize.OLE32 ref: 00868C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00868D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00868E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00882C0C), ref: 00868E84
CoGetObject.OLE32(?,00000000,00882C0C,?), ref: 00868EA7
SetErrorMode.KERNEL32(00000000), ref: 00868EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00868F3A
VariantClear.OLEAUT32(?), ref: 00868F4A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 94e94cfc96b9fb6b8f26389ec37249b2e83f63d6d727e7d1ecb5eff9f1168573
Instruction ID: 33d7fc86d40d49c5a845f5f27e76d59e8cd41a0e04c8f7092c509d6931157e31
Opcode Fuzzy Hash: 94e94cfc96b9fb6b8f26389ec37249b2e83f63d6d727e7d1ecb5eff9f1168573
Instruction Fuzzy Hash: 7BC1F071208205EFC700DF68C88492AB7E9FF89348F114A6DF699DB251DB71ED05CB62

Function 00854189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0085419D
__swprintf.LIBCMT ref: 008541AA

Part of subcall function 008138D8: __woutput_l.LIBCMT ref: 00813931

FindResourceW.KERNEL32(?,?,0000000E), ref: 008541D4
LoadResource.KERNEL32(?,00000000), ref: 008541E0
LockResource.KERNEL32(00000000), ref: 008541ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0085420D
LoadResource.KERNEL32(?,00000000), ref: 0085421F
SizeofResource.KERNEL32(?,00000000), ref: 0085422E
LockResource.KERNEL32(?), ref: 0085423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0085429B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 03f16093a3163e96ab00ecd2453af2cc810428281e7ecee22041f4f9dc4a68f6
Instruction ID: 8d9145b500e869c8a70527613280922654857587e53ad62466fa33c4ed5c45ef
Opcode Fuzzy Hash: 03f16093a3163e96ab00ecd2453af2cc810428281e7ecee22041f4f9dc4a68f6
Instruction Fuzzy Hash: A6317E7160521AABDB119FA1DC48EBF7BADFF08306F004525FD09D2152E770DA95CBA4

Function 008516DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00851700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00850778,?,00000001), ref: 00851714
GetWindowThreadProcessId.USER32(00000000), ref: 0085171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00850778,?,00000001), ref: 0085172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0085173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00850778,?,00000001), ref: 00851755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00850778,?,00000001), ref: 00851767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00850778,?,00000001), ref: 008517AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00850778,?,00000001), ref: 008517C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00850778,?,00000001), ref: 008517CC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: fb0320e33d20d9cc5e0f26aa53f41665e67561d8b5e131ba055243f2686e8ec3
Instruction ID: 035c21f25d5e9a08a4335fbffce6c0daec4a91773a4115d10e9d489f895283ae
Opcode Fuzzy Hash: fb0320e33d20d9cc5e0f26aa53f41665e67561d8b5e131ba055243f2686e8ec3
Instruction Fuzzy Hash: AE31BA71604304ABEB119F29DC8CB793BA9FB9A716F104024FD08D62A4DB749D848B64

Function 0084A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0084AA64), ref: 0084A9A2

Strings

NAME, xrefs: 0084A7D4
CLASS, xrefs: 0084A721
TEXT, xrefs: 0084A8D9
INSTANCE, xrefs: 0084A8B0
CLASSNN, xrefs: 0084A744
REGEXPCLASS, xrefs: 0084A767

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: da0f8f03b0f961b8ff100557953ee98c2d00f37d9c74ced02f375eff408e3c43
Instruction ID: 9616bc7873871bc33a264c27d0336733a474fae402b69b593541cda757339fa5
Opcode Fuzzy Hash: da0f8f03b0f961b8ff100557953ee98c2d00f37d9c74ced02f375eff408e3c43
Instruction Fuzzy Hash: 3C918370A4050EEADB1CDF64C481BE9FF74FF04304F108129E999EB291DB346A99CB91

Function 007F2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 007F2EAE

Part of subcall function 007F1DB3: GetClientRect.USER32(?,?), ref: 007F1DDC
Part of subcall function 007F1DB3: GetWindowRect.USER32(?,?), ref: 007F1E1D
Part of subcall function 007F1DB3: ScreenToClient.USER32(?,?), ref: 007F1E45

GetDC.USER32 ref: 0082CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0082CF95
SelectObject.GDI32(00000000,00000000), ref: 0082CFA3
SelectObject.GDI32(00000000,00000000), ref: 0082CFB8
ReleaseDC.USER32(?,00000000), ref: 0082CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0082D04B

Strings

U, xrefs: 0082CF20

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: b7f720c83e365d49c283a703b31d7fcb6b9d28832d461daf467b5e54e7c2559e
Instruction ID: da7665f431cba46b758f89e8bd8e9aa426013cb597dd046b8d51926110207dd3
Opcode Fuzzy Hash: b7f720c83e365d49c283a703b31d7fcb6b9d28832d461daf467b5e54e7c2559e
Instruction Fuzzy Hash: AD71E631400209DFCF21CF64D888ABA7BB5FF48354F244269EE55DA2A6D7358C92DF60

Function 0087C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

Part of subcall function 007F2344: GetCursorPos.USER32(?), ref: 007F2357
Part of subcall function 007F2344: ScreenToClient.USER32(008B67B0,?), ref: 007F2374
Part of subcall function 007F2344: GetAsyncKeyState.USER32(00000001), ref: 007F2399
Part of subcall function 007F2344: GetAsyncKeyState.USER32(00000002), ref: 007F23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0087C2E4
ImageList_EndDrag.COMCTL32 ref: 0087C2EA
ReleaseCapture.USER32 ref: 0087C2F0
SetWindowTextW.USER32(?,00000000), ref: 0087C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0087C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0087C48F

Strings

@GUI_DRAGFILE, xrefs: 0087C424
@GUI_DROPID, xrefs: 0087C3E1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 7977858f18bb9d1267c6cf548897c85418950eeff37c09d00ea5040437e9e01e
Instruction ID: 117da73d0c004f528b684245dea18ce65d704280b47752d4e923dbef50e6daff
Opcode Fuzzy Hash: 7977858f18bb9d1267c6cf548897c85418950eeff37c09d00ea5040437e9e01e
Instruction Fuzzy Hash: 8D518E70204304EFD704DF14C899FAA7BE5FB88314F04862DF6598B2A2DB75D954CB52

Function 00868F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0087F910), ref: 0086903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0087F910), ref: 00869071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 008691EB
SysFreeString.OLEAUT32(?), ref: 00869215

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 5652b1ce423bbf10ab00027f499c73f4b8b353492025c5278492d3be24a3e487
Instruction ID: 44c92b2d60c30f890db1ea17fb316352201f6247527ae479412b63f8f618bd9b
Opcode Fuzzy Hash: 5652b1ce423bbf10ab00027f499c73f4b8b353492025c5278492d3be24a3e487
Instruction Fuzzy Hash: 1BF11771A00209EFDB04DF94C888EAEB7B9FF49314F118059F955EB291DB31AE46CB50

Function 0086F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0086FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0086FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0086FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0086FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0086FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0086FD90
CloseHandle.KERNEL32(?), ref: 0086FDBF
CloseHandle.KERNEL32(?), ref: 0086FE36

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 046a0389710b95a3ccbe6aca2a307208842ac66814c03bf3bd63e0c2e9aed6e9
Instruction ID: b48b076834b73951ca534b98a84e3c50a7944cc754e36868f8acfd226fbf859b
Opcode Fuzzy Hash: 046a0389710b95a3ccbe6aca2a307208842ac66814c03bf3bd63e0c2e9aed6e9
Instruction Fuzzy Hash: F8E19C31204201DFCB14EF28D885A6ABBE5FF84354F15846DFA998B2A2DB31EC45CB52

Function 00854F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008548AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008538D3,?), ref: 008548C7

Part of subcall function 008548AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008538D3,?), ref: 008548E0

Part of subcall function 00854CD3: GetFileAttributesW.KERNEL32(?,00853947), ref: 00854CD4

lstrcmpiW.KERNEL32(?,?), ref: 00854FE2
_wcscmp.LIBCMT ref: 00854FFC
MoveFileW.KERNEL32(?,?), ref: 00855017

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 47e216cb106a9ca9b7156d22919bd5a122105289feedb261c52c944919ebb894
Instruction ID: f402d0af589a0a7f4888f65b0aa64feef2f84660f7f49bc219705c9ef546ecec
Opcode Fuzzy Hash: 47e216cb106a9ca9b7156d22919bd5a122105289feedb261c52c944919ebb894
Instruction Fuzzy Hash: 0F5183B20087849BC724DB64D8959DFB7ECFF84311F00492EB689C3192EF74A68C8766

Function 008788B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0087896E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a674a35f8fd9cafad625d860bc58724b749ce9b155f34cca4ff7cc3aaca95495
Instruction ID: d2d33f0bede6c044a38c04c00bc03af48c1f7b52641493087dbb1b60969f17d1
Opcode Fuzzy Hash: a674a35f8fd9cafad625d860bc58724b749ce9b155f34cca4ff7cc3aaca95495
Instruction Fuzzy Hash: D651B330584218FFDF209F28CC8DB697B65FB04354F608122F61CE66A9DF71E9809B52

Function 007F2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0082C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0082C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0082C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0082C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0082C5C0
DestroyIcon.USER32(00000000), ref: 0082C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0082C5EC
DestroyIcon.USER32(?), ref: 0082C5FB

Part of subcall function 0087A71E: DeleteObject.GDI32(00000000), ref: 0087A757

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 6098c173a1321688d9e5d24f29e05d4b75e937a3c1bcada5e18c7e2b02cafaf4
Instruction ID: c53caf1076e9108d8d567505426c1e61af700795ebf7e44a8a5671412324d45d
Opcode Fuzzy Hash: 6098c173a1321688d9e5d24f29e05d4b75e937a3c1bcada5e18c7e2b02cafaf4
Instruction Fuzzy Hash: BB514770A00209AFDB24DF25DC49BBA37A5FB58750F104528FA06D72A1EB74E991DB60

Function 00848E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00848A84,00000B00,?,?), ref: 00848E0C
HeapAlloc.KERNEL32(00000000,?,00848A84,00000B00,?,?), ref: 00848E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00848A84,00000B00,?,?), ref: 00848E28
GetCurrentProcess.KERNEL32(?,00000000,?,00848A84,00000B00,?,?), ref: 00848E30
DuplicateHandle.KERNEL32(00000000,?,00848A84,00000B00,?,?), ref: 00848E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00848A84,00000B00,?,?), ref: 00848E43
GetCurrentProcess.KERNEL32(00848A84,00000000,?,00848A84,00000B00,?,?), ref: 00848E4B
DuplicateHandle.KERNEL32(00000000,?,00848A84,00000B00,?,?), ref: 00848E4E
CreateThread.KERNEL32(00000000,00000000,00848E74,00000000,00000000,00000000), ref: 00848E68

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 431fa04dfd1e7a723e466620a0952ff7f9a630e32ac674e58195ea84ebfb444f
Instruction ID: 301a326230575db64a2b761655d2f259c6d70d054db9a4f17a5a3222e711ecaf
Opcode Fuzzy Hash: 431fa04dfd1e7a723e466620a0952ff7f9a630e32ac674e58195ea84ebfb444f
Instruction Fuzzy Hash: B101AC75240308FFE611AB65DC4DF5B3B6CFB89711F404421FA09DB196CA74D8408A30

Function 00869428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086947C
VariantInit.OLEAUT32(?), ref: 0086954D
VariantInit.OLEAUT32(?), ref: 0086964E
VariantClear.OLEAUT32(?), ref: 00869658
VariantClear.OLEAUT32(?), ref: 008696B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 008694DD, 0086960B, 008696C3
Incorrect Object type in FOR..IN loop, xrefs: 00869631

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 118846e5bd2bcf38733f083f332563171c0c6ab013ede9ac7b39ffcdcacbeb3c
Instruction ID: 8645c781fba11bba68e4e1c04edc6a3853c60950fa68509941153db4dd089e10
Opcode Fuzzy Hash: 118846e5bd2bcf38733f083f332563171c0c6ab013ede9ac7b39ffcdcacbeb3c
Instruction Fuzzy Hash: A291A970A00219ABDF24DFA5C848FAEBBB8FF45724F118159F559EB280DB709945CFA0

Function 00869A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00847652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?,?,0084799D), ref: 0084766F
Part of subcall function 00847652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?), ref: 0084768A
Part of subcall function 00847652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?), ref: 00847698
Part of subcall function 00847652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?), ref: 008476A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00869B1B
_memset.LIBCMT ref: 00869B28
_memset.LIBCMT ref: 00869C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00869C97
CoTaskMemFree.OLE32(?), ref: 00869CA2

Strings

NULL Pointer assignment, xrefs: 00869CF0

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: f62fa1c032cebf6e6dd5f820d0bbc9ac45cd9d52f0c808422113851a3c448dd8
Instruction ID: 30a7576021d468ba99ce80bf24fb663d89686dd69021a21344e4a6dcf36b1750
Opcode Fuzzy Hash: f62fa1c032cebf6e6dd5f820d0bbc9ac45cd9d52f0c808422113851a3c448dd8
Instruction Fuzzy Hash: B4911971D0022DEBDB10DFA5DC85ADEBBB9FF08710F104169E519A7281DB719A44CFA1

Function 00876FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00877093
SendMessageW.USER32(?,00001036,00000000,?), ref: 008770A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 008770C1
_wcscat.LIBCMT ref: 0087711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00877133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00877161

Strings

SysListView32, xrefs: 00877065

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 8934bda8c312fc9109a3578955a990e1f807533bcd85e6d3d16b7e64f0f4bc9e
Instruction ID: e383740635d8b1ff3734b93c2290c17797e39bb443730ae09cbd7b5307e9e782
Opcode Fuzzy Hash: 8934bda8c312fc9109a3578955a990e1f807533bcd85e6d3d16b7e64f0f4bc9e
Instruction Fuzzy Hash: B4419371A04308AFEB219F64CC85BEE77A8FF08750F10456AF658E7292D675DD84CB60

Function 0086EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00853E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00853EB6
Part of subcall function 00853E91: Process32FirstW.KERNEL32(00000000,?), ref: 00853EC4
Part of subcall function 00853E91: CloseHandle.KERNEL32(00000000), ref: 00853F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0086ECB8
GetLastError.KERNEL32 ref: 0086ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0086ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0086ED77
GetLastError.KERNEL32(00000000), ref: 0086ED82
CloseHandle.KERNEL32(00000000), ref: 0086EDB7

Strings

SeDebugPrivilege, xrefs: 0086ECD6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: c871716911c588aca697ed72bcfc6c96108c673a6a483b3a5b7c95d798095c33
Instruction ID: 30d5f2cbab5156b05d94dcc674a271d688ec776f992daa77c3656d9910694b48
Opcode Fuzzy Hash: c871716911c588aca697ed72bcfc6c96108c673a6a483b3a5b7c95d798095c33
Instruction Fuzzy Hash: BD419A712002059FDB20EF28CC99F6DB7A1FF40714F088019FA469B3D2DB75A814CB96

Function 00853226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 008532C5

Strings

stop, xrefs: 00853296
blank, xrefs: 00853247
info, xrefs: 00853266
question, xrefs: 0085327E
warning, xrefs: 008532AE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 43803659a1412824071c3a263f381ff9f1d1c0041d01cd7920d34529d1040b70
Instruction ID: b3e24c883272222280b46049fcc4a853344bb5180d06162a437b5ee44b01f5ee
Opcode Fuzzy Hash: 43803659a1412824071c3a263f381ff9f1d1c0041d01cd7920d34529d1040b70
Instruction Fuzzy Hash: 3611273120874ABBE7055A54DC42DBAB79CFF1A3B7F20002AFD04E6281E7A59B8445A6

