Edit tour

Windows Analysis Report
Attendance list.exe

Overview

General Information

Sample name:	Attendance list.exe
Analysis ID:	1465802
MD5:	ac274060092bb14f6504d6fd48c20590
SHA1:	9c1c471f9a2fe2523062c8bcd16fbf093ae6a72e
SHA256:	e977838b7536ed73154cbfb37e2204bbc873da89b3c5aeed5bb2d9eff73a07b6
Tags:	exe
Infos:

Detection

FormBook

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Attendance list.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\Attendance list.exe" MD5: AC274060092BB14F6504D6FD48C20590)

svchost.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\Attendance list.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2acb0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x141bf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e763:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17c72:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2e763:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x17c72:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.unpack	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2d963:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x16e72:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Attendance list.exe", CommandLine: "C:\Users\user\Desktop\Attendance list.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Attendance list.exe", ParentImage: C:\Users\user\Desktop\Attendance list.exe, ParentProcessId: 7432, ParentProcessName: Attendance list.exe, ProcessCommandLine: "C:\Users\user\Desktop\Attendance list.exe", ProcessId: 7452, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\Attendance list.exe", CommandLine: "C:\Users\user\Desktop\Attendance list.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\Attendance list.exe", ParentImage: C:\Users\user\Desktop\Attendance list.exe, ParentProcessId: 7432, ParentProcessName: Attendance list.exe, ProcessCommandLine: "C:\Users\user\Desktop\Attendance list.exe", ProcessId: 7452, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Attendance list.exe	ReversingLabs: Detection: 44%
Source: Attendance list.exe	Virustotal: Detection: 39%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Attendance list.exe

Joe Sandbox ML: detected

Source: Attendance list.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: Attendance list.exe, 00000000.00000003.1650735131.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, Attendance list.exe, 00000000.00000003.1650516808.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1975568723.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1977257906.0000000003500000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Attendance list.exe, 00000000.00000003.1650735131.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, Attendance list.exe, 00000000.00000003.1650516808.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2013318515.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1975568723.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1977257906.0000000003500000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_002B4696
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BC93C FindFirstFileW,FindClose,	0_2_002BC93C
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_002BC9C7
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002BF200
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002BF35D
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_002BF65E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002B3A2B
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002B3D4E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_002BBF27

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002C25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_002C25E2

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002C425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_002C425A

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002C4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_002C4458

Source: C:\Users\user\Desktop\Attendance list.exe

0_2_002C425A

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002B0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_002B0219

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002DCDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_002DCDAC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00253B4C
Source: Attendance list.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Attendance list.exe, 00000000.00000000.1642064482.0000000000305000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cbf527d6-0
Source: Attendance list.exe, 00000000.00000000.1642064482.0000000000305000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_14feb605-6
Source: Attendance list.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b35930b1-2
Source: Attendance list.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7758b7e3-f

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042BBA3 NtClose,	1_2_0042BBA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772B60 NtClose,LdrInitializeThunk,	1_2_03772B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03772DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037735C0 NtCreateMutant,LdrInitializeThunk,	1_2_037735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03774340 NtSetContextThread,	1_2_03774340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03774650 NtSuspendThread,	1_2_03774650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BF0 NtAllocateVirtualMemory,	1_2_03772BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BE0 NtQueryValueKey,	1_2_03772BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772BA0 NtEnumerateValueKey,	1_2_03772BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772B80 NtQueryInformationFile,	1_2_03772B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AF0 NtWriteFile,	1_2_03772AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AD0 NtReadFile,	1_2_03772AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772AB0 NtWaitForSingleObject,	1_2_03772AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F60 NtCreateProcessEx,	1_2_03772F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F30 NtCreateSection,	1_2_03772F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FE0 NtCreateFile,	1_2_03772FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FB0 NtResumeThread,	1_2_03772FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772FA0 NtQuerySection,	1_2_03772FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772F90 NtProtectVirtualMemory,	1_2_03772F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772E30 NtWriteVirtualMemory,	1_2_03772E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772EE0 NtQueueApcThread,	1_2_03772EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772EA0 NtAdjustPrivilegesToken,	1_2_03772EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772E80 NtReadVirtualMemory,	1_2_03772E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D30 NtUnmapViewOfSection,	1_2_03772D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D10 NtMapViewOfSection,	1_2_03772D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772D00 NtSetInformationFile,	1_2_03772D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DD0 NtDelayExecution,	1_2_03772DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772DB0 NtEnumerateKey,	1_2_03772DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C70 NtFreeVirtualMemory,	1_2_03772C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C60 NtCreateKey,	1_2_03772C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772C00 NtQueryInformationProcess,	1_2_03772C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CF0 NtOpenProcess,	1_2_03772CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CC0 NtQueryVirtualMemory,	1_2_03772CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772CA0 NtQueryInformationToken,	1_2_03772CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773010 NtOpenDirectoryObject,	1_2_03773010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773090 NtSetValueKey,	1_2_03773090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037739B0 NtGetContextThread,	1_2_037739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773D70 NtOpenThread,	1_2_03773D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03773D10 NtOpenProcessToken,	1_2_03773D10

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002B4021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_002B4021

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002A8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_002A8858

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002B545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_002B545F

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0025E800	0_2_0025E800
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027DBB5	0_2_0027DBB5
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0025E060	0_2_0025E060
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002D804A	0_2_002D804A
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00264140	0_2_00264140
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00272405	0_2_00272405
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00286522	0_2_00286522
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002D0665	0_2_002D0665
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0028267E	0_2_0028267E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027283A	0_2_0027283A
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00266843	0_2_00266843
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002889DF	0_2_002889DF
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00268A0E	0_2_00268A0E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00286A94	0_2_00286A94
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002D0AE2	0_2_002D0AE2
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002AEB07	0_2_002AEB07
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B8B13	0_2_002B8B13
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027CD61	0_2_0027CD61
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00287006	0_2_00287006
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0026710E	0_2_0026710E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00263190	0_2_00263190
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00251287	0_2_00251287
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002733C7	0_2_002733C7
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027F419	0_2_0027F419
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00265680	0_2_00265680
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002716C4	0_2_002716C4
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002658C0	0_2_002658C0
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002778D3	0_2_002778D3
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00271BB8	0_2_00271BB8
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00289D05	0_2_00289D05
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0025FE40	0_2_0025FE40
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027BFE6	0_2_0027BFE6
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00271FD0	0_2_00271FD0
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_03963600	0_2_03963600
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403840	1_2_00403840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042E053	1_2_0042E053
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040282A	1_2_0040282A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402830	1_2_00402830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004010C0	1_2_004010C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410893	1_2_00410893
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004010BE	1_2_004010BE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E913	1_2_0040E913
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004029F0	1_2_004029F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004033FF	1_2_004033FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404C54	1_2_00404C54
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403400	1_2_00403400
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402CA4	1_2_00402CA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402CB0	1_2_00402CB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410673	1_2_00410673
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416FDF	1_2_00416FDF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416FE3	1_2_00416FE3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA352	1_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038003E6	1_2_038003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0	1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C02C0	1_2_037C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C8158	1_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038001AA	1_2_038001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118	1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730100	1_2_03730100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F81CC	1_2_037F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F41A2	1_2_037F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764750	1_2_03764750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373C7C0	1_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375C6E0	1_2_0375C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03800591	1_2_03800591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F2446	1_2_037F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4420	1_2_037E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EE4F6	1_2_037EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FAB40	1_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F6BD7	1_2_037F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962	1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380A9A6	1_2_0380A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374A840	1_2_0374A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03742840	1_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E8F0	1_2_0376E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037268B8	1_2_037268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4F40	1_2_037B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760F30	1_2_03760F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E2F30	1_2_037E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03782F28	1_2_03782F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732FC8	1_2_03732FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BEFA0	1_2_037BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740E59	1_2_03740E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FEE26	1_2_037FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FEEDB	1_2_037FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752E90	1_2_03752E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FCE93	1_2_037FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DCD1F	1_2_037DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374AD00	1_2_0374AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373ADE0	1_2_0373ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03758DBF	1_2_03758DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740C00	1_2_03740C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730CF2	1_2_03730CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0CB5	1_2_037E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372D34C	1_2_0372D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F132D	1_2_037F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0378739A	1_2_0378739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E12ED	1_2_037E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375B2C0	1_2_0375B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037452A0	1_2_037452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372F172	1_2_0372F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377516C	1_2_0377516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374B1B0	1_2_0374B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380B16B	1_2_0380B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F70E9	1_2_037F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF0E0	1_2_037FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EF0CC	1_2_037EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037470C0	1_2_037470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF7B0	1_2_037FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03785630	1_2_03785630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F16CC	1_2_037F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7571	1_2_037F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038095C3	1_2_038095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DD5B0	1_2_037DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03731460	1_2_03731460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FF43F	1_2_037FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFB76	1_2_037FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B5BF0	1_2_037B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377DBF9	1_2_0377DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375FB80	1_2_0375FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B3A6C	1_2_037B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFA49	1_2_037FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7A46	1_2_037F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EDAC6	1_2_037EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DDAAC	1_2_037DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03785AA0	1_2_03785AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E1AA3	1_2_037E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03749950	1_2_03749950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375B950	1_2_0375B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D5910	1_2_037D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AD800	1_2_037AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037438E0	1_2_037438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFF09	1_2_037FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03703FD2	1_2_03703FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03703FD5	1_2_03703FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFFB1	1_2_037FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03741F92	1_2_03741F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03749EB0	1_2_03749EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F7D73	1_2_037F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F1D5A	1_2_037F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03743D40	1_2_03743D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375FDC0	1_2_0375FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B9C32	1_2_037B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FFCF2	1_2_037FFCF2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03775130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03787E54 appears 108 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0372B970 appears 265 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 037AEA12 appears 86 times
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: String function: 00278B40 appears 42 times
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: String function: 00270D27 appears 70 times
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: String function: 00257F41 appears 35 times

Source: Attendance list.exe, 00000000.00000003.1651034764.0000000003FA3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Attendance list.exe
Source: Attendance list.exe, 00000000.00000003.1650222790.00000000040FD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Attendance list.exe

Source: Attendance list.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal88.troj.evad.winEXE@3/4@0/0

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002BA2D5 GetLastError,FormatMessageW,

0_2_002BA2D5

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002A8713 AdjustTokenPrivileges,CloseHandle,		0_2_002A8713
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002A8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_002A8CC3

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002BB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_002BB59E

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002CF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_002CF121

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002BC602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_002BC602

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00254FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00254FE9

Source: C:\Users\user\Desktop\Attendance list.exe

File created: C:\Users\user\AppData\Local\Temp\autE4E0.tmp

Jump to behavior

Source: Attendance list.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Attendance list.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Attendance list.exe	ReversingLabs: Detection: 44%
Source: Attendance list.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\Attendance list.exe "C:\Users\user\Desktop\Attendance list.exe"
Source: C:\Users\user\Desktop\Attendance list.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Attendance list.exe"
Source: C:\Users\user\Desktop\Attendance list.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Attendance list.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: Attendance list.exe

Static file information: File size 1197056 > 1048576

Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Attendance list.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Attendance list.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Attendance list.exe, 00000000.00000003.1650735131.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, Attendance list.exe, 00000000.00000003.1650516808.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1975568723.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1977257906.0000000003500000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Attendance list.exe, 00000000.00000003.1650735131.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, Attendance list.exe, 00000000.00000003.1650516808.0000000004020000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2013318515.000000000389E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2013318515.0000000003700000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1975568723.0000000003300000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1977257906.0000000003500000.00000004.00000020.00020000.00000000.sdmp

Source: Attendance list.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Attendance list.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Attendance list.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Attendance list.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Attendance list.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002CC304 LoadLibraryA,GetProcAddress,

0_2_002CC304

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B8719 push FFFFFF8Bh; iretd	0_2_002B871B
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027E94F push edi; ret	0_2_0027E951
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027EA68 push esi; ret	0_2_0027EA6A
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00278B85 push ecx; ret	0_2_00278B98
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027EC43 push esi; ret	0_2_0027EC45
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027ED2C push edi; ret	0_2_0027ED2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041905C push 72B82297h; ret	1_2_004190E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00408028 pushfd ; retf	1_2_00408034
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00419151 push ecx; iretd	1_2_00419152
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004089B6 push ecx; retf	1_2_004089C2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004162D3 push esi; retf	1_2_004162DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403AB0 push eax; ret	1_2_00403AB2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00407C44 pushfd ; retf	1_2_00407C45
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0041856F push edx; ret	1_2_00418572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040ADF5 push eax; retf	1_2_0040AE11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00405776 pushad ; retf	1_2_00405785
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411F7B push ebx; retf	1_2_00411F7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00418F14 push ecx; ret	1_2_00418F15
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370225F pushad ; ret	1_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037027FA pushad ; ret	1_2_037027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD push ecx; mov dword ptr [esp], ecx	1_2_037309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0370283D push eax; iretd	1_2_03702858

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_00254A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00254A35
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002D55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_002D55FD

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002733C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_002733C7

Source: C:\Users\user\Desktop\Attendance list.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\Attendance list.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Attendance list.exe

API/Special instruction interceptor: Address: 3963224

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0377096E rdtsc

1_2_0377096E

Source: C:\Users\user\Desktop\Attendance list.exe

Evaded block: after key decision

graph_0-99667

Source: C:\Users\user\Desktop\Attendance list.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98369

Source: C:\Users\user\Desktop\Attendance list.exe	API coverage: 4.7 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7456

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_002B4696
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BC93C FindFirstFileW,FindClose,	0_2_002BC93C
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_002BC9C7
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002BF200
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_002BF35D
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_002BF65E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002B3A2B
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002B3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_002B3D4E
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002BBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_002BBF27

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00254AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00254AFE

Source: C:\Users\user\Desktop\Attendance list.exe	API call chain: ExitProcess graph end node			graph_0-96987
Source: C:\Users\user\Desktop\Attendance list.exe	API call chain: ExitProcess graph end node			graph_0-97059

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_0377096E rdtsc

1_2_0377096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417F93 LdrLoadDll,

1_2_00417F93

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002C41FD BlockInput,

0_2_002C41FD

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00253B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00253B4C

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00285CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00285CCC

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002CC304 LoadLibraryA,GetProcAddress,