Function 00854534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0085454E
LoadStringW.USER32(00000000), ref: 00854555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0085456B
LoadStringW.USER32(00000000), ref: 00854572
_wprintf.LIBCMT ref: 00854598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008545B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00854593

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: ddf7b33a852d31bc8f1c6eb957285887916f822a75bd2609630f74a0c856ea48
Instruction ID: 1a35374e4433587c0dfd4439af7787f7f9b4648337a6d4816ba40badbc6c28d8
Opcode Fuzzy Hash: ddf7b33a852d31bc8f1c6eb957285887916f822a75bd2609630f74a0c856ea48
Instruction Fuzzy Hash: 7801A2F2800208BFE711ABA5DD8DEE7776CFB08305F4004A5BB49D2012EA749EC48B70

Function 0087D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

GetSystemMetrics.USER32(0000000F), ref: 0087D78A
GetSystemMetrics.USER32(0000000F), ref: 0087D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0087D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0087DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0087DA24
ShowWindow.USER32(00000003,00000000), ref: 0087DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0087DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0087DA8B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 547d1d4185a6e2f2d0af618dacd13488b4c2df94c6143ad1dfc008bbae6995d0
Instruction ID: 77133a288441e755bef49b9babdb766a58dc5adeb6d1b37dfce7af3bdcdffba7
Opcode Fuzzy Hash: 547d1d4185a6e2f2d0af618dacd13488b4c2df94c6143ad1dfc008bbae6995d0
Instruction Fuzzy Hash: 17B14871600229EFDF14CF69C989BA97BB1FF44711F08C169ED48DA29AD734E990CB50

Function 007F2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0082C417,00000004,00000000,00000000,00000000), ref: 007F2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0082C417,00000004,00000000,00000000,00000000,000000FF), ref: 007F2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0082C417,00000004,00000000,00000000,00000000), ref: 0082C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0082C417,00000004,00000000,00000000,00000000), ref: 0082C4D6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 63a249b2e565fcccc0d04370d4cdbf6af2a4b9252aa34d996d0687c9ff17469f
Instruction ID: 43bd3a1694913c8f277c1f448de8db1802c407499f04fb680d136009364b18ad
Opcode Fuzzy Hash: 63a249b2e565fcccc0d04370d4cdbf6af2a4b9252aa34d996d0687c9ff17469f
Instruction Fuzzy Hash: B4410A30208A88AAC7359B2A9C9C77B7B92FB95310F14C419EB4786763D67DD883D711

Function 00857368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0085737F

Part of subcall function 00810FF6: std::exception::exception.LIBCMT ref: 0081102C
Part of subcall function 00810FF6: __CxxThrowException@8.LIBCMT ref: 00811041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 008573B6
EnterCriticalSection.KERNEL32(?), ref: 008573D2
_memmove.LIBCMT ref: 00857420
_memmove.LIBCMT ref: 0085743D
LeaveCriticalSection.KERNEL32(?), ref: 0085744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00857461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00857480

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 9abd3aabbca71347db063e0d99608b8f2c9286b5a853f15528d98dfc1fdebe85
Instruction ID: 8bf80f339192d8589fa023ac50ad243dc9ba0300ad8ac58186818872ffe4fc37
Opcode Fuzzy Hash: 9abd3aabbca71347db063e0d99608b8f2c9286b5a853f15528d98dfc1fdebe85
Instruction Fuzzy Hash: 3C319031904205EBCF10DF69DC89AAE7BB8FF45311B1440A5FE04DB25ADB30DA94CBA1

Function 00876442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0087645A
GetDC.USER32(00000000), ref: 00876462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0087646D
ReleaseDC.USER32(00000000,00000000), ref: 00876479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 008764B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 008764C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00879299,?,?,000000FF,00000000,?,000000FF,?), ref: 00876500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00876520

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 44433c65f8d2f5c9c0306009886eddb041e9ae73577e88d9f280312b405fd60c
Instruction ID: 790d4b02057dc43dd28ffe80f16c2526e170bd549d981714fc8b49da227a2bdf
Opcode Fuzzy Hash: 44433c65f8d2f5c9c0306009886eddb041e9ae73577e88d9f280312b405fd60c
Instruction Fuzzy Hash: 8E317C72200610AFEB118F11CC8AFEA3BA9FF09761F044065FE08DA29AD675DC91CB64

Function 0084C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0084C087
_memcmp.LIBCMT ref: 0084C0A9
_memcmp.LIBCMT ref: 0084C0C1
_memcmp.LIBCMT ref: 0084C0D4
_memcmp.LIBCMT ref: 0084C0EE
_memcmp.LIBCMT ref: 0084C101
_memcmp.LIBCMT ref: 0084C119
_memcmp.LIBCMT ref: 0084C134

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 3d6625414d10e6b6c8fefea92e66ddd5bdcbe2db42446483781ac07fbbdc7233
Instruction ID: 121e847ac8f7ecdd449dd7ccd0fa1192f6483a2f5d87ac5cfecc799c56282ad5
Opcode Fuzzy Hash: 3d6625414d10e6b6c8fefea92e66ddd5bdcbe2db42446483781ac07fbbdc7233
Instruction Fuzzy Hash: DE21927160260DBBD694B6258D46FBB379DFF303A8F044020FE05D6382E756DE1186A6

Function 0085ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

Part of subcall function 0080FEC6: _wcscpy.LIBCMT ref: 0080FEE9

_wcstok.LIBCMT ref: 0085EEFF
_wcscpy.LIBCMT ref: 0085EF8E
_memset.LIBCMT ref: 0085EFC1

Strings

X, xrefs: 0085EFFE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: cd1271f83638114ea64c9af5f8367ca65dc376e069b57a64dc07e478fc629470
Instruction ID: 61a8fe5d46d6bd368c3f04c1984658980f5b1cb51da64e2ab3c82449c22171a9
Opcode Fuzzy Hash: cd1271f83638114ea64c9af5f8367ca65dc376e069b57a64dc07e478fc629470
Instruction Fuzzy Hash: 9CC14771508704DFC724EF24C885A6AB7E4FF85310F04496DFA99DB3A2DB34A949CB92

Function 007F1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db279d1dc9db1ac9eb1681d0966ba16646e9b4344ed3dafb9096f081ed37a3fc
Instruction ID: 9db0427e629d38967817958137de86b5e28863c05aad16c310eec53e317009ba
Opcode Fuzzy Hash: db279d1dc9db1ac9eb1681d0966ba16646e9b4344ed3dafb9096f081ed37a3fc
Instruction Fuzzy Hash: B5716A30900119EFCB04CF98CC89ABEBB79FF85310F548159FA15AB351D738AA91CBA0

Function 00866E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8aa213391cde522c317523704abf003c0a9437d4e9b65344b743d968075a9808
Instruction ID: 763f863ea400807c8225ab234c7bd57dc1a70bcfb5e50b162a7dfffe202fed3b
Opcode Fuzzy Hash: 8aa213391cde522c317523704abf003c0a9437d4e9b65344b743d968075a9808
Instruction Fuzzy Hash: F361CC71108704EBC710EB24CC8AF6BB7A9FF84718F104A18F6559B2A2DA759D00CBA2

Function 0087B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(014356F8), ref: 0087B6A5
IsWindowEnabled.USER32(014356F8), ref: 0087B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0087B795
SendMessageW.USER32(014356F8,000000B0,?,?), ref: 0087B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0087B809
GetWindowLongW.USER32(014356F8,000000EC), ref: 0087B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0087B843

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f6710c33e273aa09d6d30d5f04d2801cb796043644c06af5e82f324e43253aa8
Instruction ID: ed17c35d6bc2708e46cda2be9b662425f0883548c9e2bf07e5750dadc71eed03
Opcode Fuzzy Hash: f6710c33e273aa09d6d30d5f04d2801cb796043644c06af5e82f324e43253aa8
Instruction Fuzzy Hash: 5D719C34604204AFDB249F64C8E4FBA7BBAFF59340F188069EA49D73A9D731E951CB50

Function 0086F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086F75C
_memset.LIBCMT ref: 0086F825
ShellExecuteExW.SHELL32(?), ref: 0086F86A

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

Part of subcall function 0080FEC6: _wcscpy.LIBCMT ref: 0080FEE9

GetProcessId.KERNEL32(00000000), ref: 0086F8E1
CloseHandle.KERNEL32(00000000), ref: 0086F910

Strings

@, xrefs: 0086F839

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 6aa1c1276f6229a6e843035eb81e44692288a70f7eb8071f48f34a2075987ca2
Instruction ID: db80152d0d0d57ef5cddeba860985e1388110244c72815a4d48f30a108bbd351
Opcode Fuzzy Hash: 6aa1c1276f6229a6e843035eb81e44692288a70f7eb8071f48f34a2075987ca2
Instruction Fuzzy Hash: F1618C75A00619DFCF14EF64D484AAEBBF5FF48310F158469EA4AAB352CB34AD41CB90

Function 0085145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0085149C
GetKeyboardState.USER32(?), ref: 008514B1
SetKeyboardState.USER32(?), ref: 00851512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00851540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0085155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 008515A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 008515C8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 16c4e510841399d4b6d42eb4de5ce1103b1b590d03fcb01489d16a68c4c03dc8
Instruction ID: 3ed35014e1d80eb2a36a96be160815ab2096c0ef77d27a50c900f0b357c7939a
Opcode Fuzzy Hash: 16c4e510841399d4b6d42eb4de5ce1103b1b590d03fcb01489d16a68c4c03dc8
Instruction Fuzzy Hash: 8051D3A06046D53DFF3252388C49BBA7EEABB46306F088589E9D5858C2D7E4DCC8D751

Function 00851276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 008512B5
GetKeyboardState.USER32(?), ref: 008512CA
SetKeyboardState.USER32(?), ref: 0085132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00851357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00851374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 008513B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 008513D9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bdc5ac9e67b9d637a58d62b7f0252a98b87295eccad5c69be282b83ed14b1083
Instruction ID: cf877ac5408e1fae9b7604ce89ca28bfcbd62e10d652c4640371c21f13b42b69
Opcode Fuzzy Hash: bdc5ac9e67b9d637a58d62b7f0252a98b87295eccad5c69be282b83ed14b1083
Instruction Fuzzy Hash: 5D5107A05046D53DFF3297248C59BBA7FAAFB06302F084589E9D4C69C2D798EC8CD751

Function 0085589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 008558AC
_wcsncpy.LIBCMT ref: 008558E1
_wcsncpy.LIBCMT ref: 00855913
_wcsncpy.LIBCMT ref: 00855946
_wcsncpy.LIBCMT ref: 00855988
_wcsncpy.LIBCMT ref: 008559C2
_wcsncpy.LIBCMT ref: 008559F1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: d3a330bbabe338329a8e9e83e1eaa595f94748a5c134d74c19d61b669487be07
Instruction ID: 0ed80e7bf8d08497801f78f5e31294cb229394ad58f6b02403f2df2fea622e1c
Opcode Fuzzy Hash: d3a330bbabe338329a8e9e83e1eaa595f94748a5c134d74c19d61b669487be07
Instruction Fuzzy Hash: 7041B365C2012876CB11FBB888869CF77ACFF05310F509862F918E3122E734D7A9C7A6

Function 008538AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008548AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008538D3,?), ref: 008548C7

Part of subcall function 008548AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008538D3,?), ref: 008548E0

lstrcmpiW.KERNEL32(?,?), ref: 008538F3
_wcscmp.LIBCMT ref: 0085390F
MoveFileW.KERNEL32(?,?), ref: 00853927
_wcscat.LIBCMT ref: 0085396F
SHFileOperationW.SHELL32(?), ref: 008539DB

Strings

\*.*, xrefs: 00853969

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 52928804666b64e4d087b3b1ed684bb3e8d2322b0e5d14478eaa3f2a688272f7
Instruction ID: 13a6b7cd76f96487ef136831d2059bdf36b72e1857843444756e3ef0d1db5f95
Opcode Fuzzy Hash: 52928804666b64e4d087b3b1ed684bb3e8d2322b0e5d14478eaa3f2a688272f7
Instruction Fuzzy Hash: 28418FB14083849AC751EF64C4859EFBBECFF89381F40192EB889C3251EA74D69CC752

Function 00877500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00877519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008775C0
IsMenu.USER32(?), ref: 008775D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00877620
DrawMenuBar.USER32 ref: 00877633

Strings

0, xrefs: 0087750D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: a909f40d9d236725192b6700db7f47acf5d4c63d3638f4c99533c712d46cfbf1
Instruction ID: d2ac0231c92b96a732d0af6acb58d01b15cd88c224a621ea39d1eab1ef239069
Opcode Fuzzy Hash: a909f40d9d236725192b6700db7f47acf5d4c63d3638f4c99533c712d46cfbf1
Instruction Fuzzy Hash: 5F410675A04609EFDB20DF54D884EAABBF9FB18314F048129EA59D7254D730ED60CFA0

Function 0087122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0087125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00871286
FreeLibrary.KERNEL32(00000000), ref: 0087133D

Part of subcall function 0087122D: RegCloseKey.ADVAPI32(?), ref: 008712A3
Part of subcall function 0087122D: FreeLibrary.KERNEL32(?), ref: 008712F5
Part of subcall function 0087122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00871318

RegDeleteKeyW.ADVAPI32(?,?), ref: 008712E0

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 0917e57d4db2f9a951432fa89d6bd8aefc381ff9ca8b27ddb4bcd3590e5a7919
Instruction ID: 49bae726788b3823bc5aa09f343879453a4077c79f923e2192f7561397c24dfe
Opcode Fuzzy Hash: 0917e57d4db2f9a951432fa89d6bd8aefc381ff9ca8b27ddb4bcd3590e5a7919
Instruction Fuzzy Hash: BF315CB1900109BFDF14DB94DC89AFEB7BCFF08300F004169E509E2646DB74DE859AA0

Function 0087653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0087655B
GetWindowLongW.USER32(014356F8,000000F0), ref: 0087658E
GetWindowLongW.USER32(014356F8,000000F0), ref: 008765C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 008765F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0087661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00876630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0087664A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 013cade44aa154c74a89a646b7226712cbee346ea74783fd5325f373b676960b
Instruction ID: be1ef53efa5e633b1575f19edc6d8f173ff1f55f2f8c83e6effdcb9377414d50
Opcode Fuzzy Hash: 013cade44aa154c74a89a646b7226712cbee346ea74783fd5325f373b676960b
Instruction Fuzzy Hash: 3D310331604510AFDB21CF19DC89F553BE1FB5A710F184268F619CB2BAEB61ECA0EB51

Function 00866486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008680A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008680CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 008664D9
WSAGetLastError.WSOCK32(00000000), ref: 008664E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00866521
connect.WSOCK32(00000000,?,00000010), ref: 0086652A
WSAGetLastError.WSOCK32 ref: 00866534
closesocket.WSOCK32(00000000), ref: 0086655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00866576

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 9c15ce5e71fa0805165f995a6996e13c87267025458974459a3ac8ba378c787b
Instruction ID: 56f51b926ca6fbaa0a680e904d0c53decffc999238a26de1380ecbcfd958a184
Opcode Fuzzy Hash: 9c15ce5e71fa0805165f995a6996e13c87267025458974459a3ac8ba378c787b
Instruction Fuzzy Hash: BD31B331600218AFDB109F24CC89BBE7BACFF45754F058069FA1AE7291DB74AD54CB62