0_2_002CC304

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_03963490 mov eax, dword ptr fs:[00000030h]	0_2_03963490
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_039634F0 mov eax, dword ptr fs:[00000030h]	0_2_039634F0
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_03961E70 mov eax, dword ptr fs:[00000030h]	0_2_03961E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D437C mov eax, dword ptr fs:[00000030h]	1_2_037D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov ecx, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B035C mov eax, dword ptr fs:[00000030h]	1_2_037B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA352 mov eax, dword ptr fs:[00000030h]	1_2_037FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D8350 mov ecx, dword ptr fs:[00000030h]	1_2_037D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B2349 mov eax, dword ptr fs:[00000030h]	1_2_037B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C310 mov ecx, dword ptr fs:[00000030h]	1_2_0372C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750310 mov ecx, dword ptr fs:[00000030h]	1_2_03750310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]	1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]	1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A30B mov eax, dword ptr fs:[00000030h]	1_2_0376A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E3F0 mov eax, dword ptr fs:[00000030h]	1_2_0374E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037663FF mov eax, dword ptr fs:[00000030h]	1_2_037663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037403E9 mov eax, dword ptr fs:[00000030h]	1_2_037403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03808324 mov eax, dword ptr fs:[00000030h]	1_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03808324 mov ecx, dword ptr fs:[00000030h]	1_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03808324 mov eax, dword ptr fs:[00000030h]	1_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03808324 mov eax, dword ptr fs:[00000030h]	1_2_03808324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]	1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]	1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov ecx, dword ptr fs:[00000030h]	1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE3DB mov eax, dword ptr fs:[00000030h]	1_2_037DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D43D4 mov eax, dword ptr fs:[00000030h]	1_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D43D4 mov eax, dword ptr fs:[00000030h]	1_2_037D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC3CD mov eax, dword ptr fs:[00000030h]	1_2_037EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A3C0 mov eax, dword ptr fs:[00000030h]	1_2_0373A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]	1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]	1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]	1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037383C0 mov eax, dword ptr fs:[00000030h]	1_2_037383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B63C0 mov eax, dword ptr fs:[00000030h]	1_2_037B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380634F mov eax, dword ptr fs:[00000030h]	1_2_0380634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]	1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]	1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728397 mov eax, dword ptr fs:[00000030h]	1_2_03728397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]	1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]	1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E388 mov eax, dword ptr fs:[00000030h]	1_2_0372E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375438F mov eax, dword ptr fs:[00000030h]	1_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375438F mov eax, dword ptr fs:[00000030h]	1_2_0375438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E0274 mov eax, dword ptr fs:[00000030h]	1_2_037E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]	1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]	1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734260 mov eax, dword ptr fs:[00000030h]	1_2_03734260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372826B mov eax, dword ptr fs:[00000030h]	1_2_0372826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A250 mov eax, dword ptr fs:[00000030h]	1_2_0372A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736259 mov eax, dword ptr fs:[00000030h]	1_2_03736259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA250 mov eax, dword ptr fs:[00000030h]	1_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA250 mov eax, dword ptr fs:[00000030h]	1_2_037EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B8243 mov eax, dword ptr fs:[00000030h]	1_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B8243 mov ecx, dword ptr fs:[00000030h]	1_2_037B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372823B mov eax, dword ptr fs:[00000030h]	1_2_0372823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038062D6 mov eax, dword ptr fs:[00000030h]	1_2_038062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]	1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]	1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402E1 mov eax, dword ptr fs:[00000030h]	1_2_037402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A2C3 mov eax, dword ptr fs:[00000030h]	1_2_0373A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402A0 mov eax, dword ptr fs:[00000030h]	1_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037402A0 mov eax, dword ptr fs:[00000030h]	1_2_037402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov ecx, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C62A0 mov eax, dword ptr fs:[00000030h]	1_2_037C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0380625D mov eax, dword ptr fs:[00000030h]	1_2_0380625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E284 mov eax, dword ptr fs:[00000030h]	1_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E284 mov eax, dword ptr fs:[00000030h]	1_2_0376E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]	1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]	1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0283 mov eax, dword ptr fs:[00000030h]	1_2_037B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C156 mov eax, dword ptr fs:[00000030h]	1_2_0372C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C8158 mov eax, dword ptr fs:[00000030h]	1_2_037C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736154 mov eax, dword ptr fs:[00000030h]	1_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736154 mov eax, dword ptr fs:[00000030h]	1_2_03736154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]	1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]	1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov ecx, dword ptr fs:[00000030h]	1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]	1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C4144 mov eax, dword ptr fs:[00000030h]	1_2_037C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760124 mov eax, dword ptr fs:[00000030h]	1_2_03760124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov ecx, dword ptr fs:[00000030h]	1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]	1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]	1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DA118 mov eax, dword ptr fs:[00000030h]	1_2_037DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_038061E5 mov eax, dword ptr fs:[00000030h]	1_2_038061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F0115 mov eax, dword ptr fs:[00000030h]	1_2_037F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov eax, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DE10E mov ecx, dword ptr fs:[00000030h]	1_2_037DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037601F8 mov eax, dword ptr fs:[00000030h]	1_2_037601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE1D0 mov eax, dword ptr fs:[00000030h]	1_2_037AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F61C3 mov eax, dword ptr fs:[00000030h]	1_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F61C3 mov eax, dword ptr fs:[00000030h]	1_2_037F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]	1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]	1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]	1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B019F mov eax, dword ptr fs:[00000030h]	1_2_037B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804164 mov eax, dword ptr fs:[00000030h]	1_2_03804164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804164 mov eax, dword ptr fs:[00000030h]	1_2_03804164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]	1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]	1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A197 mov eax, dword ptr fs:[00000030h]	1_2_0372A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03770185 mov eax, dword ptr fs:[00000030h]	1_2_03770185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC188 mov eax, dword ptr fs:[00000030h]	1_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EC188 mov eax, dword ptr fs:[00000030h]	1_2_037EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4180 mov eax, dword ptr fs:[00000030h]	1_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4180 mov eax, dword ptr fs:[00000030h]	1_2_037D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375C073 mov eax, dword ptr fs:[00000030h]	1_2_0375C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732050 mov eax, dword ptr fs:[00000030h]	1_2_03732050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6050 mov eax, dword ptr fs:[00000030h]	1_2_037B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6030 mov eax, dword ptr fs:[00000030h]	1_2_037C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A020 mov eax, dword ptr fs:[00000030h]	1_2_0372A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C020 mov eax, dword ptr fs:[00000030h]	1_2_0372C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]	1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]	1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]	1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E016 mov eax, dword ptr fs:[00000030h]	1_2_0374E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4000 mov ecx, dword ptr fs:[00000030h]	1_2_037B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D2000 mov eax, dword ptr fs:[00000030h]	1_2_037D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C0F0 mov eax, dword ptr fs:[00000030h]	1_2_0372C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037720F0 mov ecx, dword ptr fs:[00000030h]	1_2_037720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_0372A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037380E9 mov eax, dword ptr fs:[00000030h]	1_2_037380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B60E0 mov eax, dword ptr fs:[00000030h]	1_2_037B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B20DE mov eax, dword ptr fs:[00000030h]	1_2_037B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F60B8 mov eax, dword ptr fs:[00000030h]	1_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F60B8 mov ecx, dword ptr fs:[00000030h]	1_2_037F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037280A0 mov eax, dword ptr fs:[00000030h]	1_2_037280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C80A8 mov eax, dword ptr fs:[00000030h]	1_2_037C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373208A mov eax, dword ptr fs:[00000030h]	1_2_0373208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738770 mov eax, dword ptr fs:[00000030h]	1_2_03738770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740770 mov eax, dword ptr fs:[00000030h]	1_2_03740770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730750 mov eax, dword ptr fs:[00000030h]	1_2_03730750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE75D mov eax, dword ptr fs:[00000030h]	1_2_037BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772750 mov eax, dword ptr fs:[00000030h]	1_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772750 mov eax, dword ptr fs:[00000030h]	1_2_03772750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B4755 mov eax, dword ptr fs:[00000030h]	1_2_037B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov esi, dword ptr fs:[00000030h]	1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov eax, dword ptr fs:[00000030h]	1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376674D mov eax, dword ptr fs:[00000030h]	1_2_0376674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov eax, dword ptr fs:[00000030h]	1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov ecx, dword ptr fs:[00000030h]	1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376273C mov eax, dword ptr fs:[00000030h]	1_2_0376273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AC730 mov eax, dword ptr fs:[00000030h]	1_2_037AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C720 mov eax, dword ptr fs:[00000030h]	1_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C720 mov eax, dword ptr fs:[00000030h]	1_2_0376C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730710 mov eax, dword ptr fs:[00000030h]	1_2_03730710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760710 mov eax, dword ptr fs:[00000030h]	1_2_03760710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C700 mov eax, dword ptr fs:[00000030h]	1_2_0376C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037347FB mov eax, dword ptr fs:[00000030h]	1_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037347FB mov eax, dword ptr fs:[00000030h]	1_2_037347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]	1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]	1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037527ED mov eax, dword ptr fs:[00000030h]	1_2_037527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE7E1 mov eax, dword ptr fs:[00000030h]	1_2_037BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373C7C0 mov eax, dword ptr fs:[00000030h]	1_2_0373C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B07C3 mov eax, dword ptr fs:[00000030h]	1_2_037B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037307AF mov eax, dword ptr fs:[00000030h]	1_2_037307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E47A0 mov eax, dword ptr fs:[00000030h]	1_2_037E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D678E mov eax, dword ptr fs:[00000030h]	1_2_037D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03762674 mov eax, dword ptr fs:[00000030h]	1_2_03762674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F866E mov eax, dword ptr fs:[00000030h]	1_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F866E mov eax, dword ptr fs:[00000030h]	1_2_037F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A660 mov eax, dword ptr fs:[00000030h]	1_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A660 mov eax, dword ptr fs:[00000030h]	1_2_0376A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374C640 mov eax, dword ptr fs:[00000030h]	1_2_0374C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374E627 mov eax, dword ptr fs:[00000030h]	1_2_0374E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03766620 mov eax, dword ptr fs:[00000030h]	1_2_03766620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768620 mov eax, dword ptr fs:[00000030h]	1_2_03768620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373262C mov eax, dword ptr fs:[00000030h]	1_2_0373262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03772619 mov eax, dword ptr fs:[00000030h]	1_2_03772619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE609 mov eax, dword ptr fs:[00000030h]	1_2_037AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0374260B mov eax, dword ptr fs:[00000030h]	1_2_0374260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE6F2 mov eax, dword ptr fs:[00000030h]	1_2_037AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B06F1 mov eax, dword ptr fs:[00000030h]	1_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B06F1 mov eax, dword ptr fs:[00000030h]	1_2_037B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A6C7 mov eax, dword ptr fs:[00000030h]	1_2_0376A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037666B0 mov eax, dword ptr fs:[00000030h]	1_2_037666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C6A6 mov eax, dword ptr fs:[00000030h]	1_2_0376C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734690 mov eax, dword ptr fs:[00000030h]	1_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734690 mov eax, dword ptr fs:[00000030h]	1_2_03734690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]	1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]	1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376656A mov eax, dword ptr fs:[00000030h]	1_2_0376656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738550 mov eax, dword ptr fs:[00000030h]	1_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738550 mov eax, dword ptr fs:[00000030h]	1_2_03738550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740535 mov eax, dword ptr fs:[00000030h]	1_2_03740535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]	1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]	1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]	1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]	1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E53E mov eax, dword ptr fs:[00000030h]	1_2_0375E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6500 mov eax, dword ptr fs:[00000030h]	1_2_037C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804500 mov eax, dword ptr fs:[00000030h]	1_2_03804500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375E5E7 mov eax, dword ptr fs:[00000030h]	1_2_0375E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037325E0 mov eax, dword ptr fs:[00000030h]	1_2_037325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C5ED mov eax, dword ptr fs:[00000030h]	1_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376C5ED mov eax, dword ptr fs:[00000030h]	1_2_0376C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037365D0 mov eax, dword ptr fs:[00000030h]	1_2_037365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A5D0 mov eax, dword ptr fs:[00000030h]	1_2_0376A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E5CF mov eax, dword ptr fs:[00000030h]	1_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E5CF mov eax, dword ptr fs:[00000030h]	1_2_0376E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037545B1 mov eax, dword ptr fs:[00000030h]	1_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037545B1 mov eax, dword ptr fs:[00000030h]	1_2_037545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]	1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]	1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B05A7 mov eax, dword ptr fs:[00000030h]	1_2_037B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E59C mov eax, dword ptr fs:[00000030h]	1_2_0376E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732582 mov eax, dword ptr fs:[00000030h]	1_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03732582 mov ecx, dword ptr fs:[00000030h]	1_2_03732582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764588 mov eax, dword ptr fs:[00000030h]	1_2_03764588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]	1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]	1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375A470 mov eax, dword ptr fs:[00000030h]	1_2_0375A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC460 mov ecx, dword ptr fs:[00000030h]	1_2_037BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA456 mov eax, dword ptr fs:[00000030h]	1_2_037EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372645D mov eax, dword ptr fs:[00000030h]	1_2_0372645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375245A mov eax, dword ptr fs:[00000030h]	1_2_0375245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376E443 mov eax, dword ptr fs:[00000030h]	1_2_0376E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376A430 mov eax, dword ptr fs:[00000030h]	1_2_0376A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]	1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]	1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372E420 mov eax, dword ptr fs:[00000030h]	1_2_0372E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372C427 mov eax, dword ptr fs:[00000030h]	1_2_0372C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B6420 mov eax, dword ptr fs:[00000030h]	1_2_037B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]	1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]	1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768402 mov eax, dword ptr fs:[00000030h]	1_2_03768402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037304E5 mov ecx, dword ptr fs:[00000030h]	1_2_037304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037644B0 mov ecx, dword ptr fs:[00000030h]	1_2_037644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BA4B0 mov eax, dword ptr fs:[00000030h]	1_2_037BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037364AB mov eax, dword ptr fs:[00000030h]	1_2_037364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037EA49A mov eax, dword ptr fs:[00000030h]	1_2_037EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0372CB7E mov eax, dword ptr fs:[00000030h]	1_2_0372CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728B50 mov eax, dword ptr fs:[00000030h]	1_2_03728B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEB50 mov eax, dword ptr fs:[00000030h]	1_2_037DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4B4B mov eax, dword ptr fs:[00000030h]	1_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4B4B mov eax, dword ptr fs:[00000030h]	1_2_037E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6B40 mov eax, dword ptr fs:[00000030h]	1_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6B40 mov eax, dword ptr fs:[00000030h]	1_2_037C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FAB40 mov eax, dword ptr fs:[00000030h]	1_2_037FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D8B42 mov eax, dword ptr fs:[00000030h]	1_2_037D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EB20 mov eax, dword ptr fs:[00000030h]	1_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EB20 mov eax, dword ptr fs:[00000030h]	1_2_0375EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F8B28 mov eax, dword ptr fs:[00000030h]	1_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037F8B28 mov eax, dword ptr fs:[00000030h]	1_2_037F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AEB1D mov eax, dword ptr fs:[00000030h]	1_2_037AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804B00 mov eax, dword ptr fs:[00000030h]	1_2_03804B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]	1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]	1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738BF0 mov eax, dword ptr fs:[00000030h]	1_2_03738BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EBFC mov eax, dword ptr fs:[00000030h]	1_2_0375EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BCBF0 mov eax, dword ptr fs:[00000030h]	1_2_037BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEBD0 mov eax, dword ptr fs:[00000030h]	1_2_037DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]	1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]	1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03750BCB mov eax, dword ptr fs:[00000030h]	1_2_03750BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]	1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]	1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730BCD mov eax, dword ptr fs:[00000030h]	1_2_03730BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740BBE mov eax, dword ptr fs:[00000030h]	1_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740BBE mov eax, dword ptr fs:[00000030h]	1_2_03740BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037E4BB0 mov eax, dword ptr fs:[00000030h]	1_2_037E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03802B57 mov eax, dword ptr fs:[00000030h]	1_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03802B57 mov eax, dword ptr fs:[00000030h]	1_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03802B57 mov eax, dword ptr fs:[00000030h]	1_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03802B57 mov eax, dword ptr fs:[00000030h]	1_2_03802B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804A80 mov eax, dword ptr fs:[00000030h]	1_2_03804A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037ACA72 mov eax, dword ptr fs:[00000030h]	1_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037ACA72 mov eax, dword ptr fs:[00000030h]	1_2_037ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]	1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]	1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA6F mov eax, dword ptr fs:[00000030h]	1_2_0376CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037DEA60 mov eax, dword ptr fs:[00000030h]	1_2_037DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03736A50 mov eax, dword ptr fs:[00000030h]	1_2_03736A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740A5B mov eax, dword ptr fs:[00000030h]	1_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03740A5B mov eax, dword ptr fs:[00000030h]	1_2_03740A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03754A35 mov eax, dword ptr fs:[00000030h]	1_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03754A35 mov eax, dword ptr fs:[00000030h]	1_2_03754A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA38 mov eax, dword ptr fs:[00000030h]	1_2_0376CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376CA24 mov eax, dword ptr fs:[00000030h]	1_2_0376CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0375EA2E mov eax, dword ptr fs:[00000030h]	1_2_0375EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BCA11 mov eax, dword ptr fs:[00000030h]	1_2_037BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376AAEE mov eax, dword ptr fs:[00000030h]	1_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0376AAEE mov eax, dword ptr fs:[00000030h]	1_2_0376AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03730AD0 mov eax, dword ptr fs:[00000030h]	1_2_03730AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764AD0 mov eax, dword ptr fs:[00000030h]	1_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03764AD0 mov eax, dword ptr fs:[00000030h]	1_2_03764AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]	1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]	1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786ACC mov eax, dword ptr fs:[00000030h]	1_2_03786ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738AA0 mov eax, dword ptr fs:[00000030h]	1_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03738AA0 mov eax, dword ptr fs:[00000030h]	1_2_03738AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03786AA4 mov eax, dword ptr fs:[00000030h]	1_2_03786AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03768A90 mov edx, dword ptr fs:[00000030h]	1_2_03768A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373EA80 mov eax, dword ptr fs:[00000030h]	1_2_0373EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4978 mov eax, dword ptr fs:[00000030h]	1_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037D4978 mov eax, dword ptr fs:[00000030h]	1_2_037D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC97C mov eax, dword ptr fs:[00000030h]	1_2_037BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]	1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]	1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03756962 mov eax, dword ptr fs:[00000030h]	1_2_03756962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov eax, dword ptr fs:[00000030h]	1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov edx, dword ptr fs:[00000030h]	1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0377096E mov eax, dword ptr fs:[00000030h]	1_2_0377096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B0946 mov eax, dword ptr fs:[00000030h]	1_2_037B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B892A mov eax, dword ptr fs:[00000030h]	1_2_037B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C892B mov eax, dword ptr fs:[00000030h]	1_2_037C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BC912 mov eax, dword ptr fs:[00000030h]	1_2_037BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728918 mov eax, dword ptr fs:[00000030h]	1_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03728918 mov eax, dword ptr fs:[00000030h]	1_2_03728918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE908 mov eax, dword ptr fs:[00000030h]	1_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037AE908 mov eax, dword ptr fs:[00000030h]	1_2_037AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037629F9 mov eax, dword ptr fs:[00000030h]	1_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037629F9 mov eax, dword ptr fs:[00000030h]	1_2_037629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE9E0 mov eax, dword ptr fs:[00000030h]	1_2_037BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0373A9D0 mov eax, dword ptr fs:[00000030h]	1_2_0373A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037649D0 mov eax, dword ptr fs:[00000030h]	1_2_037649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037FA9D3 mov eax, dword ptr fs:[00000030h]	1_2_037FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C69C0 mov eax, dword ptr fs:[00000030h]	1_2_037C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03804940 mov eax, dword ptr fs:[00000030h]	1_2_03804940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov esi, dword ptr fs:[00000030h]	1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov eax, dword ptr fs:[00000030h]	1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037B89B3 mov eax, dword ptr fs:[00000030h]	1_2_037B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037429A0 mov eax, dword ptr fs:[00000030h]	1_2_037429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD mov eax, dword ptr fs:[00000030h]	1_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037309AD mov eax, dword ptr fs:[00000030h]	1_2_037309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE872 mov eax, dword ptr fs:[00000030h]	1_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037BE872 mov eax, dword ptr fs:[00000030h]	1_2_037BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6870 mov eax, dword ptr fs:[00000030h]	1_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_037C6870 mov eax, dword ptr fs:[00000030h]	1_2_037C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03760854 mov eax, dword ptr fs:[00000030h]	1_2_03760854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734859 mov eax, dword ptr fs:[00000030h]	1_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03734859 mov eax, dword ptr fs:[00000030h]	1_2_03734859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03742840 mov ecx, dword ptr fs:[00000030h]	1_2_03742840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]	1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]	1_2_03752835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03752835 mov eax, dword ptr fs:[00000030h]	1_2_03752835

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002A81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_002A81F7

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027A364 SetUnhandledExceptionFilter,		0_2_0027A364
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_0027A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0027A395

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Attendance list.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Attendance list.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2C25008

Jump to behavior

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002A8C93 LogonUserW,

0_2_002A8C93

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00253B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00253B4C

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00254A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00254A35

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002B4EF5 mouse_event,

0_2_002B4EF5

Source: C:\Users\user\Desktop\Attendance list.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\Attendance list.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Attendance list.exe

0_2_002A81F7

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002B4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_002B4C03

Source: Attendance list.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Attendance list.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_0027886B cpuid

0_2_0027886B

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_002850D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_002850D7

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00292230 GetUserNameW,

0_2_00292230

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_0028418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0028418A

Source: C:\Users\user\Desktop\Attendance list.exe

Code function: 0_2_00254AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00254AFE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Attendance list.exe	Binary or memory string: WIN_81
Source: Attendance list.exe	Binary or memory string: WIN_XP
Source: Attendance list.exe	Binary or memory string: WIN_XPe
Source: Attendance list.exe	Binary or memory string: WIN_VISTA
Source: Attendance list.exe	Binary or memory string: WIN_7
Source: Attendance list.exe	Binary or memory string: WIN_8
Source: Attendance list.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002C6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_002C6596
Source: C:\Users\user\Desktop\Attendance list.exe	Code function: 0_2_002C6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_002C6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	2 Valid Accounts	2 Valid Accounts	2 Valid Accounts	21 Input Capture	2 System Time Discovery	Remote Services	21 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	LSASS Memory	15 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	21 Access Token Manipulation	2 Virtualization/Sandbox Evasion	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	212 Process Injection	21 Access Token Manipulation	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	212 Process Injection	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	115 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Attendance list.exe	45%	ReversingLabs	Win32.Trojan.Autoit
Attendance list.exe	40%	Virustotal		Browse
Attendance list.exe	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465802
Start date and time:	2024-07-02 06:13:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Attendance list.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@3/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 56 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
00:14:28	API Interceptor	3x Sleep call for process: svchost.exe modified

Process:	C:\Users\user\Desktop\Attendance list.exe
File Type:	data
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	7.994758912890692
Encrypted:	true
SSDEEP:	6144:KhuRm8/xU0Q1cv7HzfhKU8EkYERLkm34Z3cPMRVd:KQRmqxJQ1wfhF5ER+bRVd
MD5:	08F7CCD0DD280D2FA4F8C8A3BCB835EC
SHA1:	3CFD34A341C25D5CB9AC1B532C7CEEAD3E32AF2B
SHA-256:	FCBDCDDA495F396408339E1AEFD1B2531D0B66A11ABCD8461B0F5F52147BF790
SHA-512:	62DB62D77D267ED7DFC1A1411CCE0494C2CC6E0BC78F6F1C981652A2769F12CCCBC2838C5C5CE68F5C46CE44A46A1CED414E3B18D678013D008F4B2C91A0415F
Malicious:	false
Reputation:	low
Preview:	~....6OJBo.J...z.3Y...LB...DC9WEKF23ZQXA6OJB7KDC9WEKF23ZQ.A6OD].ED.0.d.G~.{.0(Eo:0X,6"Tw&(\\.q:$.=?,."c}..k+]W?.UL<kJB7KDC9.DB..S=.e!Q.w"P.^..+!.)...}V(.X...Y0../Q[g1?.6OJB7KDCi.EK.32Z$..`OJB7KDC9.EIG92QQX_2OJB7KDC9We_F23JQXA.KJB7.DC)WEKD23\QXA6OJB1KDC9WEKF.7ZQZA6OJB7ID..WE[F2#ZQXA&OJR7KDC9WUKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9y1.>F3ZQ.]2OJR7KD]=WE[F23ZQXA6OJB7KDc9W%KF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KD

C:\Users\user\AppData\Local\Temp\autE51F.tmp

Download File

Process:	C:\Users\user\Desktop\Attendance list.exe
File Type:	data
Category:	dropped
Size (bytes):	9840
Entropy (8bit):	7.599658708143446
Encrypted:	false
SSDEEP:	192:65jwEiq2KWeTY6Vi+7MX9O1JZNO3yLyD416WBAoniCl2e6EMajYxc3EBVHbZr:I6qTRPI9ObSCGD413BAoniG2anEmEXbt
MD5:	DCE9B5B03644E1F050CAA151E1BB4013
SHA1:	DD24ED4B2C5571BBC09B03FF67D5C36F8D310A81
SHA-256:	D7A72B68CACCCFAD5C528525F2045E8F9552A0A42135367148576738D831B57F
SHA-512:	AE11CCF13DE27E37F42D971993DDB983A47223102DFFF8D8EFB7AFB63F00E0959BCA1558110FAD6EB901C83A8087E45D44E46E901BFAC43E57012DD74ACFFF35
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\benting