Function 0084E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0084E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0084E120
SysAllocString.OLEAUT32(00000000), ref: 0084E123
SysAllocString.OLEAUT32 ref: 0084E144
SysFreeString.OLEAUT32 ref: 0084E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0084E167
SysAllocString.OLEAUT32(?), ref: 0084E175

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 18bd57b55da65cf3992ab87590b0c2e5687f98193dd68b9ed392e4ff2b7a21f8
Instruction ID: 3644fb4aa85a8ec425da7cecad5d2dd016e88360c61f92c8e1f7708acd28474f
Opcode Fuzzy Hash: 18bd57b55da65cf3992ab87590b0c2e5687f98193dd68b9ed392e4ff2b7a21f8
Instruction Fuzzy Hash: 6921833560410CAFDB109FA9DC88CAB77ECFB09760B148136FA59CB2A5DA70DC81CB64

Function 0087783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007F1D73
Part of subcall function 007F1D35: GetStockObject.GDI32(00000011), ref: 007F1D87
Part of subcall function 007F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007F1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 008778A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 008778AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 008778B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 008778C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 008778D4

Strings

Msctls_Progress32, xrefs: 00877872

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: cabb2858a420925e32a0dcb419b47adcb88bbaffa3acfed6fbdc99f4678395e5
Instruction ID: 5a9988e28052a2a78c1dd10cda211c65b5c2465b3ffc41e5ff4393300ca83a3d
Opcode Fuzzy Hash: cabb2858a420925e32a0dcb419b47adcb88bbaffa3acfed6fbdc99f4678395e5
Instruction Fuzzy Hash: 011181B1110119BFEF159E60CC85EE77F6DFF08758F018124FA08A21A0C7719C21DBA4

Function 008141C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00814292,?), ref: 008141E3
GetProcAddress.KERNEL32(00000000), ref: 008141EA
EncodePointer.KERNEL32(00000000), ref: 008141F6
DecodePointer.KERNEL32(00000001,00814292,?), ref: 00814213

Strings

RoInitialize, xrefs: 008141D2
combase.dll, xrefs: 008141DE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: cc6de59cc133ec7d5d7156ef95aa8dcf77a601bd882aab91c79fa71f70f016d6
Instruction ID: 1770c54415fdc759b13bf82929a764f610452ed5c84b493884e8291ad4d6a8dd
Opcode Fuzzy Hash: cc6de59cc133ec7d5d7156ef95aa8dcf77a601bd882aab91c79fa71f70f016d6
Instruction Fuzzy Hash: BEE012B4990300AFEF206F79EC0EB443B95FB11702F505524F625D51A6D7B680D59F10

Function 0081429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,008141B8), ref: 008142B8
GetProcAddress.KERNEL32(00000000), ref: 008142BF
EncodePointer.KERNEL32(00000000), ref: 008142CA
DecodePointer.KERNEL32(008141B8), ref: 008142E5

Strings

combase.dll, xrefs: 008142B3
RoUninitialize, xrefs: 008142A7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 1c36d34df2a248bc0442f7ed789520454f078e899463531a6193ec33af823dd7
Instruction ID: ffa85aa32479fb282b8a7feac0dbd9f82fcc3507b6eca4f15fe830131a297650
Opcode Fuzzy Hash: 1c36d34df2a248bc0442f7ed789520454f078e899463531a6193ec33af823dd7
Instruction Fuzzy Hash: 87E0BF7C9913109BEB109B65EC0EF443BA8FB14742F105125F229E11A6CBB585C0DB14

Function 0085675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008568AD
_memmove.LIBCMT ref: 008567E8

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

_memmove.LIBCMT ref: 0085685B
_memmove.LIBCMT ref: 00856942
_memmove.LIBCMT ref: 0085695B
_memmove.LIBCMT ref: 00856977

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction ID: 7feca28a964b860efcd0a9b48b086cc92659aa49a2eeca83bcfc994006725b23
Opcode Fuzzy Hash: b6af34302f73e7cc86d124cdaa6c703dbf7dfb6507262c8ff84fb63fda3a9fb8
Instruction Fuzzy Hash: 2C61AC3090064E9BCF11EF24C889EFE7BA8FF48308F444559FE559B292EA34A859CB51

Function 0087046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 008710A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00870038,?,?), ref: 008710BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00870548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00870588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 008705AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 008705D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00870617
RegCloseKey.ADVAPI32(00000000), ref: 00870624

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: b79bcbb30c8183b07c73b39961fc50e1a0fac7702d896cbe159e83c5dacc334b
Instruction ID: 0b8c7709d7ffd41cd7e3ca5e9952a8b0cf3f38b200b0a8fb9e833c8702023316
Opcode Fuzzy Hash: b79bcbb30c8183b07c73b39961fc50e1a0fac7702d896cbe159e83c5dacc334b
Instruction Fuzzy Hash: ED514A31508304DFCB14EB28C889E6ABBE8FF89314F04891DF659972A2DB31E955CF52

Function 00875A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00875A82
GetMenuItemCount.USER32(00000000), ref: 00875AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00875AE1
GetMenuItemID.USER32(?,?), ref: 00875B50
GetSubMenu.USER32(?,?), ref: 00875B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00875BAF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 88ae250fc16bb26cf8d90a3b664dcf77ad5d98dc8ff614f9a3d7a5e381cba98d
Instruction ID: 36f544d7579bfabc2be29956ae7a320386179a871e2c03a84e320784a4fd8984
Opcode Fuzzy Hash: 88ae250fc16bb26cf8d90a3b664dcf77ad5d98dc8ff614f9a3d7a5e381cba98d
Instruction Fuzzy Hash: 83515D31A00629EFDB11DF64C845AAEB7B4FF48320F148469E909F7355CBB5EE818B91

Function 0084F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0084F3F7
VariantClear.OLEAUT32(00000013), ref: 0084F469
VariantClear.OLEAUT32(00000000), ref: 0084F4C4
_memmove.LIBCMT ref: 0084F4EE
VariantClear.OLEAUT32(?), ref: 0084F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0084F569

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 29514a1bb4dcda9b1cd1ee4b43c89f8bbb2786cb594f12f5a80be3e6a1c9a93c
Instruction ID: b063cbee3ab4c2570f20280c9a1f2698697c1cb43da7cc5f395850044c6fdd9e
Opcode Fuzzy Hash: 29514a1bb4dcda9b1cd1ee4b43c89f8bbb2786cb594f12f5a80be3e6a1c9a93c
Instruction Fuzzy Hash: C45167B5A00209EFCB10CF58D884AAAB7F8FF4C314B15816AEA59DB305D730E951CBA0

Function 008526F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00852792
IsMenu.USER32(00000000), ref: 008527B2
CreatePopupMenu.USER32 ref: 008527E6
GetMenuItemCount.USER32(000000FF), ref: 00852844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00852875

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c0286b89e92bee93b5c9de73564784be33446669a605c42ad6d16152897f89d9
Instruction ID: 5132c71845564809460237b3c22250a98833270d5c42c03bb74659de7c5cc37b
Opcode Fuzzy Hash: c0286b89e92bee93b5c9de73564784be33446669a605c42ad6d16152897f89d9
Instruction Fuzzy Hash: 8A519070A00209DBDF24CFA8D888AADBBF5FF5631AF104569EC25DB291DB709948CB51

Function 007F1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 007F179A
GetWindowRect.USER32(?,?), ref: 007F17FE
ScreenToClient.USER32(?,?), ref: 007F181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007F182C
EndPaint.USER32(?,?), ref: 007F1876

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 2839bb2224961a2c017a20e5fab9e38b73dae4a184dbddd1dfe664e8691754ec
Instruction ID: e7bea4a4093f2a51d61fa2442fc2771d9089bf47fb604f5411f38c86e3fabd6c
Opcode Fuzzy Hash: 2839bb2224961a2c017a20e5fab9e38b73dae4a184dbddd1dfe664e8691754ec
Instruction Fuzzy Hash: A141AB70200214EFD710DF25D888BBA7BE8FB59774F040628FAA9872A2D7359885DB61

Function 0087B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(008B67B0,00000000,014356F8,?,?,008B67B0,?,0087B862,?,?), ref: 0087B9CC
EnableWindow.USER32(00000000,00000000), ref: 0087B9F0
ShowWindow.USER32(008B67B0,00000000,014356F8,?,?,008B67B0,?,0087B862,?,?), ref: 0087BA50
ShowWindow.USER32(00000000,00000004,?,0087B862,?,?), ref: 0087BA62
EnableWindow.USER32(00000000,00000001), ref: 0087BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0087BAA9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 26cc945babe6491d33fc22870d2ab0111aa4524c4451cf5f22238f0c33212c6e
Instruction ID: b70b2c6da274a63520c245585bfb2af4214ee46c1558c98e410521bfb9eb288b
Opcode Fuzzy Hash: 26cc945babe6491d33fc22870d2ab0111aa4524c4451cf5f22238f0c33212c6e
Instruction Fuzzy Hash: AC413E30601251AFDB26DF15D489B95BBE2FB05310F1881A9EB5CCF2AAD731E845CB51

Function 008673B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00865134,?,?,00000000,00000001), ref: 008673BF

Part of subcall function 00863C94: GetWindowRect.USER32(?,?), ref: 00863CA7

GetDesktopWindow.USER32 ref: 008673E9
GetWindowRect.USER32(00000000), ref: 008673F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00867422

Part of subcall function 008554E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0085555E

GetCursorPos.USER32(?), ref: 0086744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008674AC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 9f54e9f9a44ddf5d80edb5e2a3a02f7f87c13ef739479d0bcc659c9e77a7c803
Instruction ID: 3ba2674f16178cd199f142d89fc12e860faaa6d5b34a828e8cb500a86ff76144
Opcode Fuzzy Hash: 9f54e9f9a44ddf5d80edb5e2a3a02f7f87c13ef739479d0bcc659c9e77a7c803
Instruction Fuzzy Hash: 5031D272508305ABD720DF15D849E9BBBA9FF98318F000919F588D7192DB30EA48CBD6

Function 00848D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008485F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00848608
Part of subcall function 008485F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00848612
Part of subcall function 008485F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00848621
Part of subcall function 008485F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00848628
Part of subcall function 008485F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0084863E

GetLengthSid.ADVAPI32(?,00000000,00848977), ref: 00848DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00848DB8
HeapAlloc.KERNEL32(00000000), ref: 00848DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00848DD8
GetProcessHeap.KERNEL32(00000000,00000000,00848977), ref: 00848DEC
HeapFree.KERNEL32(00000000), ref: 00848DF3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: d668456dae8aafa7f07e44f5fec06982801c6c308c5d6dff2c72db0b2e4817ab
Instruction ID: eb3d431f843bb88463a224c172172f9cb354039cbf2b3de262edc5807ced8f37
Opcode Fuzzy Hash: d668456dae8aafa7f07e44f5fec06982801c6c308c5d6dff2c72db0b2e4817ab
Instruction Fuzzy Hash: 4B11EB32A02A08FFDB109FA5CC08BBE7BA9FF41315F144029E949D3251CB36E980CB60

Function 00848AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00848B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00848B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00848B40
CloseHandle.KERNEL32(00000004), ref: 00848B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00848B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00848B8E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 4fbce87394aa8d9eee8277e1b7a712fb1947915d25440b983ff67927d49fcac9
Instruction ID: 378d731d0ffc42251f4764cbef35b0277e8ad18083d7d4db2d74b328c14dd4d5
Opcode Fuzzy Hash: 4fbce87394aa8d9eee8277e1b7a712fb1947915d25440b983ff67927d49fcac9
Instruction Fuzzy Hash: 951136B250024DEFDB018FA5ED49FDE7BA9FB08358F044064FA08A2161C772CDA0AB60

Function 0087C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007F12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007F134D
Part of subcall function 007F12F3: SelectObject.GDI32(?,00000000), ref: 007F135C
Part of subcall function 007F12F3: BeginPath.GDI32(?), ref: 007F1373
Part of subcall function 007F12F3: SelectObject.GDI32(?,00000000), ref: 007F139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0087C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0087C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0087C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0087C1F6
EndPath.GDI32(00000000), ref: 0087C206
StrokePath.GDI32(00000000), ref: 0087C216

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: d62ad783a79907cec51e2984085eebd7e5719317478956c7c1fb90bee9d1e8e3
Instruction ID: ef3c4120ab2e50aa574f67ea27d7e19bd56d1e800c0b6f67345d593c994f0eb6
Opcode Fuzzy Hash: d62ad783a79907cec51e2984085eebd7e5719317478956c7c1fb90bee9d1e8e3
Instruction Fuzzy Hash: 2011097640410CBFDB129F91DC88EAA7FADFF08354F048025BA189A166D7719D95DBA0

Function 008103A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 008103D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 008103DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008103E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008103F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 008103F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00810401

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: a2dcccd4289201ca344e5408da897b9d2b6f8f688a5adb77399baff7bdf3cad2
Instruction ID: 22147b49f349cb4a95cba105d95ce8a51b40ec23238dda06988c1d91c0e3a522
Opcode Fuzzy Hash: a2dcccd4289201ca344e5408da897b9d2b6f8f688a5adb77399baff7bdf3cad2
Instruction Fuzzy Hash: 9A016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47942C7F5A864CBE5

Function 0085568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0085569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 008556B1
GetWindowThreadProcessId.USER32(?,?), ref: 008556C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008556CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008556D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008556E0

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: c90c2219d692f4193786fbab1e82d9ec7b0f80ff3f97e172d6ec99a21a7ce712
Instruction ID: ae52ef2c67af3eef770212ac8ce162bfa47614e0c97dba7bb39e38d03081894b
Opcode Fuzzy Hash: c90c2219d692f4193786fbab1e82d9ec7b0f80ff3f97e172d6ec99a21a7ce712
Instruction Fuzzy Hash: 1FF01D32245158BBE7215BA39C0DEAB7B7CFBD6B11F000169FA09D106296A19A41C6B5

Function 008574D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 008574E5
EnterCriticalSection.KERNEL32(?,?,00801044,?,?), ref: 008574F6
TerminateThread.KERNEL32(00000000,000001F6,?,00801044,?,?), ref: 00857503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00801044,?,?), ref: 00857510

Part of subcall function 00856ED7: CloseHandle.KERNEL32(00000000,?,0085751D,?,00801044,?,?), ref: 00856EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00857523
LeaveCriticalSection.KERNEL32(?,?,00801044,?,?), ref: 0085752A

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 433e1b955b4b8f32bd21d6933670958c401118f69a208d988b4416d1ff0aea83
Instruction ID: f058f4852fa06884a5aca22a462db29723fc1404502986722426c0e4bf67c816
Opcode Fuzzy Hash: 433e1b955b4b8f32bd21d6933670958c401118f69a208d988b4416d1ff0aea83
Instruction Fuzzy Hash: 89F09A3A054612EBDB121B24FC8C9EA372AFF05302B040131F706910AADB719880CAA0

Function 00848E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00848E7F
UnloadUserProfile.USERENV(?,?), ref: 00848E8B
CloseHandle.KERNEL32(?), ref: 00848E94
CloseHandle.KERNEL32(?), ref: 00848E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00848EA5
HeapFree.KERNEL32(00000000), ref: 00848EAC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 30613591f9835e445698e11d9c829950f600b216fa6d0ea4c45058acd7e36676
Instruction ID: 713d357ec66aa1e7e8b360d56b82426dda3040afff0f3fc86ab8f2d32a3fb24e
Opcode Fuzzy Hash: 30613591f9835e445698e11d9c829950f600b216fa6d0ea4c45058acd7e36676
Instruction Fuzzy Hash: 1AE0C236004001FBDA025FF2EC0C90ABB69FB89362B548230F31D82579CB3294A0DB60