Download File

Process:	C:\Users\user\Desktop\Attendance list.exe
File Type:	data
Category:	dropped
Size (bytes):	274432
Entropy (8bit):	7.994758912890692
Encrypted:	true
SSDEEP:	6144:KhuRm8/xU0Q1cv7HzfhKU8EkYERLkm34Z3cPMRVd:KQRmqxJQ1wfhF5ER+bRVd
MD5:	08F7CCD0DD280D2FA4F8C8A3BCB835EC
SHA1:	3CFD34A341C25D5CB9AC1B532C7CEEAD3E32AF2B
SHA-256:	FCBDCDDA495F396408339E1AEFD1B2531D0B66A11ABCD8461B0F5F52147BF790
SHA-512:	62DB62D77D267ED7DFC1A1411CCE0494C2CC6E0BC78F6F1C981652A2769F12CCCBC2838C5C5CE68F5C46CE44A46A1CED414E3B18D678013D008F4B2C91A0415F
Malicious:	false
Reputation:	low
Preview:	~....6OJBo.J...z.3Y...LB...DC9WEKF23ZQXA6OJB7KDC9WEKF23ZQ.A6OD].ED.0.d.G~.{.0(Eo:0X,6"Tw&(\\.q:$.=?,."c}..k+]W?.UL<kJB7KDC9.DB..S=.e!Q.w"P.^..+!.)...}V(.X...Y0../Q[g1?.6OJB7KDCi.EK.32Z$..`OJB7KDC9.EIG92QQX_2OJB7KDC9We_F23JQXA.KJB7.DC)WEKD23\QXA6OJB1KDC9WEKF.7ZQZA6OJB7ID..WE[F2#ZQXA&OJR7KDC9WUKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9y1.>F3ZQ.]2OJR7KD]=WE[F23ZQXA6OJB7KDc9W%KF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KDC9WEKF23ZQXA6OJB7KD

C:\Users\user\AppData\Local\Temp\conged

Download File

Process:	C:\Users\user\Desktop\Attendance list.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.589992688693254
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbA+IL26cz24vfF3if6gF:miTZ+2QoioGRk6ZklputwjpjBkCiw2RQ
MD5:	E1561084BAD30A33612A273F6B143A19
SHA1:	842414D322C02E03EE20E8E62AA908A8CA2FC892
SHA-256:	36470D381704EEBA19EFCDA19357A1873D626376F7C5530CFE2E0BE4D0F7D0A7
SHA-512:	122AA8DD43D6DA9E345CB734055E142299AF03580E6D3B0DFAC2562F62D80BC2AC77C2CCFA421047DAAC1F1E0EB5DF33C07413AAF0321B2BBA79F001ED84867D
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.1506622976873135
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Attendance list.exe
File size:	1'197'056 bytes
MD5:	ac274060092bb14f6504d6fd48c20590
SHA1:	9c1c471f9a2fe2523062c8bcd16fbf093ae6a72e
SHA256:	e977838b7536ed73154cbfb37e2204bbc873da89b3c5aeed5bb2d9eff73a07b6
SHA512:	b3bf7b5f6b2e29e7a01c1efc4ddd5326cc4caf74b23225f03c4a0108f8739e0a9f99e00e90b944cd9178730ae8fee5a4e3f45d0889812be802cf01024e491874
SSDEEP:	24576:eAHnh+eWsN3skA4RV1Hom2KXMmHa+3RwsGpjQT/sM5:Jh+ZkldoPK8Ya+BDujQT/D
TLSH:	C845BD0273D1C036FFABA2739B6AF64156BD79250133852F13982DB9BC701B1267E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66833693 [Mon Jul 1 23:06:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FEC9521CD2Dh
jmp 00007FEC9520FAE4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEC9520FC6Ah
cmp edi, eax
jc 00007FEC9520FFCEh
bt dword ptr [004C41FCh], 01h
jnc 00007FEC9520FC69h
rep movsb
jmp 00007FEC9520FF7Ch
cmp ecx, 00000080h
jc 00007FEC9520FE34h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FEC9520FC70h
bt dword ptr [004BF324h], 01h
jc 00007FEC95210140h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FEC9520FE0Dh
test edi, 00000003h
jne 00007FEC9520FE1Eh
test esi, 00000003h
jne 00007FEC9520FDFDh
bt edi, 02h
jnc 00007FEC9520FC6Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FEC9520FC73h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FEC9520FCC5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x59d18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x122000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x59d18	0x59e00	825d539a2c42d9940188ba0542810553	False	0.9269438890820584	data	7.892385272077475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x122000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x50fe0	data			1.0003345953506317
RT_GROUP_ICON	0x121798	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x121810	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x121824	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x121838	0x14	data	English	Great Britain	1.25
RT_VERSION	0x12184c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x121928	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	00:13:53
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\Attendance list.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Attendance list.exe"
Imagebase:	0x250000
File size:	1'197'056 bytes
MD5 hash:	AC274060092BB14F6504D6FD48C20590
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:13:54
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Attendance list.exe"
Imagebase:	0x980000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2013285557.0000000003570000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000001.00000002.2013032455.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	167

Executed Functions

Function 00253B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00253B7A
IsDebuggerPresent.KERNEL32 ref: 00253B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,003162F8,003162E0,?,?), ref: 00253BFD

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Part of subcall function 00260A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00253C26,003162F8,?,?,?), ref: 00260ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00253C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,003093F0,00000010), ref: 0028D4BC
SetCurrentDirectoryW.KERNEL32(?,003162F8,?,?,?), ref: 0028D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00305D40,003162F8,?,?,?), ref: 0028D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0028D581

Part of subcall function 00253A58: GetSysColorBrush.USER32(0000000F), ref: 00253A62
Part of subcall function 00253A58: LoadCursorW.USER32(00000000,00007F00), ref: 00253A71
Part of subcall function 00253A58: LoadIconW.USER32(00000063), ref: 00253A88
Part of subcall function 00253A58: LoadIconW.USER32(000000A4), ref: 00253A9A
Part of subcall function 00253A58: LoadIconW.USER32(000000A2), ref: 00253AAC
Part of subcall function 00253A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00253AD2
Part of subcall function 00253A58: RegisterClassExW.USER32(?), ref: 00253B28

Part of subcall function 002539E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00253A15
Part of subcall function 002539E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00253A36
Part of subcall function 002539E7: ShowWindow.USER32(00000000,?,?), ref: 00253A4A
Part of subcall function 002539E7: ShowWindow.USER32(00000000,?,?), ref: 00253A53

Part of subcall function 002543DB: _memset.LIBCMT ref: 00254401
Part of subcall function 002543DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 002544A6

Strings

%., xrefs: 00253C56
This is a third-party compiled AutoIt script., xrefs: 0028D4B4
runas, xrefs: 0028D575

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%.
API String ID: 529118366-1956105530
Opcode ID: 685ecc2954760e7c925ed54bff4bfed83d2bf7ce11cea28ac55c7553b44144f9
Instruction ID: 59d8eed42459e21dd195f8b074aa155227b825055d47b53e2cd0005dfe8ca2a6
Opcode Fuzzy Hash: 685ecc2954760e7c925ed54bff4bfed83d2bf7ce11cea28ac55c7553b44144f9
Instruction Fuzzy Hash: 2F511D34D25249AACF12EBF4EC16DED7B78AB08341F048466FC51621A1DA744A6ACF28

Function 00254FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00254EEE,?,?,00000000,00000000), ref: 00254FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00254EEE,?,?,00000000,00000000), ref: 00255010
LoadResource.KERNEL32(?,00000000,?,?,00254EEE,?,?,00000000,00000000,?,?,?,?,?,?,00254F8F), ref: 0028DD60
SizeofResource.KERNEL32(?,00000000,?,?,00254EEE,?,?,00000000,00000000,?,?,?,?,?,?,00254F8F), ref: 0028DD75
LockResource.KERNEL32(N%,?,?,00254EEE,?,?,00000000,00000000,?,?,?,?,?,?,00254F8F,00000000), ref: 0028DD88

Strings

N%, xrefs: 0028DD85
SCRIPT, xrefs: 00255006

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N%
API String ID: 3051347437-2837872219
Opcode ID: ec0d60ce87896989614fd0c793e80610dd76dcf6720b07d568448345201feb17
Instruction ID: 43d00c22127ba972c37525bb006742be14ea3030ad31e0567ebb1031df3097a6
Opcode Fuzzy Hash: ec0d60ce87896989614fd0c793e80610dd76dcf6720b07d568448345201feb17
Instruction Fuzzy Hash: 6C119A75600701AFE7208B65EC5CF277BB9EBC9B12F24816DF806C62A0DB71EC148664

Function 00254AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00254B2B

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

GetCurrentProcess.KERNEL32(?,002DFAEC,00000000,00000000,?), ref: 00254BF8
IsWow64Process.KERNEL32(00000000), ref: 00254BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00254C45
FreeLibrary.KERNEL32(00000000), ref: 00254C50
GetSystemInfo.KERNEL32(00000000), ref: 00254C81
GetSystemInfo.KERNEL32(00000000), ref: 00254C8D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: a6e317016744303d4646555074275dbb9f7681fa32032693a19f8affb6254364
Instruction ID: 50d929ba09f6c232c687ded54723795641b7c2fa51d57130333c49e7298bffdb
Opcode Fuzzy Hash: a6e317016744303d4646555074275dbb9f7681fa32032693a19f8affb6254364
Instruction Fuzzy Hash: 8A91243186A7C0DEC731EF6894511AAFFE4AF25305B444A5ED4CB83A81D270E95CCB1D

Function 0025E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dt1, xrefs: 0025EC1A
Variable must be of type 'Object'., xrefs: 0029428C
Dt1, xrefs: 00293F1F
Dt1, xrefs: 00293F58
Dt1, xrefs: 0025EC21

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: Dt1$Dt1$Dt1$Dt1$Variable must be of type 'Object'.
API String ID: 0-2946129658
Opcode ID: 00cb583b380fbba00f747dd22af45bd8fae2910dbdba3e00ee00d8e81fc735ee
Instruction ID: cbf32ec86618798262ec17d5e474bc6d3d11be96d39986b33dddbb457018ecbc
Opcode Fuzzy Hash: 00cb583b380fbba00f747dd22af45bd8fae2910dbdba3e00ee00d8e81fc735ee
Instruction Fuzzy Hash: 92A2AD74A24206CFCF28CF58C580AA9B7B1FF48315F258059ED06AB351D770EE6ACB85

Function 002B4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0028E7C1), ref: 002B46A6
FindFirstFileW.KERNELBASE(?,?), ref: 002B46B7
FindClose.KERNEL32(00000000), ref: 002B46C7