Function 00868902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00868928
CharUpperBuffW.USER32(?,?), ref: 00868A37
VariantClear.OLEAUT32(?), ref: 00868BAF

Part of subcall function 00857804: VariantInit.OLEAUT32(00000000), ref: 00857844
Part of subcall function 00857804: VariantCopy.OLEAUT32(00000000,?), ref: 0085784D
Part of subcall function 00857804: VariantClear.OLEAUT32(00000000), ref: 00857859

Strings

Incorrect Parameter format, xrefs: 00868960, 00868B22
AUTOIT.ERROR, xrefs: 00868A3D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: fd7341bb04413db30b1caff328f69e9c35a8a31cebb19808e45a9a325a686103
Instruction ID: e609d6a9a45d6b814ef578bd99a8e60bcd73e5a57fda4fb859473dd64884c92d
Opcode Fuzzy Hash: fd7341bb04413db30b1caff328f69e9c35a8a31cebb19808e45a9a325a686103
Instruction Fuzzy Hash: EB912371608305DBC714DF28C48496ABBE4FF89354F048A6EF99ACB362DB31E945CB52

Function 00852F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0080FEC6: _wcscpy.LIBCMT ref: 0080FEE9

_memset.LIBCMT ref: 00853077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008530A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00853159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00853187

Strings

0, xrefs: 00853063

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 63fb6d6162012f1715c55635f9080b8a69185ef0caceb4fcbd92b288d8772a36
Instruction ID: 91a614566e66099421124c9acc1dc270e50e851fe52bba85e8487af89ca4b4ed
Opcode Fuzzy Hash: 63fb6d6162012f1715c55635f9080b8a69185ef0caceb4fcbd92b288d8772a36
Instruction Fuzzy Hash: 1C51C032608700AAD7259F38D845AABBBE8FF45391F040A2DFD95D22D1DB74CA48C792

Function 0084DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0084DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0084DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0084DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0084DB8E

Strings

DllGetClassObject, xrefs: 0084DB01

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: fd534d78efc6c44dae0fab9bbf23268f513f1351622d827abbf10c645942d41f
Instruction ID: bce2f15fb67fed5ee7078ad814c3cb1489b46b2d09245915602d57d46101a6f6
Opcode Fuzzy Hash: fd534d78efc6c44dae0fab9bbf23268f513f1351622d827abbf10c645942d41f
Instruction Fuzzy Hash: F1415EB160030DEFDB15CF55C888A9A7BA9FF44364F1580AAAD09DF206D7B1DD44DBA0

Function 00852C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00852CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00852D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,008B6890,00000000), ref: 00852D5A

Strings

0, xrefs: 00852CA4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: d20bce0946689c2adc86842395e8a4407ff6bbf8b1ab074f7e9adfb3cd4223c6
Instruction ID: 5082eacd47eab0d5e8ff178c5ba831bc21f58f2ee4308b8049084b76469ef09d
Opcode Fuzzy Hash: d20bce0946689c2adc86842395e8a4407ff6bbf8b1ab074f7e9adfb3cd4223c6
Instruction Fuzzy Hash: 5C418E302053069FD724DF28C844B5ABBE8FF86321F14466EED65D7292DB70E908CB92

Function 0086DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0086DAD9

Part of subcall function 007F79AB: _memmove.LIBCMT ref: 007F79F9

Strings

stdcall, xrefs: 0086DB5B
cdecl, xrefs: 0086DB30
winapi, xrefs: 0086DB4A
none, xrefs: 0086DBB4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 1d8ca71788a7161428567d1019e994bbdbd740112a46389391fd063054d0912d
Instruction ID: 2d807e9e071627c57647520a501d2cd1b57d02c43f7b0b272c982f7355069027
Opcode Fuzzy Hash: 1d8ca71788a7161428567d1019e994bbdbd740112a46389391fd063054d0912d
Instruction Fuzzy Hash: 3831A370A00619DBCF00EF94CC809FEB7B4FF15320B118A29E965D7795CB75A945CB80

Function 00849372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 008493F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00849409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00849439

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Strings

ComboBox, xrefs: 00849380
ListBox, xrefs: 008493B5

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: ba494b3450490f72eeb10d13e040f3f8c085369159234dcc919accdba8a01a43
Instruction ID: 75bded2084d14ff81dfc306a81626b1c15ef24999cf0b6d3c41a753def67c3a1
Opcode Fuzzy Hash: ba494b3450490f72eeb10d13e040f3f8c085369159234dcc919accdba8a01a43
Instruction Fuzzy Hash: FD21E47190410CAADB28AB74DC8ACFFB778FF05360B104119FA65D72E1DB394D4AD610

Function 00861B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00861B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00861B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00861B96
InternetCloseHandle.WININET(00000000), ref: 00861BDD

Part of subcall function 00862777: GetLastError.KERNEL32(?,?,00861B0B,00000000,00000000,00000001), ref: 0086278C
Part of subcall function 00862777: SetEvent.KERNEL32(?,?,00861B0B,00000000,00000000,00000001), ref: 008627A1

Strings

, xrefs: 00861B87

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: a0060233a93a446e0b4ad9a0bfdb8ba3246162c721e3468ddcce072e96c2d758
Instruction ID: e2cf7c3ae23251dc96805ea2c95d7da66eb975d21550be9d50bf45cfe9a689e9
Opcode Fuzzy Hash: a0060233a93a446e0b4ad9a0bfdb8ba3246162c721e3468ddcce072e96c2d758
Instruction Fuzzy Hash: E421CDB1600208BFEB119F259CC9EBF76FCFB497A8F15012AF505E6241EA209D049761

Function 00876656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007F1D73
Part of subcall function 007F1D35: GetStockObject.GDI32(00000011), ref: 007F1D87
Part of subcall function 007F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007F1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 008766D0
LoadLibraryW.KERNEL32(?), ref: 008766D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 008766EC
DestroyWindow.USER32(?), ref: 008766F4

Strings

SysAnimate32, xrefs: 008766AB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: cff3d50be2e741efd1551e5a036f8eea0c112a462f96e629dcf83459047128a1
Instruction ID: 7607e0e3f37a2d2a77240f7bbba177699658bfe7345a4c3a46958bbae4e9b7aa
Opcode Fuzzy Hash: cff3d50be2e741efd1551e5a036f8eea0c112a462f96e629dcf83459047128a1
Instruction Fuzzy Hash: EF219271100A05ABEF104F64DC84EBB37ADFF693A8F508629FA19D2194E771CCA19760

Function 0085703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0085705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00857091
GetStdHandle.KERNEL32(0000000C), ref: 008570A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 008570DD

Strings

nul, xrefs: 008570D8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 33e00672222e083ac59d5f1eab68bc03dc51592aa37615bea3b4b2718a161b35
Instruction ID: 6576750f5159bfa812c7189cf912246a93b9ad673e57fd94548d1a9ed2250b34
Opcode Fuzzy Hash: 33e00672222e083ac59d5f1eab68bc03dc51592aa37615bea3b4b2718a161b35
Instruction Fuzzy Hash: 5121B274504609ABDB209F39EC09A9A77F8FF54722F208619FDA1D72D0E7709858CB60

Function 0085710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0085712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0085715D
GetStdHandle.KERNEL32(000000F6), ref: 0085716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 008571A8

Strings

nul, xrefs: 008571A3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b3562930cf0ccb280ed29825df52aa322870aac397e45f8dea9a18d68e829557
Instruction ID: fbb9b39de07853f86f26abf8d1395d77c4000f778af6288c877e86b2e78b79a0
Opcode Fuzzy Hash: b3562930cf0ccb280ed29825df52aa322870aac397e45f8dea9a18d68e829557
Instruction Fuzzy Hash: E421D3755486099BDB209F29AC04AAAB7E8FF45332F204619FDB1D32D0E770D849CB61

Function 0085AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0085AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0085AF13
__swprintf.LIBCMT ref: 0085AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0087F910), ref: 0085AF6A

Strings

%lu, xrefs: 0085AF26

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 740e6bb96c3fefccf5795818454a8c5a9337f42f94fc623af1e9d05162d3c92a
Instruction ID: a2cae2ae75883fe0f6d36a044a47530b0a2f2a3efcbde9bf862ac2a479726989
Opcode Fuzzy Hash: 740e6bb96c3fefccf5795818454a8c5a9337f42f94fc623af1e9d05162d3c92a
Instruction Fuzzy Hash: 3A21623060010DAFCB10DB55C889EAE7BB8FF49704B104069FA09EB352DB75EA45DB21

Function 0084A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

Part of subcall function 0084A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0084A399
Part of subcall function 0084A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0084A3AC
Part of subcall function 0084A37C: GetCurrentThreadId.KERNEL32 ref: 0084A3B3
Part of subcall function 0084A37C: AttachThreadInput.USER32(00000000), ref: 0084A3BA

GetFocus.USER32 ref: 0084A554

Part of subcall function 0084A3C5: GetParent.USER32(?), ref: 0084A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0084A59D
EnumChildWindows.USER32(?,0084A615), ref: 0084A5C5
__swprintf.LIBCMT ref: 0084A5DF

Strings

%s%d, xrefs: 0084A5D9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 52692408ae9ed9e3fc5149e95c8446b8129df04fae75969c9d19fb96a4c0eeb8
Instruction ID: b0d79a769966c8a8f7826222f3eb42dfe729fcc91d6c3d6cfa4c5e5370ae1344
Opcode Fuzzy Hash: 52692408ae9ed9e3fc5149e95c8446b8129df04fae75969c9d19fb96a4c0eeb8
Instruction Fuzzy Hash: 41119D7164420CABDF14BF68DC89FEA3768FF48700F044075BA1CEA252DA749985CB76

Function 00852017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00852048

Strings

APPEND, xrefs: 00852081
EXISTS, xrefs: 00852070
KEYS, xrefs: 0085205F
REMOVE, xrefs: 0085204E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 43950a213ea4ff57d431b88e524ed6a3184d58af04780ef5e334e662a6bc5cd0
Instruction ID: 3d64e73b3c9b23e262d131fb3c3a2b6990cd09b689c78dd8fae7be2fb27ecfa9
Opcode Fuzzy Hash: 43950a213ea4ff57d431b88e524ed6a3184d58af04780ef5e334e662a6bc5cd0
Instruction Fuzzy Hash: 43115B30900109DFCF04EFA4D8414FEB7B5FF16304B108568D956E7692EB32A94ACB51

Function 0086EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0086EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0086EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0086F07E
CloseHandle.KERNEL32(?), ref: 0086F0FF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 81ea4cf9621fe0d6797fdf93eff12e27b1361d29258e0d46c5dc150e7ccc627a
Instruction ID: 465bac288e0e165549c714a76d52932170b9a4dd3792703c7fd9290acbbae566
Opcode Fuzzy Hash: 81ea4cf9621fe0d6797fdf93eff12e27b1361d29258e0d46c5dc150e7ccc627a
Instruction Fuzzy Hash: A0816D716047059FD720DF28D84AB6AB7E5FF48710F04881DFA99DB392DB74A840CB52

Function 008702C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 008710A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00870038,?,?), ref: 008710BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00870388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008703C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0087040E
RegCloseKey.ADVAPI32(?,?), ref: 0087043A
RegCloseKey.ADVAPI32(00000000), ref: 00870447

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 6c73bb6f3a5e526cbf8413440895a49c63e8f33ef254e2b90135d937e4986bee
Instruction ID: af8b1bd0eb77eaa20b01218e89c5a79aadf84ae7ac6ca61fce4e204353cdab69
Opcode Fuzzy Hash: 6c73bb6f3a5e526cbf8413440895a49c63e8f33ef254e2b90135d937e4986bee
Instruction Fuzzy Hash: CB512B71208208EFD704EB54D885E6EB7E8FF84318F04891DB699D7292DB34E905DB52

Function 0086DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0086DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 0086DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0086DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 0086DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0086DD35

Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00857B20,?,?,00000000), ref: 007F5B8C
Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00857B20,?,?,00000000,?,?), ref: 007F5BB0

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: f26d9d285d6bb4d05da75e6f14cb08132a92b7192965d8ff0bdfc80fd309b764
Instruction ID: e89786bf375a829bd853e6fa953112e31878778d92ea89cc1498527b8bd02218
Opcode Fuzzy Hash: f26d9d285d6bb4d05da75e6f14cb08132a92b7192965d8ff0bdfc80fd309b764
Instruction Fuzzy Hash: CB512875A00609DFCB00EF68C4889ADBBF4FF58310B05C069EA19AB352DB74ED45CB91

Function 0085E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0085E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0085E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0085E8F2

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0085E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0085E91F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 88ef1547501abcd26008572b28245b4cb2b97802fc65a1657d5db8dc454ead1a
Instruction ID: d692c377deb55b3c8c4d4cb8ded7712c2882a83dc1993df2412e5f2d06a4d9a8
Opcode Fuzzy Hash: 88ef1547501abcd26008572b28245b4cb2b97802fc65a1657d5db8dc454ead1a
Instruction Fuzzy Hash: DC512C35A00209DFCF05EF64C985AADBBF5FF48310B1480A9EA49AB362CB35ED51DB51

Function 0087A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a1a6bc3adaf607e4c6de0031bb47de4e510ffb5f5b860d71a6dea70bcb1006
Instruction ID: ec03b3044b9fcb8fb6381b6108ebf702d13d3e4f48431bb91226cdf30a8921ae
Opcode Fuzzy Hash: b9a1a6bc3adaf607e4c6de0031bb47de4e510ffb5f5b860d71a6dea70bcb1006
Instruction Fuzzy Hash: EA41C135900108ABD718DF28CC88BADBBA8FB89310F188265F95DE72E5D770ED41DA51

Function 007F2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007F2357
ScreenToClient.USER32(008B67B0,?), ref: 007F2374
GetAsyncKeyState.USER32(00000001), ref: 007F2399
GetAsyncKeyState.USER32(00000002), ref: 007F23A7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 8f71bf7e6a5ea0b8db80c138b38b3a7db601fb93b9577d6dbbfa263694c48c48
Instruction ID: 18c488809688dafb0a986c9c5f8c00ef0b2ec0d2fddace01caf567eaf265a98b
Opcode Fuzzy Hash: 8f71bf7e6a5ea0b8db80c138b38b3a7db601fb93b9577d6dbbfa263694c48c48
Instruction Fuzzy Hash: 6941B171504129FBCF199F68D848AFDBB74FF05364F20431AF928D62A1CB349994DBA1

Function 00846920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0084695D
TranslateAcceleratorW.USER32(?,?,?), ref: 008469A9
TranslateMessage.USER32(?), ref: 008469D2
DispatchMessageW.USER32(?), ref: 008469DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008469EB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 75cbb7ae8a0e9cbafc0203d65b9f5c3a425943cf8741d1ed2170ec92ff623210
Instruction ID: 6df929da08bfc4b2c84537b3ca37c1e3310ffa68f032ad04aebb42c19e0d95bc
Opcode Fuzzy Hash: 75cbb7ae8a0e9cbafc0203d65b9f5c3a425943cf8741d1ed2170ec92ff623210
Instruction Fuzzy Hash: 7931E27190065EAADB20CF74CC48BB67FA8FF12304F144265E425D21A1F7B8D8A9DB92