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 9090f8d3c1a809943e93cd1309883bdf7c1269ea82cbe95ea8e1dc61a758ab0e
Instruction ID: 77b6f01f914546fe24a0364bcf27436134300cb61228d0da3d142c5ce3c124b3
Opcode Fuzzy Hash: 9090f8d3c1a809943e93cd1309883bdf7c1269ea82cbe95ea8e1dc61a758ab0e
Instruction Fuzzy Hash: 4DE0D8318214015B82107738FC8D4EA775C9E06375F100716F836C14E0E7B05D608599

Function 00260B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00260BBB
timeGetTime.WINMM ref: 00260E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00260FB3
TranslateMessage.USER32(?), ref: 00260FC7
DispatchMessageW.USER32(?), ref: 00260FD5
Sleep.KERNEL32(0000000A), ref: 00260FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0026105A
DestroyWindow.USER32 ref: 00261066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00261080
Sleep.KERNEL32(0000000A,?,?), ref: 002952AD
TranslateMessage.USER32(?), ref: 0029608A
DispatchMessageW.USER32(?), ref: 00296098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 002960AC

Strings

@TRAY_ID, xrefs: 00295BB9
@GUI_WINHANDLE, xrefs: 002953B9
@GUI_CTRLHANDLE, xrefs: 0029540E
pr1, xrefs: 002953D8
pr1, xrefs: 00295383
@COM_EVENTOBJ, xrefs: 0029591A
@GUI_CTRLID, xrefs: 00295364
pr1, xrefs: 00295BDE
pr1, xrefs: 0029542D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pr1$pr1$pr1$pr1
API String ID: 4003667617-2604743637
Opcode ID: 4d297c5d821cd347cb51c2e54cfb12b2fcdab28ddaa881589efdbdd77f32e8ae
Instruction ID: 935d315aa07d61bd3547b939eb9122b98344e8fb46e36bd75d9843e9d063f73b
Opcode Fuzzy Hash: 4d297c5d821cd347cb51c2e54cfb12b2fcdab28ddaa881589efdbdd77f32e8ae
Instruction Fuzzy Hash: D8B2E670628752DFDB25DF24C884BAAB7E5BF84304F14491DF84A87291DB71E8A4CF86

Function 002B93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002B91E9: __time64.LIBCMT ref: 002B91F3

Part of subcall function 00255045: _fseek.LIBCMT ref: 0025505D

__wsplitpath.LIBCMT ref: 002B94BE

Part of subcall function 0027432E: __wsplitpath_helper.LIBCMT ref: 0027436E

_wcscpy.LIBCMT ref: 002B94D1
_wcscat.LIBCMT ref: 002B94E4
__wsplitpath.LIBCMT ref: 002B9509
_wcscat.LIBCMT ref: 002B951F
_wcscat.LIBCMT ref: 002B9532

Part of subcall function 002B922F: _memmove.LIBCMT ref: 002B9268
Part of subcall function 002B922F: _memmove.LIBCMT ref: 002B9277

_wcscmp.LIBCMT ref: 002B9479

Part of subcall function 002B99BE: _wcscmp.LIBCMT ref: 002B9AAE
Part of subcall function 002B99BE: _wcscmp.LIBCMT ref: 002B9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 002B96DC
_wcsncpy.LIBCMT ref: 002B974F
DeleteFileW.KERNEL32(?,?), ref: 002B9785
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 002B979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 002B97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 002B97BE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 4824819accefc6b4bed8d09c0c824ed00bc762a872da2da2578633fbc8932f82
Instruction ID: 940ed00e7b169b03f3f052c835c5678b3c6d81b34eea819229f0f7c66e2c2fb5
Opcode Fuzzy Hash: 4824819accefc6b4bed8d09c0c824ed00bc762a872da2da2578633fbc8932f82
Instruction Fuzzy Hash: 2EC13CB1D10229AACF21DFA5CC85EDEB7BDEF49340F0040AAF609E7151DB709A948F65

Function 00253015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00253074
RegisterClassExW.USER32(00000030), ref: 0025309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002530AF
InitCommonControlsEx.COMCTL32(?), ref: 002530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002530DC
LoadIconW.USER32(000000A9), ref: 002530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00253101

Strings

TaskbarCreated, xrefs: 002530A4
AutoIt v3 GUI, xrefs: 00253090
+, xrefs: 0025305D
0, xrefs: 00253056

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9c1952d4b01ae093a1c03c177b557e8cb20db96d65491d42bebb811f23671a27
Instruction ID: d7f3ecfaecfd0092b59fcd9773a87752e11ac1460eedf34cd9d9825116caff36
Opcode Fuzzy Hash: 9c1952d4b01ae093a1c03c177b557e8cb20db96d65491d42bebb811f23671a27
Instruction Fuzzy Hash: B53189B1C41309AFDB41CFE4E989BC9BBF4FB09310F14812AE581E62A0D3B50981CF54

Function 00253041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00253074
RegisterClassExW.USER32(00000030), ref: 0025309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002530AF
InitCommonControlsEx.COMCTL32(?), ref: 002530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002530DC
LoadIconW.USER32(000000A9), ref: 002530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00253101

Strings

TaskbarCreated, xrefs: 002530A4
AutoIt v3 GUI, xrefs: 00253090
+, xrefs: 0025305D
0, xrefs: 00253056

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d50465569a358886c021122ea07802f18a09a16e48bd25dc3c371bd5f4309ba5
Instruction ID: dac222f050766737aa6250b799455b7d60a6048df0acc2b2baf6c1d6697996d1
Opcode Fuzzy Hash: d50465569a358886c021122ea07802f18a09a16e48bd25dc3c371bd5f4309ba5
Instruction Fuzzy Hash: 9F21E4B1D11318AFDB41DFE4E949BDDBBF8FB08701F00812AF911A62A0D7B149448F95

Function 002571EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00254864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,003162F8,?,002537C0,?), ref: 00254882

Part of subcall function 0027074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,002572C5), ref: 00270771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00257308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0028ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0028ED32
RegCloseKey.ADVAPI32(?), ref: 0028ED70
_wcscat.LIBCMT ref: 0028EDC9

Strings

Software\AutoIt v3\AutoIt, xrefs: 002572FE
Include, xrefs: 0028ECE8, 0028ED29
\, xrefs: 0028EDEC
\Include\, xrefs: 002572C5

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 8428ffcf6e0aa3e8fd8406c64502625e8d8d4f106cba4f06fa49132183934fd9
Instruction ID: 6ab0edd962c1e5511cb6b0a8bdf6a588051f50a2192883422a11ef07764c1bb8
Opcode Fuzzy Hash: 8428ffcf6e0aa3e8fd8406c64502625e8d8d4f106cba4f06fa49132183934fd9
Instruction Fuzzy Hash: AE717D714693019EC715EF25EC8189BB7FCFF59350F48882EF845832A0EB70996ACB56

Function 00253633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 002536D2
KillTimer.USER32(?,00000001), ref: 002536FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0025371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0025372A
CreatePopupMenu.USER32 ref: 0025373E
PostQuitMessage.USER32(00000000), ref: 0025375F

Strings

TaskbarCreated, xrefs: 00253725
%., xrefs: 0028D2D1, 0028D31F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%.
API String ID: 129472671-2498375929
Opcode ID: fefc568bb5431d7ab8d37169257e36e9d83d6e6079fe556d9b7df0fbf875d1ea
Instruction ID: 0d85753fe65724d0a7ef51e061e21cdc42400f9457d9725beb24ed8cfd12eb7b
Opcode Fuzzy Hash: fefc568bb5431d7ab8d37169257e36e9d83d6e6079fe556d9b7df0fbf875d1ea
Instruction Fuzzy Hash: E2414BB5630106BBDB15EF64EC0ABF9775CE708382F141529FD02822E1CAB09E79976D

Function 00253A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00253A62
LoadCursorW.USER32(00000000,00007F00), ref: 00253A71
LoadIconW.USER32(00000063), ref: 00253A88
LoadIconW.USER32(000000A4), ref: 00253A9A
LoadIconW.USER32(000000A2), ref: 00253AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00253AD2
RegisterClassExW.USER32(?), ref: 00253B28

Part of subcall function 00253041: GetSysColorBrush.USER32(0000000F), ref: 00253074
Part of subcall function 00253041: RegisterClassExW.USER32(00000030), ref: 0025309E
Part of subcall function 00253041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 002530AF
Part of subcall function 00253041: InitCommonControlsEx.COMCTL32(?), ref: 002530CC
Part of subcall function 00253041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 002530DC
Part of subcall function 00253041: LoadIconW.USER32(000000A9), ref: 002530F2
Part of subcall function 00253041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00253101

Strings

0, xrefs: 00253B06
AutoIt v3, xrefs: 00253B17
#, xrefs: 00253B0D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 3a073bb1da58b4502b25ece85f88088302f194128ea41b26506cc37a8ac10a98
Instruction ID: 94e49130ca5f140aa5a2f4a8ec10ffb972f0ecca5391e70dcdfa6ef8ff5c9160
Opcode Fuzzy Hash: 3a073bb1da58b4502b25ece85f88088302f194128ea41b26506cc37a8ac10a98
Instruction Fuzzy Hash: D7213C70D11304AFEB129FA4ED0ABDD7BB8FB0C711F00852AE504A62A0D7B65A55CF48

Function 00253778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 0025380D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 002537C0
b1, xrefs: 0028D44E
/AutoIt3ExecuteLine, xrefs: 002538B9
/AutoIt3OutputDebug, xrefs: 002538A4
/AutoIt3ExecuteScript, xrefs: 002538CE
CMDLINE, xrefs: 00253834
/ErrorStdOut, xrefs: 0025388F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$b1
API String ID: 1825951767-457443653
Opcode ID: 9591a284a41ddd9d65b78eb3eba2e36fdb5475f8b63ddc28ab689bfd8d64d478
Instruction ID: 7b90a382f91946eeedfe8509c1b53edc9b3e2a3c56916d0e55268b8070e987e4
Opcode Fuzzy Hash: 9591a284a41ddd9d65b78eb3eba2e36fdb5475f8b63ddc28ab689bfd8d64d478
Instruction Fuzzy Hash: 8EA14F718202299ACF05EFA0CC969EEB7B8BF14341F44442AF816B7191DB749A6DCF64