Function 00848F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00848F12
PostMessageW.USER32(?,00000201,00000001), ref: 00848FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00848FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00848FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00848FDA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: d9f1ab4266657d2bf99356f3245e75901910d65535904b704ccdbb98f91a35f4
Instruction ID: fb1a2adfa0c64cc2b218cdf4f9560b1b3cbc0d4a3557aa7419a4ff6ecf51e561
Opcode Fuzzy Hash: d9f1ab4266657d2bf99356f3245e75901910d65535904b704ccdbb98f91a35f4
Instruction Fuzzy Hash: A431EE7150021DEFDB00CF68D94CAAE7BB6FB14325F104229FA28EA1D1CBB0D958CB90

Function 0084B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0084B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0084B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0084B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0084B742
_wcsstr.LIBCMT ref: 0084B74C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 281f50d3beb3b45dd5efcd8b5744107db585b55d2e2f63c0003788a763edb8c7
Instruction ID: 44334dd6c638baf95b10b4b3c7dc2705a6b3cb95054540d22e315588b03ecc6a
Opcode Fuzzy Hash: 281f50d3beb3b45dd5efcd8b5744107db585b55d2e2f63c0003788a763edb8c7
Instruction Fuzzy Hash: 9321F932604248BBEB259B799C49E7B7B9CFF59720F004039FD09CA1A1EF61DC80D661

Function 0087B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

GetWindowLongW.USER32(?,000000F0), ref: 0087B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0087B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0087B489
GetSystemMetrics.USER32(00000004), ref: 0087B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00861184,00000000), ref: 0087B4D0

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 3faf5908bae51b54e50a5b0442c05a011e293778e47ff09ece0b9047a0289f76
Instruction ID: 784173a5fd048594d28c01b9173bd07fb6b5f31fb75fec755406a08813a6b1ab
Opcode Fuzzy Hash: 3faf5908bae51b54e50a5b0442c05a011e293778e47ff09ece0b9047a0289f76
Instruction Fuzzy Hash: 7121A331514255AFCB108F39CC08B6A37A6FB05724F148738FA2AD31E6E730D850DB94

Function 008497E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00849802

Part of subcall function 007F7D2C: _memmove.LIBCMT ref: 007F7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00849834
__itow.LIBCMT ref: 0084984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00849874
__itow.LIBCMT ref: 00849885

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 351af4029818e58c10a018d9a697e8ce19a332d127448342fbdde1b8e794372e
Instruction ID: 677860067569061ef4ad1ded1ec9611b55e3ae05dcf760c782a2bda824cd15eb
Opcode Fuzzy Hash: 351af4029818e58c10a018d9a697e8ce19a332d127448342fbdde1b8e794372e
Instruction Fuzzy Hash: 3F219831B0020CABDB219A698C8AEEF7BA9FF5A710F044035FE45DB291D670CD45D791

Function 007F12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007F134D
SelectObject.GDI32(?,00000000), ref: 007F135C
BeginPath.GDI32(?), ref: 007F1373
SelectObject.GDI32(?,00000000), ref: 007F139C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3642a910713106c5a479928d6e0a01ff89e60aa5437e51e7280ab5b8cf4cd1b3
Instruction ID: fe26946deaf86622b49736a3e3de1dffe76ea7063c01dcb3e018f48f54da5ace
Opcode Fuzzy Hash: 3642a910713106c5a479928d6e0a01ff89e60aa5437e51e7280ab5b8cf4cd1b3
Instruction Fuzzy Hash: 65212F71800208EFDB119F25EC087B97BF9FB00361F54833AF918966A1E77999A1DF90

Function 0084C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0084C176
_memcmp.LIBCMT ref: 0084C194
_memcmp.LIBCMT ref: 0084C1A7
_memcmp.LIBCMT ref: 0084C1BF
_memcmp.LIBCMT ref: 0084C1D7

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 01fa7db947d11e485ee9ce04d117f736282145c430e504d3ca9c00a5a3db76ba
Instruction ID: e9844970fc971c51eaf8e08802fcc3013082ea13d13b97bc9d15489dfef7e3f8
Opcode Fuzzy Hash: 01fa7db947d11e485ee9ce04d117f736282145c430e504d3ca9c00a5a3db76ba
Instruction Fuzzy Hash: 010192B160610D7BE604B6255C46FBB775CFF213A8F044021FE14D6283E655AE1182A1

Function 00854D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00854D5C
__beginthreadex.LIBCMT ref: 00854D7A
MessageBoxW.USER32(?,?,?,?), ref: 00854D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00854DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00854DAC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: da1317665e7b89eda63dabdebe26862d54f54323245a51b921255b996ccf03db
Instruction ID: be88877099e39b0261f8f8cc6fd62d47fa03dc56c9c27f5ed17a09ec8dd85785
Opcode Fuzzy Hash: da1317665e7b89eda63dabdebe26862d54f54323245a51b921255b996ccf03db
Instruction Fuzzy Hash: 3E1104B2904608BBD7019BA99C08ADA7FACFB49325F184369FD18D3351D675CD888BB0

Function 0084874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00848766
GetLastError.KERNEL32(?,0084822A,?,?,?), ref: 00848770
GetProcessHeap.KERNEL32(00000008,?,?,0084822A,?,?,?), ref: 0084877F
HeapAlloc.KERNEL32(00000000,?,0084822A,?,?,?), ref: 00848786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0084879D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 034866f684443460975b05403b48398276a6696a06471be1bd0118493844ac9d
Instruction ID: cfd73c6f4c76f85a0d4fa4275c2f87f2d9c9b210e211c581549ee9f2c1d4a9f6
Opcode Fuzzy Hash: 034866f684443460975b05403b48398276a6696a06471be1bd0118493844ac9d
Instruction Fuzzy Hash: 08014671204208EFDB204FA6DC8CD6B7BACFF8A355B200439F949C2260DA31CC80CA70

Function 008554E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00855502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00855510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00855518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00855522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0085555E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 461de2592a4140dd1c035c1963a1ed4051de5a64db68a3614baaad02136634f3
Instruction ID: 99f59049e6494e1d588c2953a66e0cadc01256a0f9c8180e3c2b1c727c65a79f
Opcode Fuzzy Hash: 461de2592a4140dd1c035c1963a1ed4051de5a64db68a3614baaad02136634f3
Instruction Fuzzy Hash: 07015B31C00A2DDBCF00EFE9E8589EDBB78FB09716F440056E905F2141EB309598C7A1

Function 00847652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?,?,0084799D), ref: 0084766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?), ref: 0084768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?), ref: 00847698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?), ref: 008476A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0084758C,80070057,?,?), ref: 008476B4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0a4b3f9efc320a477bb11ae561526acc63c97834f5953a9dbb5d06563ae23845
Instruction ID: 66046092d6d6fc77139b71e804862c7835003045179091ba1193f3176e533e26
Opcode Fuzzy Hash: 0a4b3f9efc320a477bb11ae561526acc63c97834f5953a9dbb5d06563ae23845
Instruction Fuzzy Hash: 9401B172600618ABDB108F19DC08AAA7BAEFF58751F150038FE08D2216E731DD8087A0

Function 008485F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00848608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00848612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00848621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00848628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0084863E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f4f3fcfe3c26345f6efd42ce4c7ae39104eeee956b7057f77245108af016c944
Instruction ID: 57c9064851492eda32bb28ec6b21ff6b463a53c268ebf63ca6764dc1098b03c3
Opcode Fuzzy Hash: f4f3fcfe3c26345f6efd42ce4c7ae39104eeee956b7057f77245108af016c944
Instruction Fuzzy Hash: 18F03731201208EFEB110FA6DC8DE6B3BACFF8AB54F440429FA49C6251CB61DC81DA70

Function 00848652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00848669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00848673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00848682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00848689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0084869F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 69e8188fd3485c2873624068b3748ad5e5b24341fad8653b272dc811ceeb8c79
Instruction ID: 149a0ca9027f25634ef3e781d8fdda61e59ba7a5c669301185a1b8bacfd0bcf8
Opcode Fuzzy Hash: 69e8188fd3485c2873624068b3748ad5e5b24341fad8653b272dc811ceeb8c79
Instruction Fuzzy Hash: FDF04F71200308EFEB111FA6EC8CE6B3BACFF8A754F140025FA49C6251CB61D981DA70

Function 0084C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0084C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0084C6D1
MessageBeep.USER32(00000000), ref: 0084C6E9
KillTimer.USER32(?,0000040A), ref: 0084C705
EndDialog.USER32(?,00000001), ref: 0084C71F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: c19ae2f5bb13ecd2075c187763030be792889d9d15a7da5447ab2a158b3d65e6
Instruction ID: 80b93c7a355b72b61a5abc8ab53e7416865a97a0e4479441bc2cf2dd2433a21d
Opcode Fuzzy Hash: c19ae2f5bb13ecd2075c187763030be792889d9d15a7da5447ab2a158b3d65e6
Instruction Fuzzy Hash: 2C01A230500308ABEB205B25DC4EFA677BCFF10745F00066DF646E10E1DBE0A9948F80

Function 007F13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007F13BF
StrokeAndFillPath.GDI32(?,?,0082BAD8,00000000,?), ref: 007F13DB
SelectObject.GDI32(?,00000000), ref: 007F13EE
DeleteObject.GDI32 ref: 007F1401
StrokePath.GDI32(?), ref: 007F141C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f57ee23dbfc51790f2978df05327ddbe04ac7b3c4914a38579a572cde165c558
Instruction ID: a02f64ae90ab5ef8b876ca456a534179c04876c4593a59364e16f164a2ec7e4a
Opcode Fuzzy Hash: f57ee23dbfc51790f2978df05327ddbe04ac7b3c4914a38579a572cde165c558
Instruction Fuzzy Hash: 40F0C431004648EBDB125F26EC0C7683FA5BB41326F54C334E62D952F6D73989A5DF61

Function 0085C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0085C69D
CoCreateInstance.OLE32(00882D6C,00000000,00000001,00882BDC,?), ref: 0085C6B5

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

CoUninitialize.OLE32 ref: 0085C922

Strings

.lnk, xrefs: 0085C631, 0085C659, 0085C663

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 258bb4d50df2ea1decd16b0e092d8b6c0ea856f1a66c99782994cfbe1cd3bd1a
Instruction ID: 7e62fd65103ab7efa60a5b7dabf795619bbd4882c9fab1f5fc1693e178b5d7f2
Opcode Fuzzy Hash: 258bb4d50df2ea1decd16b0e092d8b6c0ea856f1a66c99782994cfbe1cd3bd1a
Instruction Fuzzy Hash: 31A12B71108309AFD700EF54C885EABB7E8FF95704F00492CF656972A2EB74EA49CB52

Function 00802E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00810FF6: std::exception::exception.LIBCMT ref: 0081102C
Part of subcall function 00810FF6: __CxxThrowException@8.LIBCMT ref: 00811041

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 007F7BB1: _memmove.LIBCMT ref: 007F7C0B

__swprintf.LIBCMT ref: 0080302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00802EC6

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 406075afb91879d79849e74d682e5fb5d017d334398818ba602282585551a2e3
Instruction ID: d01d81f143bdf2fa071271d9863d1e1c492a08a2af80fb190a6acd20f62b4d6d
Opcode Fuzzy Hash: 406075afb91879d79849e74d682e5fb5d017d334398818ba602282585551a2e3
Instruction Fuzzy Hash: 15916C71508605EFC718EF28D889C7EB7A8FF85750F00491DF646D72A1EA64EE44CB92

Function 0085BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 007F48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007F48A1,?,?,007F37C0,?), ref: 007F48CE

CoInitialize.OLE32(00000000), ref: 0085BC26
CoCreateInstance.OLE32(00882D6C,00000000,00000001,00882BDC,?), ref: 0085BC3F
CoUninitialize.OLE32 ref: 0085BC5C

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

Strings

.lnk, xrefs: 0085BC08, 0085BC16

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 359fc50e0b42baa287c13c42a1c7e1e4903ca26b792e4fda7b4731156c60c4f9
Instruction ID: 51ac426f5a14c66b55de832d10463c926a3d60ef72231cea96b5aff54167a794
Opcode Fuzzy Hash: 359fc50e0b42baa287c13c42a1c7e1e4903ca26b792e4fda7b4731156c60c4f9
Instruction Fuzzy Hash: 4AA143752043059FCB00DF14C488E6ABBE5FF89315F148998FA999B3A2CB35ED49CB91

Function 0081524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008152DD

Part of subcall function 00820340: __87except.LIBCMT ref: 0082037B

Strings

pow, xrefs: 008152B5, 008152D2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 194c7eb7124ff9d0ee107eebe7b6b09664addc87ccbb16b9eb14b30e288616a8
Instruction ID: 2e53b0fa4b134ca6d6ead9ee0ab74062f684c7bbfc245dff2e3b225a6237d732
Opcode Fuzzy Hash: 194c7eb7124ff9d0ee107eebe7b6b09664addc87ccbb16b9eb14b30e288616a8
Instruction Fuzzy Hash: E0515A62A0C605C7CB11B718E9513AA2B98FF81754F708958E495C63EBEF74CCC49E8A

Function 0081023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00810280
+, xrefs: 00810277

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: af63d7bfa30d9cd61dded4df211cb5daec4a48eaae21284cbaf7705fa0ecb23d
Instruction ID: 5b368bfba1724d615adfea0d49d4c4c34c9ffea329b9cac9a02f038d69e3dc47
Opcode Fuzzy Hash: af63d7bfa30d9cd61dded4df211cb5daec4a48eaae21284cbaf7705fa0ecb23d
Instruction Fuzzy Hash: 4751017590564DDFCB159F28C888BFD7BA8FF16310F184065E8A1DB2A2D7749C82CB60

Function 008062F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008063A8
_memmove.LIBCMT ref: 00806446
_memset.LIBCMT ref: 0080646A

Strings

ERCP, xrefs: 00806313

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 96cfd92f27912a4b39a570a29d5356c532e47c8c0996548efbf92f91cd261b20
Instruction ID: 77ecf8170e263f5426e04b4a54491c003fb11f0bdf64e1946dccaa7a6a418071
Opcode Fuzzy Hash: 96cfd92f27912a4b39a570a29d5356c532e47c8c0996548efbf92f91cd261b20
Instruction Fuzzy Hash: 4951C1719007099BDB24CF65CC857AABBF8FF04314F20856EE64ACB281F770A6A4CB45

Function 00877BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0087F910,00000000,?,?,?,?), ref: 00877C4E
GetWindowLongW.USER32 ref: 00877C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00877C7B

Strings

SysTreeView32, xrefs: 00877C20

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 28258974e2cd0a3ed3b937a0813a112593a88ce047b5e8f46a9b234b672cf820
Instruction ID: f72098c9b6c012020b8a135e2f47e64b4a9175293b48fa089a7c309aeae050f5
Opcode Fuzzy Hash: 28258974e2cd0a3ed3b937a0813a112593a88ce047b5e8f46a9b234b672cf820
Instruction Fuzzy Hash: 18318E31204209ABDB118E38CC45BEA77A9FF49324F248725F979D32E5D735E851DB50

Function 00877648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 008776D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 008776E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00877708

Strings

SysMonthCal32, xrefs: 0087769B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 8b24f3e403a17d30b80005a48bdfec31a3dedea054e116f3709fdbc9c836b106
Instruction ID: e13a4486de9124bb7f79c72514f712cddff22cce2b86c620a65bf2f085b6bb9e
Opcode Fuzzy Hash: 8b24f3e403a17d30b80005a48bdfec31a3dedea054e116f3709fdbc9c836b106
Instruction Fuzzy Hash: 7E21EF32600218ABDF118EA4CC46FEA3B79FB58714F100254FE19AB1D4DAB1E890CBA0

Function 00876F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00876FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00876FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00876FDF

Strings

Listbox, xrefs: 00876F77

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 72d362de88d433f3cc8e10ef5e067d8ac9d9af36b70981bd90b913dd19958ae4
Instruction ID: 7c8b45c6b418584984716025c8aacad5d6d9249003973de32d751dd5c0402b12
Opcode Fuzzy Hash: 72d362de88d433f3cc8e10ef5e067d8ac9d9af36b70981bd90b913dd19958ae4
Instruction Fuzzy Hash: 0421B032610118BFDF119F54DC85EBB3BAAFF89754F018124FA18DB194DA71EC618BA0

Function 0087797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 008779E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 008779F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00877A03

Strings

msctls_trackbar32, xrefs: 008779B8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 498c5b05dba243836069de549c227fd126e6b0980469f9f5ef80fde3ee6a9e3e
Instruction ID: 8a0c8610df22d214908aa0f25268dca9fb0032a4953a0a97021d8463f7c90600
Opcode Fuzzy Hash: 498c5b05dba243836069de549c227fd126e6b0980469f9f5ef80fde3ee6a9e3e
Instruction Fuzzy Hash: 01112332244208BBEF109F60CC05FAB7BA9FF89B64F014628FB04A2091D271D811DB20

Function 007F4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007F4C2E), ref: 007F4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007F4CB5

Strings

kernel32.dll, xrefs: 007F4C9E
GetNativeSystemInfo, xrefs: 007F4CAF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: edd81ff282cc11ddf24f7c6e972b275a14d3e2b91c25aae9bac8a2752abd912b
Instruction ID: 10e2c1268cb75f912c3165f06335d57d4b40c720e6a7b95ed982e389783991ef
Opcode Fuzzy Hash: edd81ff282cc11ddf24f7c6e972b275a14d3e2b91c25aae9bac8a2752abd912b
Instruction Fuzzy Hash: D8D01730510727CFD7209F36DA1861676E5BF057A1F11C83AAAAAD6255E678D8C0CA60

Function 007F4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007F4D2E,?,007F4F4F,?,008B62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007F4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007F4D81

Strings

kernel32.dll, xrefs: 007F4D6A
Wow64DisableWow64FsRedirection, xrefs: 007F4D7B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 5313279da5a736cb302de734edb63fe7bc8e29b2abcbcac8a11db14fbd9bfd7e
Instruction ID: c6ad73fb4cde77815d8f446a946960e3347df0a3be47f8b843d114bf3f0588db
Opcode Fuzzy Hash: 5313279da5a736cb302de734edb63fe7bc8e29b2abcbcac8a11db14fbd9bfd7e
Instruction Fuzzy Hash: C1D01730610713CFD7219F32DC0862676E8BF15362F11C83AA69AD6754E678D8C0CA60

Function 007F4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007F4CE1,?), ref: 007F4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007F4DB4

Strings

kernel32.dll, xrefs: 007F4D9D
Wow64RevertWow64FsRedirection, xrefs: 007F4DAE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: c60494f6be85eac794e8caf3cbef4ff9213514e4605d774ff45815328a85976d
Instruction ID: a64fa5d4f8b607c0a9d811163dc51c387c54a2e49bc373e70a0455707b5750a8
Opcode Fuzzy Hash: c60494f6be85eac794e8caf3cbef4ff9213514e4605d774ff45815328a85976d
Instruction Fuzzy Hash: 0BD01731650713DFD7209F36D808A5676E4FF05355F11C83AEADAD6654E778D8C0CA60

Function 00871072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,008712C1), ref: 00871080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00871092

Strings

advapi32.dll, xrefs: 0087107B
RegDeleteKeyExW, xrefs: 0087108C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 4647012b87f5a53a919959023fa763391d5ac02bc1a958e98845c758204f2c43
Instruction ID: c9af57f6b6e6076498ff8b56c74b8cca2572598d126b85d92c023692a490f3a3
Opcode Fuzzy Hash: 4647012b87f5a53a919959023fa763391d5ac02bc1a958e98845c758204f2c43
Instruction Fuzzy Hash: 52D01230510712CFD7209F75D81C61676E4FF15351F11CC3AA49DD6A55D774C4C0CA50

Function 008693F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00869009,?,0087F910), ref: 00869403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00869415

Strings

kernel32.dll, xrefs: 008693FE
GetModuleHandleExW, xrefs: 0086940F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: bc704311970a8a6d25387eeaab28896bc7f801a2db42345545f02b6a78053c33
Instruction ID: b55ad1568e0e6fed38eaa028893ad6d8662c85bc78365fe5cc9752e3a3971d5b
Opcode Fuzzy Hash: bc704311970a8a6d25387eeaab28896bc7f801a2db42345545f02b6a78053c33
Instruction Fuzzy Hash: D1D08230500313CFE7208B32C94822272E8FF11361F02C83AE59AC2A91EA74C880CA20

Function 008476C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2059530f020d7320de4af42402a67e11727091702a6450cbca49802933cc40f8
Instruction ID: 6397147df35664edb3237fcbad9432acc183c4bc27b4fab26e9b7e0c86e4a038
Opcode Fuzzy Hash: 2059530f020d7320de4af42402a67e11727091702a6450cbca49802933cc40f8
Instruction Fuzzy Hash: 28C14175A0421AEFDB14CFA4C884EAEBBF5FF48714B158599E805EB251D730ED81CB90

Function 0086E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0086E3D2
CharLowerBuffW.USER32(?,?), ref: 0086E415

Part of subcall function 0086DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0086DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0086E615
_memmove.LIBCMT ref: 0086E628

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 035b41f313b966688bfa38a99910b90e957bd2f394ba6a4d623e2a0053143212
Instruction ID: eedb54bd41e72c29c4733d200f32ae4f1fb9e6a9aa5374b3ae7b51e43b1b4cb8
Opcode Fuzzy Hash: 035b41f313b966688bfa38a99910b90e957bd2f394ba6a4d623e2a0053143212
Instruction Fuzzy Hash: 8CC134756083018FC714DF28C484A6ABBE4FF88718F15896DF99ADB351DB70E946CB82

Function 008683A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008683D8
CoUninitialize.OLE32 ref: 008683E3

Part of subcall function 0084DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0084DAC5

VariantInit.OLEAUT32(?), ref: 008683EE
VariantClear.OLEAUT32(?), ref: 008686BF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: e173653cfe0973e1a8fdbdfb32857e4823b94ba2804a1e99a7a1e4cb13a447c4
Instruction ID: ef056dc370b8c87963f073d98c8805e4c907aaaf43c76872a4ef55615cab2937
Opcode Fuzzy Hash: e173653cfe0973e1a8fdbdfb32857e4823b94ba2804a1e99a7a1e4cb13a447c4
Instruction Fuzzy Hash: 8EA10175204705DFCB10DF24C889B2AB7E4FF88354F058548FA9A9B3A2CB74E944CB56

Function 00847A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00882C7C,?), ref: 00847C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00882C7C,?), ref: 00847C4A
CLSIDFromProgID.OLE32(?,?,00000000,0087FB80,000000FF,?,00000000,00000800,00000000,?,00882C7C,?), ref: 00847C6F
_memcmp.LIBCMT ref: 00847C90

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 9f29cb9540783b0777b3c8e5792234fb80f3208ac1d6ff98593d69c707da2286
Instruction ID: 59a6f5770fd4307dc9f118ba3a82267f7509850a022e5bba93d86ca9dfb9c03f
Opcode Fuzzy Hash: 9f29cb9540783b0777b3c8e5792234fb80f3208ac1d6ff98593d69c707da2286
Instruction Fuzzy Hash: 57810A71A00109EFCB04DF94C988EEEB7B9FF89315F204599E515EB250DB71AE46CB60

Function 00846DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00846E04
SysAllocString.OLEAUT32(00000000), ref: 00846EAD
VariantCopy.OLEAUT32 ref: 00846EDC
VariantClear.OLEAUT32(?), ref: 00846F03

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 93d28e9f8413f6ec453c65cdf7b53f96963498324281fc6f97b3b49a2f1c47fa
Instruction ID: 4884c8d0283a578f436ffbe243a63bbe4d016113b12d39efc29a70b6992930f9
Opcode Fuzzy Hash: 93d28e9f8413f6ec453c65cdf7b53f96963498324281fc6f97b3b49a2f1c47fa
Instruction Fuzzy Hash: 5651D83060470DDADB20AF79D895B39B3E4FF49310F20881FE696C7292EF7498849B16

Function 00879A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0143E3B8,?), ref: 00879AD2
ScreenToClient.USER32(00000002,00000002), ref: 00879B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00879B72

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 5739e085d1ae8e3effee38ecf9e1a126245e3425c8db0adb9fc1f7062e8996d9
Instruction ID: afc6f025e6341f9cd54e891b9555c286f3f081996ec9b8b108004dd347ba9ed7
Opcode Fuzzy Hash: 5739e085d1ae8e3effee38ecf9e1a126245e3425c8db0adb9fc1f7062e8996d9
Instruction Fuzzy Hash: 98512A34A00219EFCF10DF68D8859AE7BB6FB55320F148269F959DB2A4D730ED91CB90

Function 00866CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00866CE4
WSAGetLastError.WSOCK32(00000000), ref: 00866CF4

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00866D58
WSAGetLastError.WSOCK32(00000000), ref: 00866D64

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: b86b8f102af898e4f1f929bcd3eb76c9ad09541ac3a30c9a061b9e0c50ea6536
Instruction ID: be8673c7bac231939c265b43cd9aa70054092298caaa0117a6cf1b90a53bb795
Opcode Fuzzy Hash: b86b8f102af898e4f1f929bcd3eb76c9ad09541ac3a30c9a061b9e0c50ea6536
Instruction Fuzzy Hash: 1B418274740204AFEB10AF24DC8AF7A77A9EB44B14F448058FB59DF3D2DA759D108B92

Function 0086672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0087F910), ref: 008667BA
_strlen.LIBCMT ref: 008667EC

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 508be49670781a203d6790bfc34f597213af02400ea90f8209b99f79ac1839cf
Instruction ID: bc53ecc3e348c19d943b683b190f8053386d54df81fea0296fe0f0f414d121d3
Opcode Fuzzy Hash: 508be49670781a203d6790bfc34f597213af02400ea90f8209b99f79ac1839cf
Instruction Fuzzy Hash: 3A418031A00108ABCB14EB68DCC5EBEB7A9FF48314F158165FA29DB392EB34AD50C751

Function 0085BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0085BB09
GetLastError.KERNEL32(?,00000000), ref: 0085BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0085BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0085BB80

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: e907e43e9062f9844a2739970f855e5dbd879c64ea2ff17ee68ea2ec6220643d
Instruction ID: a52c0c4b6088e70614e2d796cbe8db643897a5e6a5f89af2816a17c784674894
Opcode Fuzzy Hash: e907e43e9062f9844a2739970f855e5dbd879c64ea2ff17ee68ea2ec6220643d
Instruction Fuzzy Hash: 66411839200614DFCB11EF15C588A69BBE5FF89320B098498EE4A9B362CB74FD45CB91

Function 00878AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00878B4D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e3d83a9f6ead8d3edbe7f2d489fe106d5a57d4fe294668036b2c16c183415f70
Instruction ID: 40fcbd5dedee63afdc3797e1e550e56eb1aa8b12a880309aad745fc2ac1e46cc
Opcode Fuzzy Hash: e3d83a9f6ead8d3edbe7f2d489fe106d5a57d4fe294668036b2c16c183415f70
Instruction Fuzzy Hash: AB31D474680218FFEB209A28CC8DFA97764FB05330F24C616FA59D72A9DF30E9509B51

Function 0087ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0087AE1A
GetWindowRect.USER32(?,?), ref: 0087AE90
PtInRect.USER32(?,?,0087C304), ref: 0087AEA0
MessageBeep.USER32(00000000), ref: 0087AF11

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9bb30570e28719e6ea524536f493a661430883c2a63f1122586c33c3737638ac
Instruction ID: 3472271cce13297b3bcee19ccd14349f75de5da168a4b9854419f4aedca2be62
Opcode Fuzzy Hash: 9bb30570e28719e6ea524536f493a661430883c2a63f1122586c33c3737638ac
Instruction Fuzzy Hash: 4B417B72604119DFCB19CF58C884A6DBBF5FB88340F14C1A9E81CCB269D730E841CB92

Function 00850FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00851037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00851053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 008510B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0085110B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 1ee676cecc0f313be7a247fa249338d0dc8b28d40da96284fa16a82fca308153
Instruction ID: c8ab79fb06c0307cad445e15f9c1b665d0d03530dbfcbf92cf02efdfeaadeb5e
Opcode Fuzzy Hash: 1ee676cecc0f313be7a247fa249338d0dc8b28d40da96284fa16a82fca308153
Instruction Fuzzy Hash: 00313B30E40A98AEFF308B698C0DBF9BBA5FB44316F04435AED84D21D1C77489C89B56

Function 00851121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00851176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00851192
PostMessageW.USER32(00000000,00000101,00000000), ref: 008511F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00851243

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b9359b7cd73cc70835924bcf374751c095288a7e097d18de49cd5bac58a88eac
Instruction ID: b6a4f8abe81b31a25871fe93e9fcd4e534fc727bdccce7fdc886daddb36f0416
Opcode Fuzzy Hash: b9359b7cd73cc70835924bcf374751c095288a7e097d18de49cd5bac58a88eac
Instruction Fuzzy Hash: 1C312B30980A0C5AEF20CB698C0D7FABBAAFB49316F04539BEA85D21D1C374899D9755

Function 00826415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0082644B
__isleadbyte_l.LIBCMT ref: 00826479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008264A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008264DD

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1ed9a32488ca593fc7e1d4f70ff4d43920e8dd0c4516ea22ef8ed36e85df4b44
Instruction ID: 033df0a02ecc5a656321d8b073c02637a6c8f385b0313a01066e0600b276a27a
Opcode Fuzzy Hash: 1ed9a32488ca593fc7e1d4f70ff4d43920e8dd0c4516ea22ef8ed36e85df4b44
Instruction Fuzzy Hash: 4B31C17160026AEFDB21AF65E845BBA7BA9FF40320F154429F894C7191F731D8E0DB94

Function 00875175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00875189

Part of subcall function 0085387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00853897
Part of subcall function 0085387D: GetCurrentThreadId.KERNEL32 ref: 0085389E
Part of subcall function 0085387D: AttachThreadInput.USER32(00000000,?,008552A7), ref: 008538A5

GetCaretPos.USER32(?), ref: 0087519A
ClientToScreen.USER32(00000000,?), ref: 008751D5
GetForegroundWindow.USER32 ref: 008751DB

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 11665d050fefbbf0f3845ff146212bea8fc5583c38a1304cfd067738657a3018
Instruction ID: 3b3283855b9549b09bb4cb9ea6eb3f8e1a4818bf6944c8c4e40de4030a395b6c
Opcode Fuzzy Hash: 11665d050fefbbf0f3845ff146212bea8fc5583c38a1304cfd067738657a3018
Instruction Fuzzy Hash: A5310171900108AFDB04EFA9C845AEFB7F9FF58300F10406AE515E7251DA759E45CFA1