Function 0025F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002703A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 002703D3
Part of subcall function 002703A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 002703DB
Part of subcall function 002703A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 002703E6
Part of subcall function 002703A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 002703F1
Part of subcall function 002703A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 002703F9
Part of subcall function 002703A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00270401

Part of subcall function 00266259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0025FA90), ref: 002662B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0025FB2D
OleInitialize.OLE32(00000000), ref: 0025FBAA
CloseHandle.KERNEL32(00000000), ref: 002949F2

Strings

<g1, xrefs: 0025FA90
c1, xrefs: 0025F94B
%., xrefs: 0025F8F6, 0025F908, 0025FACE, 0025FBB1
\d1, xrefs: 0025F957

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <g1$\d1$%.$c1
API String ID: 1986988660-374475462
Opcode ID: b083b7291b89e4ae871f2a7181be7221c6c6b876dcb9040f824f60476f515999
Instruction ID: 29a12e363d892856d151c276b68e5bcc190450c346fdb71fc6779f7fbf378674
Opcode Fuzzy Hash: b083b7291b89e4ae871f2a7181be7221c6c6b876dcb9040f824f60476f515999
Instruction Fuzzy Hash: 7981DAB49112408ED38ADFEAED576D4BAEDEB8C308B11C57E9419C72B2EB314458CF18

Function 039625E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 039626B1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 039628D7

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: 719a891209b8d3c4c8a2652e96dccbd19c2d46a30c9f7a9cf176924a5e23412d
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: 38A12A74E01209EBDB14CFA4C894BEEB7B9FF48304F248999E541BB280D775AA41CF94

Function 002539E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00253A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00253A36
ShowWindow.USER32(00000000,?,?), ref: 00253A4A
ShowWindow.USER32(00000000,?,?), ref: 00253A53

Strings

edit, xrefs: 00253A30
AutoIt v3, xrefs: 00253A0D, 00253A12, 00253A13

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3086a95e3d7eb3443014238f9a57721dc3cd512bda94aa3e639f7ef0b342c342
Instruction ID: 2ca2c35b60160f10e0239c92bb38c580f42cf635441c1d964e0d4937d9baf1b6
Opcode Fuzzy Hash: 3086a95e3d7eb3443014238f9a57721dc3cd512bda94aa3e639f7ef0b342c342
Instruction Fuzzy Hash: 66F03A70A012907EEA3217636C0EEA72E7DD7CAF50F01842AB900A2270C2B50C12CAB4

Function 039623B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 039622A0: Sleep.KERNELBASE(000001F4), ref: 039622B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 039624CB

Strings

3ZQXA6OJB7KDC9WEKF2, xrefs: 0396252E, 03962531

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID: CreateFileSleep
String ID: 3ZQXA6OJB7KDC9WEKF2
API String ID: 2694422964-1262096003
Opcode ID: beb02d66af6a32757d277410fe79211a67d08cfc7b8a7c38dd82ec641aab9745
Instruction ID: d8a7e4606519d2f13d89efc0df21afa026e816c0e07e56ce476d70a4ed5f08d3
Opcode Fuzzy Hash: beb02d66af6a32757d277410fe79211a67d08cfc7b8a7c38dd82ec641aab9745
Instruction Fuzzy Hash: 3C51C130D05299EBEF21DBE4C814BEEBB78AF44300F044599E249BB2C0D7B90B48CB65

Function 0025410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0028D5EC

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

_memset.LIBCMT ref: 0025418D
_wcscpy.LIBCMT ref: 002541E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002541F1

Strings

Line: , xrefs: 0028D615

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: cbd6d336c76b739663b9f1ffeeacd60089e0e5efe8a04648d582ccc198345187
Instruction ID: 3485344f3e8c5d4c842059b86e3eda08f329e1e290712de001b5ad660748bb30
Opcode Fuzzy Hash: cbd6d336c76b739663b9f1ffeeacd60089e0e5efe8a04648d582ccc198345187
Instruction Fuzzy Hash: 1C31F7310283045AD322FB60EC46FDB73ECAF44305F10891AF98992091DB74A6ADCB9B

Function 0027564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 002756AB
_memcpy_s.LIBCMT ref: 0027571D
__read_nolock.LIBCMT ref: 0027577B
__filbuf.LIBCMT ref: 0027579E
_memset.LIBCMT ref: 002757E2

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 4704e9535c69d164ad692ba2fd26497108561b0a70f618968e37d657cfbdd0a3
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: AA518634A20B26DBDB289E69888566EF7A5AF40320F64C729E82D961D0D7F09D718F40

Function 002569CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00254F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,003162F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00254F6F

_free.LIBCMT ref: 0028E68C
_free.LIBCMT ref: 0028E6D3

Part of subcall function 00256BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00256D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0028E462
Bad directive syntax error, xrefs: 0028E6BB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: e6c814a266b62aa98441b00ad0374c922946c091a8900c56f7ddbbb74f2cb9b3
Instruction ID: bb84983cd8a140514129f1faee31215403d846042dbf6e55898627e37262b4aa
Opcode Fuzzy Hash: e6c814a266b62aa98441b00ad0374c922946c091a8900c56f7ddbbb74f2cb9b3
Instruction Fuzzy Hash: BE917F75930229DFCF04EFA4C8919EDB7B8BF15314F14442AF815AB291EB749928CF54

Function 002535B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,002535A1,SwapMouseButtons,00000004,?), ref: 002535D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,002535A1,SwapMouseButtons,00000004,?,?,?,?,00252754), ref: 002535F5
RegCloseKey.KERNELBASE(00000000,?,?,002535A1,SwapMouseButtons,00000004,?,?,?,?,00252754), ref: 00253617

Strings

Control Panel\Mouse, xrefs: 002535D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 20d02c0009e48378c3b0d77738316feddcfc5f0ae7e8a3b24f1677bb022afdd0
Instruction ID: 31cec260d37ed567aef6a01631f15da5a0f4ab2ab1e5251848f3776cd14cb6f2
Opcode Fuzzy Hash: 20d02c0009e48378c3b0d77738316feddcfc5f0ae7e8a3b24f1677bb022afdd0
Instruction Fuzzy Hash: 45115A71921209BFDB20CF64EC44EAEB7BCEF04781F00946AF805D7210D2719F649768

Function 039612A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03961A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03961AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03961B13

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 5fe9e54f045f664e1d0346ce9919bf39b31262b63adf11ed3b5b390b2397d043
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: F0621C30A15258DBEB24CFA4C850BDEB376EF58300F1095A9D10DEB3A4E7799E81CB59

Function 002B97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00255045: _fseek.LIBCMT ref: 0025505D

Part of subcall function 002B99BE: _wcscmp.LIBCMT ref: 002B9AAE
Part of subcall function 002B99BE: _wcscmp.LIBCMT ref: 002B9AC1

_free.LIBCMT ref: 002B992C
_free.LIBCMT ref: 002B9933
_free.LIBCMT ref: 002B999E

Part of subcall function 00272F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00279C64), ref: 00272FA9
Part of subcall function 00272F95: GetLastError.KERNEL32(00000000,?,00279C64), ref: 00272FBB

_free.LIBCMT ref: 002B99A6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 7f9c199c9fabec108272d0d144bffbae187047e09721a23e44783598c8c381a3
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 785160B1914628AFDF249F64CC41ADEBBB9EF48300F0044AEF649A7281DB715E94CF59

Function 0027493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002749D0
__flush.LIBCMT ref: 002749F0
__write.LIBCMT ref: 00274A23
__flsbuf.LIBCMT ref: 00274A51

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: c3529ee5dc4b76c270797b771abd925f1b8f3b9e99b7afd20f97e188737a4428
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: E341E531660607DBDF28AE69C89196F77A9EF80360B24C16DE95D87640D770DD608B44

Function 00254DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00254E1A

Strings

EA06, xrefs: 0028DCF5
AU3!P/., xrefs: 00254E14

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/.$EA06
API String ID: 4104443479-1743673582
Opcode ID: 96ee2576c9b6f645c8f135b5ce8e136fdfe68581f9532f896b31e25ea8a34497
Instruction ID: 3225dcc73824a5825242bc4dd689dcce7774b731994d0af299c918d33d106296
Opcode Fuzzy Hash: 96ee2576c9b6f645c8f135b5ce8e136fdfe68581f9532f896b31e25ea8a34497
Instruction Fuzzy Hash: F5418E32A341646BCF117F6488637BEFFA1AB0530AF584065EC429A182C5719DEC87E5

Function 002573E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0028EE62
GetOpenFileNameW.COMDLG32(?), ref: 0028EEAC

Part of subcall function 002548AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002548A1,?,?,002537C0,?), ref: 002548CE

Part of subcall function 002709D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002709F4

Strings

X, xrefs: 0028EE7A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: b8652a5bac7ba2cef65ea20dfa06d96e950352f6ae77d478926593983e976f6f
Instruction ID: ea413ef448030ab2ac5047d53e29b908c1de578a3c56b4248c9e8759c24fe9b1
Opcode Fuzzy Hash: b8652a5bac7ba2cef65ea20dfa06d96e950352f6ae77d478926593983e976f6f
Instruction Fuzzy Hash: 2221C6709212589BCF01DF94D8457EE7BFC9F49315F00801AE808E7281DBB4599D8F95

Function 002B901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002B9036
__fread_nolock.LIBCMT ref: 002B904B

Strings

EA06, xrefs: 002B907D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 3a72650d7ab04f31b265e0e1c1f2698c280570da539c86c5cd9a6c61a54c4cf8
Instruction ID: 44966f5a93b31538df0699578cc9ddabb7623e2e317fd5ffe4f44404974a1189
Opcode Fuzzy Hash: 3a72650d7ab04f31b265e0e1c1f2698c280570da539c86c5cd9a6c61a54c4cf8
Instruction Fuzzy Hash: 6201F971814218AFDB28CAA8C856FEEBBF89B01301F00859EF556D2181E5B5A6148B60

Function 002B9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 002B9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 002B9B99