Function 0087C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

GetCursorPos.USER32(?), ref: 0087C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0082BBFB,?,?,?,?,?), ref: 0087C7D7
GetCursorPos.USER32(?), ref: 0087C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0082BBFB,?,?,?), ref: 0087C85E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 866b3bad0725ee3c3c594bfd864974f19c0489c9688ee015dfd7c3f39c8f8b3c
Instruction ID: 8d43337fd73e1db02ef556823caacbd4bbd65571632454848466bd6e954b4003
Opcode Fuzzy Hash: 866b3bad0725ee3c3c594bfd864974f19c0489c9688ee015dfd7c3f39c8f8b3c
Instruction Fuzzy Hash: AB31A035600018AFCB15CF59C898EEA7BB6FB09310F048169FA09CB266C735DE60DFA1

Function 00848B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00848652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00848669
Part of subcall function 00848652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00848673
Part of subcall function 00848652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00848682
Part of subcall function 00848652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00848689
Part of subcall function 00848652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0084869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00848BEB
_memcmp.LIBCMT ref: 00848C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00848C44
HeapFree.KERNEL32(00000000), ref: 00848C4B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2a550135bf8eb41d61b9c636bffea8812fa2d6ca0d6e2e7fb2c03a88bd031514
Instruction ID: 1b4d8b973812a6815f28c34edcc7ab598aa7132be15e8f0667ead172a3632b0c
Opcode Fuzzy Hash: 2a550135bf8eb41d61b9c636bffea8812fa2d6ca0d6e2e7fb2c03a88bd031514
Instruction Fuzzy Hash: EE217771E0120CEBCB00CFA4C988BEEB7B8FF40354F084059E558E7241EB31AA46DB60

Function 00810BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00810BF2

Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00857B20,?,?,00000000), ref: 007F5B8C
Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00857B20,?,?,00000000,?,?), ref: 007F5BB0

_fprintf.LIBCMT ref: 00810C29
OutputDebugStringW.KERNEL32(?), ref: 00846331

Part of subcall function 00814CDA: _flsall.LIBCMT ref: 00814CF3

__setmode.LIBCMT ref: 00810C5E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 752c400e1449c1dccd555fa39982c7f50e2746fafa7d58e461715b3f7b4fd8b9
Instruction ID: a520e45a61a1dd9e06292495845308a66ea722793c09516b1a22a27e3c040946
Opcode Fuzzy Hash: 752c400e1449c1dccd555fa39982c7f50e2746fafa7d58e461715b3f7b4fd8b9
Instruction Fuzzy Hash: 0411243290420CAACB04B7B8AC469FE7B6DFF41320F14011AF205D72D2EE655DD68BD2

Function 00861A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00861A97

Part of subcall function 00861B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00861B40
Part of subcall function 00861B21: InternetCloseHandle.WININET(00000000), ref: 00861BDD

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 4c0d6adac832feb4ac4c64bc41bf9df6c7fedf3df31b8308d52c5ad2a70f36fb
Instruction ID: 99937faef57fcb2ebdc6c14c2465cdeaa95e6c96366ca04b36bf9ddf573dddea
Opcode Fuzzy Hash: 4c0d6adac832feb4ac4c64bc41bf9df6c7fedf3df31b8308d52c5ad2a70f36fb
Instruction Fuzzy Hash: CC21D135200A05BFDB159F64CC09FBAB7ADFF44712F1A001AFA05D6652EB31D810ABA0

Function 0084E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0084F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0084E1C4,?,?,?,0084EFB7,00000000,000000EF,00000119,?,?), ref: 0084F5BC
Part of subcall function 0084F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0084F5E2
Part of subcall function 0084F5AD: lstrcmpiW.KERNEL32(00000000,?,0084E1C4,?,?,?,0084EFB7,00000000,000000EF,00000119,?,?), ref: 0084F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0084EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0084E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0084E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0084EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0084E237

Strings

cdecl, xrefs: 0084E22E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 1ae814feb26c663f793e377e0dd9c2ee816929650b6bfc840bde423ba5a2388f
Instruction ID: b7cfe81a914c01c46ac45c5fbdcafe90f4f2366c1c1c00fda0596f68f302a7a9
Opcode Fuzzy Hash: 1ae814feb26c663f793e377e0dd9c2ee816929650b6bfc840bde423ba5a2388f
Instruction Fuzzy Hash: 2B118136100359EFCB25AF78DC49D7A77A8FF45350B40402AF916CB254EBB1D891D7A1

Function 00825332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00825351

Part of subcall function 0081594C: __FF_MSGBANNER.LIBCMT ref: 00815963
Part of subcall function 0081594C: __NMSG_WRITE.LIBCMT ref: 0081596A
Part of subcall function 0081594C: RtlAllocateHeap.NTDLL(01420000,00000000,00000001,00000000,?,?,?,00811013,?), ref: 0081598F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: f4fed0a3f337f0a6bb6c980366153c0930c417f6bebe80b2c3ad96c649d6ae60
Instruction ID: 675acd0cdfcbb8dd47c76aba326dd56f88fec1e1a7bccf4940368e8305a77cfd
Opcode Fuzzy Hash: f4fed0a3f337f0a6bb6c980366153c0930c417f6bebe80b2c3ad96c649d6ae60
Instruction Fuzzy Hash: 5811C472544B25EECB216F78FC4E6A93798FF163A0F201529F904DA291DE7189C08791

Function 007F4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F4560

Part of subcall function 007F410D: _memset.LIBCMT ref: 007F418D
Part of subcall function 007F410D: _wcscpy.LIBCMT ref: 007F41E1
Part of subcall function 007F410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007F41F1

KillTimer.USER32(?,00000001,?,?), ref: 007F45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007F45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0082D6CE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 9cbb820851cb09375bcd7b958071f31462882711c50143b2156f63095b1b21fb
Instruction ID: d6db46a6a6e27e8b59af4aa241047160dca5e645c4f5888efa301e39738c414b
Opcode Fuzzy Hash: 9cbb820851cb09375bcd7b958071f31462882711c50143b2156f63095b1b21fb
Instruction Fuzzy Hash: 3C21B6709087989FEB329B249849BE7BFECEF11308F04009DE79D97246C7785AC48B91

Function 0086667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00857B20,?,?,00000000), ref: 007F5B8C
Part of subcall function 007F5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00857B20,?,?,00000000,?,?), ref: 007F5BB0

gethostbyname.WSOCK32(?,?,?), ref: 008666AC
WSAGetLastError.WSOCK32(00000000), ref: 008666B7
_memmove.LIBCMT ref: 008666E4
inet_ntoa.WSOCK32(?), ref: 008666EF

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 1be01be475d47af92fa0964ca6a709583e393d5be891495dd23903ab92141ac8
Instruction ID: bdd015f7f4a24019a8d9b1cd49836b117f1a64e8939d515e8e33cddd591c5b1b
Opcode Fuzzy Hash: 1be01be475d47af92fa0964ca6a709583e393d5be891495dd23903ab92141ac8
Instruction Fuzzy Hash: A3114C75900509EBCB04EBA4D99ADEEB7B8FF04310B144165F706E7262EF34AE54CB62

Function 00849023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00849043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00849055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0084906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00849086

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2e4254aa3f0530095e6e40534e06fbea1eeda5339603c60ae3c4ad66e945b94f
Instruction ID: af1a7bff5cef2e7890b27e18a8a52df5296e4d0fd37ce0ea4ab210c6ecd38549
Opcode Fuzzy Hash: 2e4254aa3f0530095e6e40534e06fbea1eeda5339603c60ae3c4ad66e945b94f
Instruction Fuzzy Hash: EA115E79900218FFDB10DFA5CC84E9EBBB4FB48710F204095EA04B7250D671AE50DB90

Function 007F1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 007F2612: GetWindowLongW.USER32(?,000000EB), ref: 007F2623

DefDlgProcW.USER32(?,00000020,?), ref: 007F12D8
GetClientRect.USER32(?,?), ref: 0082B84B
GetCursorPos.USER32(?), ref: 0082B855
ScreenToClient.USER32(?,?), ref: 0082B860

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: bf6a77fe5bcbaa0202519ef3f3ff6e3f4bea81561b6828a1c4067aabc69abeb3
Instruction ID: 47ec3d2145524678d1dbdeca1b1f9ea9afc1a715a46c3aa490beda4c2cf3e51b
Opcode Fuzzy Hash: bf6a77fe5bcbaa0202519ef3f3ff6e3f4bea81561b6828a1c4067aabc69abeb3
Instruction Fuzzy Hash: 7B112535A0001DEFCB00EFA8D8899FE77B8FB05310F404466FA15E7251D738AA91CBA6

Function 00851652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008501FD,?,00851250,?,00008000), ref: 0085166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,008501FD,?,00851250,?,00008000), ref: 00851694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008501FD,?,00851250,?,00008000), ref: 0085169E
Sleep.KERNEL32(?,?,?,?,?,?,?,008501FD,?,00851250,?,00008000), ref: 008516D1

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 74f30ccb10458e150c42ffc686adc982d96dbcfac8249a3d98e44e8b6c6c18d4
Instruction ID: 334d005da628ea2d1c867635c0a91424f65dd208a872449e886564b748d00d78
Opcode Fuzzy Hash: 74f30ccb10458e150c42ffc686adc982d96dbcfac8249a3d98e44e8b6c6c18d4
Instruction Fuzzy Hash: D0113A31C0451DD7CF009FA6D848BEEBBB8FF19712F444095DA44F2240CB309594CBA6

Function 00827207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0082722B

Part of subcall function 00827912: __fltout2.LIBCMT ref: 0082793B

__cftog_l.LIBCMT ref: 00827251
__cftoe_l.LIBCMT ref: 00827283

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: e679e9007c99eb0313cb1d3320f9da08a44503fe472ae8ad52dee10f72285e6a
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2F01803204419EFBCF125E8AEC028EE3F22FF19344B088515FA1998031C237C9B1AB81

Function 0087B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0087B59E
ScreenToClient.USER32(?,?), ref: 0087B5B6
ScreenToClient.USER32(?,?), ref: 0087B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0087B5F5

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d30eabc45113f5cc10b72ba76e714ec8dfcfc9c95cbf8199e8580c426f6bcfee
Instruction ID: 5628d5add7da8a3536ee322cb6c0d199e18296d5d8629137372ba200bb60c29f
Opcode Fuzzy Hash: d30eabc45113f5cc10b72ba76e714ec8dfcfc9c95cbf8199e8580c426f6bcfee
Instruction Fuzzy Hash: FA1146B5D00209EFDB41DF99C844AEEFBB5FB18310F108166E914E3224D735AA558F50

Function 0087B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087B8FE
_memset.LIBCMT ref: 0087B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,008B7F20,008B7F64), ref: 0087B93C
CloseHandle.KERNEL32 ref: 0087B94E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: d83a284446e12513a425764a668340e451985af6de3d258ccccd9baf1ec16713
Instruction ID: 3d0e47df4fa45eb998b9e019ea3a938958da483b74c51a1ec2aec56301facef9
Opcode Fuzzy Hash: d83a284446e12513a425764a668340e451985af6de3d258ccccd9baf1ec16713
Instruction Fuzzy Hash: 6FF05EB25443007BE2106B65AC09FBB3B9DFB48354F004020BB0CE6396DB71990087AD

Function 00856E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00856E88

Part of subcall function 0085794E: _memset.LIBCMT ref: 00857983

_memmove.LIBCMT ref: 00856EAB
_memset.LIBCMT ref: 00856EB8
LeaveCriticalSection.KERNEL32(?), ref: 00856EC8

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: a06b92a28e34780c0eac537d3a893cfb96f8fe9a2ee5b02aab79a88044d91f89
Instruction ID: f2f3337b0995650013d370618b267d436bd2e181a02c539bc2fe47675ec16aca
Opcode Fuzzy Hash: a06b92a28e34780c0eac537d3a893cfb96f8fe9a2ee5b02aab79a88044d91f89
Instruction Fuzzy Hash: 24F0543A104200ABCF016F55DC85E89BB6AFF49321B04C065FE0C9E21BC731E951CBB5

Function 0087C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007F12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007F134D
Part of subcall function 007F12F3: SelectObject.GDI32(?,00000000), ref: 007F135C
Part of subcall function 007F12F3: BeginPath.GDI32(?), ref: 007F1373
Part of subcall function 007F12F3: SelectObject.GDI32(?,00000000), ref: 007F139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0087C030
LineTo.GDI32(00000000,?,?), ref: 0087C03D
EndPath.GDI32(00000000), ref: 0087C04D
StrokePath.GDI32(00000000), ref: 0087C05B

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 9678a371d08d28de6457f14d3a3c8e01f3b6be81dd083e51ba68e7fae820bb40
Instruction ID: 81c45666951ef271f2bda7c7a394a33ae2796aae729d62315cae364c6934e7e8
Opcode Fuzzy Hash: 9678a371d08d28de6457f14d3a3c8e01f3b6be81dd083e51ba68e7fae820bb40
Instruction Fuzzy Hash: 88F09A31004619FBDB126F51AC0DFCA3B99BF06310F048010FB29611E2C76985A0CBE5

Function 0084A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0084A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0084A3AC
GetCurrentThreadId.KERNEL32 ref: 0084A3B3
AttachThreadInput.USER32(00000000), ref: 0084A3BA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e8d0c54b669f6c59a5d3583b7a966b3ecbee7eb8e698b56f376ba02272ab24ee
Instruction ID: 3f53b75e58d1d087f12415ac636a31d097bdb7a359c319939bc2572c9fe5dc2a
Opcode Fuzzy Hash: e8d0c54b669f6c59a5d3583b7a966b3ecbee7eb8e698b56f376ba02272ab24ee
Instruction Fuzzy Hash: A9E01571185328BADB201FA2DC0CED73F5CFF267A1F008024B609C8061D671C580CBA0

Function 007F2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007F2231
SetTextColor.GDI32(?,000000FF), ref: 007F223B
SetBkMode.GDI32(?,00000001), ref: 007F2250
GetStockObject.GDI32(00000005), ref: 007F2258
GetWindowDC.USER32(?,00000000), ref: 0082C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0082C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0082C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0082C112
GetPixel.GDI32(00000000,?,?), ref: 0082C132
ReleaseDC.USER32(?,00000000), ref: 0082C13D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: ffb5843addb23a79e919b56f409e573a2937d8aea4a21c102fc94ad255862433
Instruction ID: 6ab3bf4bc48cc0ea92db38c6ed3ea685184139046a5041d5875920b1590531dd
Opcode Fuzzy Hash: ffb5843addb23a79e919b56f409e573a2937d8aea4a21c102fc94ad255862433
Instruction Fuzzy Hash: 00E03932204244EADB225F65FC0D7E83B10FB05332F008366FB6D880E6877189D0DB21

Function 00848C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00848C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0084882E), ref: 00848C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0084882E), ref: 00848C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0084882E), ref: 00848C7E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: dbb92d772a5b2b4cd2af07e929e5e9ad356f00046050f3c092fec991f9016a62
Instruction ID: a6f21b66961e6d0234ff1f656e1931297bc416c7e7234f772f4e1db5b442bc2a
Opcode Fuzzy Hash: dbb92d772a5b2b4cd2af07e929e5e9ad356f00046050f3c092fec991f9016a62
Instruction Fuzzy Hash: ABE04F36642211DBD7605FB26D0CB5A3BA8FF51792F044828A349CA046DA34C4C18B61

Function 00832187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00832187
GetDC.USER32(00000000), ref: 00832191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008321B1
ReleaseDC.USER32(?), ref: 008321D2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c9ba72ee9ccfdcfc15b36e4bca5588ce4fe6ddaba0052e5d6e3253a082e1eeb0
Instruction ID: aef75b8a9677b7909f571009ca787d103b905e0a080e9957f972c3fd66edb376
Opcode Fuzzy Hash: c9ba72ee9ccfdcfc15b36e4bca5588ce4fe6ddaba0052e5d6e3253a082e1eeb0
Instruction Fuzzy Hash: 2AE0E575804608EFDB019F61C90CAAD7BB1FB5C350F108425FA5AE7321CB3891819F40