Strings

aut, xrefs: 002B9B93

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 091cce91700174d8981bc1202437de790333ae22e9a5ad3d427901987d5abfc7
Instruction ID: c5d6fe9f5f05749694257cc4b9086db73a3c5ac0788ac112ccf7112026ce0059
Opcode Fuzzy Hash: 091cce91700174d8981bc1202437de790333ae22e9a5ad3d427901987d5abfc7
Instruction Fuzzy Hash: C5D05E7994130DABDB509B90EC0EFEA772CE704700F0042A2BE55911A1DEB059988B95

Function 002CCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3d74bf4a41de24a59667f5b64fa21e10c87acd0f41d5bb4fa2ae9c5240276d
Instruction ID: 0d4af923a3515e87eeb9cfea6117e9a4bf226a15288ca19844aadc81567d05e7
Opcode Fuzzy Hash: 8d3d74bf4a41de24a59667f5b64fa21e10c87acd0f41d5bb4fa2ae9c5240276d
Instruction Fuzzy Hash: CCF13A719183019FCB14DF28C484A6ABBE5FF88314F14892EF89A9B352D771E955CF82

Function 002543DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00254401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 002544A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 002544C3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: a061067e175f1cc662be32f2c53b814c63eeddedec7828d799810d9b33d56b68
Instruction ID: 55ffd512fb0ce0cc9af1824d641d252de2efaae2bd2254ab0169686dd62554c3
Opcode Fuzzy Hash: a061067e175f1cc662be32f2c53b814c63eeddedec7828d799810d9b33d56b68
Instruction Fuzzy Hash: FE3193705157018FD721EF64E88579BFBF8FB48309F00492EF99A83241D7B16998CB56

Function 0027594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00275963

Part of subcall function 0027A3AB: __NMSG_WRITE.LIBCMT ref: 0027A3D2
Part of subcall function 0027A3AB: __NMSG_WRITE.LIBCMT ref: 0027A3DC

__NMSG_WRITE.LIBCMT ref: 0027596A

Part of subcall function 0027A408: GetModuleFileNameW.KERNEL32(00000000,003143BA,00000104,?,00000001,00000000), ref: 0027A49A
Part of subcall function 0027A408: ___crtMessageBoxW.LIBCMT ref: 0027A548

Part of subcall function 002732DF: ___crtCorExitProcess.LIBCMT ref: 002732E5
Part of subcall function 002732DF: ExitProcess.KERNEL32 ref: 002732EE

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

RtlAllocateHeap.NTDLL(01000000,00000000,00000001,00000000,?,?,?,00271013,?), ref: 0027598F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 6f00322d93364478a58aff3bb43c4007d0d3a468c45e8a7ccbbee956246edb3f
Instruction ID: 2a1d62d6b2ced265589ab8a772da79f80e47f2e2da2a0d7afd30a02a07098f9a
Opcode Fuzzy Hash: 6f00322d93364478a58aff3bb43c4007d0d3a468c45e8a7ccbbee956246edb3f
Instruction Fuzzy Hash: 7701D231371B26DEE6216B35EC42A6EB2888F41770F10C02AF60D9B1C1DEF09D218AA4

Function 002B9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,002B97D2,?,?,?,?,?,00000004), ref: 002B9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,002B97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 002B9B5B
CloseHandle.KERNEL32(00000000,?,002B97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 002B9B62

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 2790719ba6c59ba4e18e7ea8d3e19e69d6b7c76a02bdce0bf6f96d517e6fc632
Instruction ID: 340137ee2cd930f586de80fb6b105c700cadfbad85ab2cc7fa83cbbd274254ff
Opcode Fuzzy Hash: 2790719ba6c59ba4e18e7ea8d3e19e69d6b7c76a02bdce0bf6f96d517e6fc632
Instruction Fuzzy Hash: 07E08632581224B7D7611F54FC0DFCA7B18AB05765F114121FB15690E087B16A21979C

Function 002B8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 002B8FA5

Part of subcall function 00272F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00279C64), ref: 00272FA9
Part of subcall function 00272F95: GetLastError.KERNEL32(00000000,?,00279C64), ref: 00272FBB

_free.LIBCMT ref: 002B8FB6
_free.LIBCMT ref: 002B8FC8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: d6891382f5af99b8b7aea906dec61b20f56fcce9ee5a2fc98b8bdedf88e0bb5b
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 4CE012A16297028ACA24A978AD40AE357FE5F48390758081DF55DEB942DE34E865C924

Function 0025AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0029002B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: a96c3e7ef824998e1b886b4ae53126050c8649d43731a0ca3ba7c3b50a15db41
Instruction ID: eb12c4fbca46d4f18f7c8e61f9400226579fee1cfab0a2a8e24647ef2d60b0d7
Opcode Fuzzy Hash: a96c3e7ef824998e1b886b4ae53126050c8649d43731a0ca3ba7c3b50a15db41
Instruction Fuzzy Hash: D9224970528201CFCB25DF14C495B6ABBF1BF48305F14895DE88A8B362D771EDA9CB86

Function 0025492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00254992

Part of subcall function 002735AC: __lock.LIBCMT ref: 002735B2
Part of subcall function 002735AC: DecodePointer.KERNEL32(00000001,?,002549A7,002A81BC), ref: 002735BE
Part of subcall function 002735AC: EncodePointer.KERNEL32(?,?,002549A7,002A81BC), ref: 002735C9

Part of subcall function 00254A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00254A73
Part of subcall function 00254A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00254A88

Part of subcall function 00253B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00253B7A
Part of subcall function 00253B4C: IsDebuggerPresent.KERNEL32 ref: 00253B8C
Part of subcall function 00253B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,003162F8,003162E0,?,?), ref: 00253BFD
Part of subcall function 00253B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00253C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 002549D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: c5015905dd28e5d1733b1883e0e02573de0d627e8c3e5ee7cd070a7e87cb3d0e
Instruction ID: a420caf86db6d19fa99fa7e71e8ce09c2b464c81833378186b91ad9fcc82ffe5
Opcode Fuzzy Hash: c5015905dd28e5d1733b1883e0e02573de0d627e8c3e5ee7cd070a7e87cb3d0e
Instruction Fuzzy Hash: E41190719243119BC701EF69EC0694AFFF8EB99710F00891EF44583271DB709969CF9A

Function 00255DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00255981,?,?,?,?), ref: 00255E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00255981,?,?,?,?), ref: 0028E19C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8699348c5a8800b503fb7d95d0650126aca2a54c18f613d1c0be61d49fd44573
Instruction ID: f25f0a3e8eaf381c0f7c56db7d6ff3caf4c4b7ce6985c3b29939bd26592d3530
Opcode Fuzzy Hash: 8699348c5a8800b503fb7d95d0650126aca2a54c18f613d1c0be61d49fd44573
Instruction Fuzzy Hash: 2301F570260319BEF7240E24CC8BF623B9CEB01769F108319BEE95A1E0C6B05E598B18

Function 00270FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0027594C: __FF_MSGBANNER.LIBCMT ref: 00275963
Part of subcall function 0027594C: __NMSG_WRITE.LIBCMT ref: 0027596A
Part of subcall function 0027594C: RtlAllocateHeap.NTDLL(01000000,00000000,00000001,00000000,?,?,?,00271013,?), ref: 0027598F

std::exception::exception.LIBCMT ref: 0027102C
__CxxThrowException@8.LIBCMT ref: 00271041

Part of subcall function 002787DB: RaiseException.KERNEL32(?,?,?,0030BAF8,00000000,?,?,?,?,00271046,?,0030BAF8,?,00000001), ref: 00278830

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 40817dd6fc2d9f9fb1c96200231bffceee029053407b4c60fd4e178bda9f8cdc
Instruction ID: 52bb930d66b9873c829b0e242bc378a4121481168888fc17782b18302bc0763a
Opcode Fuzzy Hash: 40817dd6fc2d9f9fb1c96200231bffceee029053407b4c60fd4e178bda9f8cdc
Instruction Fuzzy Hash: 19F02D3456025DE6CB20BE59DC059DFB7AC9F00350F508015FD0DA5581EFF08AB496E0

Function 0027582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0027585C
__lock_file.LIBCMT ref: 0027587D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: fe6717009c5a1397361f3c4b7a1d81c6c2815dedd98e4baa7af39a486693c794
Instruction ID: c524f8a35d43c2369b64021d9618551105b082ca9770fbb9edd537b28eb0873f
Opcode Fuzzy Hash: fe6717009c5a1397361f3c4b7a1d81c6c2815dedd98e4baa7af39a486693c794
Instruction Fuzzy Hash: DE01AC71C50616EBCF12AFA58C0599FBB61BF40360F14C215F81C5B1A1DB718671DF92

Function 002755D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

__lock_file.LIBCMT ref: 0027561B

Part of subcall function 00276E4E: __lock.LIBCMT ref: 00276E71

__fclose_nolock.LIBCMT ref: 00275626

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: ae8fa6a6307733f08eeafc73725d9b03d190923cb4f6d30ad62c4f1676914f4f
Instruction ID: 4ed15289dfd12e7c4254b930dd7113c1e13fcda5506205ccd505ba02e17c81e7
Opcode Fuzzy Hash: ae8fa6a6307733f08eeafc73725d9b03d190923cb4f6d30ad62c4f1676914f4f
Instruction Fuzzy Hash: 13F0F031920A259AD720AF34880AB6EB6A46F01334F54C209E41CAB0C1CFFC8A218F51

Function 0396129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03961A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03961AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03961B13

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: e6d3a7b8fad23d9431d5f34146d3802767ef14b6c2c9304d2369b6d4980d6eb1
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: B812DD24E24658C6EB24DF64D8507DEB232EF68340F1094E9910DEB7A4E77A4F81CF5A

Function 00262123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde91d0ccc852fca08faefac1c7bb7d768e604a2a6493fb497412820c85c51cc
Instruction ID: 172233f57c4428f9a2f972a7ef1426efdbc66dd72ac0b2c958fa15f13dcae86a
Opcode Fuzzy Hash: fde91d0ccc852fca08faefac1c7bb7d768e604a2a6493fb497412820c85c51cc
Instruction Fuzzy Hash: 15519035620614EFCF14EF54C9A5E6D77E5AF45310F1480A8F90AAB392CB30ED68CB55

Function 00