Function 0083219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0083219B
GetDC.USER32(00000000), ref: 008321A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008321B1
ReleaseDC.USER32(?), ref: 008321D2

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e92b74c112d4197257e785ab2791c9e21c9cf6f1c8f48c0993b4e70430f7e345
Instruction ID: c63cb02a42d0148b4ce8c0b157e114579dcfcd26928b51f4bd743ab1f20a034f
Opcode Fuzzy Hash: e92b74c112d4197257e785ab2791c9e21c9cf6f1c8f48c0993b4e70430f7e345
Instruction Fuzzy Hash: 22E0E575804208AFCB019F61C80C6AD7BA1BB5C310F108025FA5AA7321CB3891819F40

Function 0084B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0084B981

Strings

Container, xrefs: 0084B8FE
AutoIt3GUI, xrefs: 0084B8F9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 9eea439dff5e7851edf891c425827fc2ddee0eaf46b5a65eda2e5ec65fd8bc0c
Instruction ID: 75c37e15b59a376e96c6b6beacccc589707fad10db57d355a858e6633f46c1db
Opcode Fuzzy Hash: 9eea439dff5e7851edf891c425827fc2ddee0eaf46b5a65eda2e5ec65fd8bc0c
Instruction Fuzzy Hash: 56913A706006099FDB24DF68C885A6ABBF9FF49710F14856EF94ACB791EB70E841CB50

Function 0085B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0080FEC6: _wcscpy.LIBCMT ref: 0080FEE9

Part of subcall function 007F9997: __itow.LIBCMT ref: 007F99C2
Part of subcall function 007F9997: __swprintf.LIBCMT ref: 007F9A0C

__wcsnicmp.LIBCMT ref: 0085B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0085B361

Strings

LPT, xrefs: 0085B292

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 2dffe4983f7c854c7f652a68cd4de438d8ee45e69b15a1fcc0a6ab505ec14e90
Instruction ID: 0ab6a26d1cf89310bb91128fc8ba45118e909ae315950af587947fddb3906b08
Opcode Fuzzy Hash: 2dffe4983f7c854c7f652a68cd4de438d8ee45e69b15a1fcc0a6ab505ec14e90
Instruction Fuzzy Hash: 94614C75A00219AFCB14DB98C885EEEB7F4FB18311F114069FA46EB391DB74AE44CB51

Function 00802AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00802AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00802AE1

Strings

@, xrefs: 00802AD5

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: c8bea1dbc6906c70e0a8878f7efde20b7239af7609bfff6a8ae7e90458674aa5
Instruction ID: 77d7bc24a036ecdd4fa5f681582b0c826e5c2ce694af7fdc9b3d91b5a6e6d605
Opcode Fuzzy Hash: c8bea1dbc6906c70e0a8878f7efde20b7239af7609bfff6a8ae7e90458674aa5
Instruction Fuzzy Hash: 8F515771418749DBD320BF54DC8ABABBBE8FF84310F82885DF2D9511A5DB348529CB26

Function 008599BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007F506B: __fread_nolock.LIBCMT ref: 007F5089

_wcscmp.LIBCMT ref: 00859AAE
_wcscmp.LIBCMT ref: 00859AC1

Strings

FILE, xrefs: 008599FA

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: c3261e4d8f005a378d2c8883af3656f86f142905c6ce0be00ab2968fe2f5b914
Instruction ID: 036995ee58703fd8a9ca431195c572341d2dad45a31967ac661092906a7fd15d
Opcode Fuzzy Hash: c3261e4d8f005a378d2c8883af3656f86f142905c6ce0be00ab2968fe2f5b914
Instruction Fuzzy Hash: CD41C671A00619FADF209EA4DC45FEFBBBDEF45710F000479FA40E7281DA759A0487A1

Function 00862882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00862892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 008628C8

Strings

|, xrefs: 00862899

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: cbb4107749cc4f61cad8e7caee189934d0955681d5ad1549c1baf2873761e6c3
Instruction ID: 000d57b15fedd078ba247e51dfb77c09d5fa0e3f0694c209b79e77573e2929f0
Opcode Fuzzy Hash: cbb4107749cc4f61cad8e7caee189934d0955681d5ad1549c1baf2873761e6c3
Instruction Fuzzy Hash: 0B31387180011DEBDF05AFA5CC89EEEBFB9FF08340F004069E915A6266DA355A56DBA0

Function 00876CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00876D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00876DC2

Strings

static, xrefs: 00876D22

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ed3c2ddacc0e57044dae5e0051cf731d526e3e1f5587de8e695b8dcd3c56f52c
Instruction ID: d5b9a0e4f4a1e081eb6e2343019c2283389d2d066f0d84f87259785efc0a80c1
Opcode Fuzzy Hash: ed3c2ddacc0e57044dae5e0051cf731d526e3e1f5587de8e695b8dcd3c56f52c
Instruction Fuzzy Hash: 7631AF71210604AADB209F28CC84BFB77A9FF48320F10C619F9A9D7194DA35ECA1CB60

Function 00852D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00852E3B

Strings

0, xrefs: 00852DF9

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a0f7ab3ba1ec8ce4c8fbe6968d0ea77afc44efca61f5927b16adf4ae7a9b87f5
Instruction ID: e473476d0efc1ef263e057cf4d14aebbc8e2202cfb0979387a4e04d47ec7b764
Opcode Fuzzy Hash: a0f7ab3ba1ec8ce4c8fbe6968d0ea77afc44efca61f5927b16adf4ae7a9b87f5
Instruction Fuzzy Hash: F431D731A00309ABEB24CF58D8867DEBBB9FF06351F140069ED85D61A2EF709D48CB51

Function 00876943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 008769D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008769DB

Strings

Combobox, xrefs: 0087699D

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: d0d3f26ec41816ac8eda9153f6a132d3916e885ca6f6c2cb09a215a08daaa9ef
Instruction ID: d78f73caf97a3d80a8b10793f18b3a1b72c3cd29b165ee8fa0024344727cf1f6
Opcode Fuzzy Hash: d0d3f26ec41816ac8eda9153f6a132d3916e885ca6f6c2cb09a215a08daaa9ef
Instruction Fuzzy Hash: A311D071200608AFEF118E14CC80FBB3B6AFB883A4F148224FA5CD7295E675DC6187A0

Function 00876E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 007F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007F1D73
Part of subcall function 007F1D35: GetStockObject.GDI32(00000011), ref: 007F1D87
Part of subcall function 007F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007F1D91

GetWindowRect.USER32(00000000,?), ref: 00876EE0
GetSysColor.USER32(00000012), ref: 00876EFA

Strings

static, xrefs: 00876EBD

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 26c427293b4e8ae2b27c8cda436e478ca17495a9bd885b6c5ee9679801693d37
Instruction ID: 0f0a342f798127ddbe6ba6eddda5d9b8196c6866d0c1dca33d845bbfef24ddbf
Opcode Fuzzy Hash: 26c427293b4e8ae2b27c8cda436e478ca17495a9bd885b6c5ee9679801693d37
Instruction Fuzzy Hash: F2216D72610609AFDB04DFA8CC45AFA7BB8FB08314F044628FE59E3250E734E861DB60

Function 00876B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00876C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00876C20

Strings

edit, xrefs: 00876BF5

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 1fb209fd51f9bc7abd44dd105c268f1c249ee5d8edc9c607fee976a3094b5a0d
Instruction ID: b9989ac7cde555751a41af7691f182d76248c0e6dc4658b388de71be9e03926e
Opcode Fuzzy Hash: 1fb209fd51f9bc7abd44dd105c268f1c249ee5d8edc9c607fee976a3094b5a0d
Instruction Fuzzy Hash: 8311BF71500608ABEB114E64DC45AFB3769FB55378F608724FA68D31E8E735DCA0AB60

Function 00852E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00852F30

Strings

0, xrefs: 00852F07

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 51b3186b3f68ecc0f7a9eeea55652f850a370d07e71f4d48c1af59566e3236a8
Instruction ID: 51ad159f2a6408586168c80037f2f9c2d3b956dc88adc72a888bec59d6845a8f
Opcode Fuzzy Hash: 51b3186b3f68ecc0f7a9eeea55652f850a370d07e71f4d48c1af59566e3236a8
Instruction Fuzzy Hash: 8111D036901228ABCB20DB58EC45B9D77B9FB06315F0400B1EC44F72A1EFB0AD0887D1

Function 008624CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00862520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00862549

Strings

<local>, xrefs: 00862511

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 26b2eac8c77007495d807eda7e0b8a2d1614ef8274c7254c48f7d28c2c78f18f
Instruction ID: 6a29c5cd48ac7a10f84055626f6f34243ac98f876f3a95eef89724c2b38895d6
Opcode Fuzzy Hash: 26b2eac8c77007495d807eda7e0b8a2d1614ef8274c7254c48f7d28c2c78f18f
Instruction Fuzzy Hash: 9C11E070100A25BADB388F518C9DEBBFF68FF06355F11816AFA0682040D7706980DAF0

Function 008680A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0086830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,008680C8,?,00000000,?,?), ref: 00868322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008680CB
htons.WSOCK32(00000000,?,00000000), ref: 00868108

Strings

255.255.255.255, xrefs: 008680E3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 58b671d56fc2649881d65b46c2db492f8980e5d22ad7c215f642a8643ca2b86e
Instruction ID: 9a410b52a7c68947d54288429e4e9f45ec4c0c14c49a23d982a00b985bb4337a
Opcode Fuzzy Hash: 58b671d56fc2649881d65b46c2db492f8980e5d22ad7c215f642a8643ca2b86e
Instruction Fuzzy Hash: 8911A534500209EBDB24AF64CC46FBDB774FF05360F108626EA15D7391DB71A815C756

Function 008492E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00849355

Strings

ComboBox, xrefs: 008492F4
ListBox, xrefs: 0084931F

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: eef7476e9cd2760a213100d52a7873b52f628eb911f9969ab23cd3868388505e
Instruction ID: 86a91f11ab89a4c7ffcee74ea50fd20f832b7a18984c61eeda5140610a8aaed3
Opcode Fuzzy Hash: eef7476e9cd2760a213100d52a7873b52f628eb911f9969ab23cd3868388505e
Instruction Fuzzy Hash: 8B019271A4521CABCB18EF64CC96CFE7769FF06320B140619FA72973D1EA355918C650

Function 008491DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0084924D

Strings

ComboBox, xrefs: 008491EC
ListBox, xrefs: 00849217

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 39f2aefc4f51a1788d0640eeb332fde4ffbd1ff79d0a70fcb3720b4594a56e71
Instruction ID: 94a87851a610ccb554befa4beb4df78ed5b7159d20501b5494807f92a208de3a
Opcode Fuzzy Hash: 39f2aefc4f51a1788d0640eeb332fde4ffbd1ff79d0a70fcb3720b4594a56e71
Instruction Fuzzy Hash: 7401D471E4510CBBCB18EBA4C897EFF77A8FF05300F140119BA62A7281EA549E088261

Function 00849264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007F7F41: _memmove.LIBCMT ref: 007F7F82

Part of subcall function 0084B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0084B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 008492D0

Strings

ComboBox, xrefs: 00849271
ListBox, xrefs: 0084929C

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 21d861076680cfc41c0c9a37f45a9cb42a856d388c1c0634f52e0942a8537ceb
Instruction ID: 81b91a34dff2ada7a93f1c9e82dea79bf1046a9336d19ccf0992636bc7a6d50a
Opcode Fuzzy Hash: 21d861076680cfc41c0c9a37f45a9cb42a856d388c1c0634f52e0942a8537ceb
Instruction Fuzzy Hash: 9601A271E4511CB7DB18EAA4C986EFF77ACFF11300F240115BA62A3282DA659E089272

Function 008551CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008551E8
_wcscmp.LIBCMT ref: 008551FA

Strings

#32770, xrefs: 008551F4

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: ea3610adfb776aae2fe62de045c950fcdfd98b140925726f3c7cfff32a8fd497
Instruction ID: 2ecdb45327b2c7634304fff666504a602d040fd3395c221ffcf54130727b4327
Opcode Fuzzy Hash: ea3610adfb776aae2fe62de045c950fcdfd98b140925726f3c7cfff32a8fd497
Instruction Fuzzy Hash: 70E06832A0032D2BE7209A99EC09FA7F7ACFF41771F00016BFD14D3050E660AA448BE1

Function 008481BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 008481CA

Part of subcall function 00813598: _doexit.LIBCMT ref: 008135A2

Strings

AutoIt, xrefs: 008481BE
Error allocating memory., xrefs: 008481C3

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: d5cf8f26a0f31101de789d75b0ba1bf3f23a6f9903ae0f40de46ae3dc27b647a
Instruction ID: 6350ee00074ac5490d142f3b499d12d423debd01f99bcc3cc0d98fd5a5d67562
Opcode Fuzzy Hash: d5cf8f26a0f31101de789d75b0ba1bf3f23a6f9903ae0f40de46ae3dc27b647a
Instruction Fuzzy Hash: 8AD0123228531872D61432A96C0EBCA794CEF19F55F104016FB08D56D38DD595C242D9

Function 0082B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0082B564: _memset.LIBCMT ref: 0082B571

Part of subcall function 00810B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0082B540,?,?,?,007F100A), ref: 00810B89

IsDebuggerPresent.KERNEL32(?,?,?,007F100A), ref: 0082B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,007F100A), ref: 0082B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0082B54E

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 0843cc5b14dd12484ef638e07ed7581944987c8065055ae4250429e07b65b57a
Instruction ID: 06d6c2958026671395f04cc9ce6b74ec382ddd41156da827d635d800797006a9
Opcode Fuzzy Hash: 0843cc5b14dd12484ef638e07ed7581944987c8065055ae4250429e07b65b57a
Instruction Fuzzy Hash: 70E06D702007218BD720EF29E9083467BE4FF00714F04892DE54ACB352EBB8D488CBA1

Function 00875BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00875BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00875C08

Part of subcall function 008554E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0085555E

Strings

Shell_TrayWnd, xrefs: 00875BEE

Memory Dump Source

Source File: 00000000.00000002.1624394089.00000000007F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007F0000, based on PE: true

Associated: 00000000.00000002.1624381774.00000000007F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.000000000087F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624441088.00000000008A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624474556.00000000008AF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1624519848.00000000008B8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7f0000_2yylp1mMbi.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5d5e883cfa74273ebbe4f42898c81917808c2832965b8b6f2f72218289df7119
Instruction ID: d60218ba44b602f8c51308462c6ef6ad6acdde3891e1ffe34187eee9ab3148ce
Opcode Fuzzy Hash: 5d5e883cfa74273ebbe4f42898c81917808c2832965b8b6f2f72218289df7119
Instruction Fuzzy Hash: CFD0A931388300B6E368BB30EC0FF932A10FB10B01F000828B70AEA1E1C9E49880C640

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2yylp1mMbi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Esher

C:\Users\user\AppData\Local\Temp\autA19A.tmp

C:\Users\user\AppData\Local\Temp\autA1D9.tmp

C:\Users\user\AppData\Local\Temp\gobioid

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
2yylp1mMbi.exe

Function 007F3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 007F4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 007F4FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 008593DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 007F3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70
windowregistryCOMMON

Function 007F3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 007F71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 007F3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 007F3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 007F3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 021D2640 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007F39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 021D2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Function 007F410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 0081564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre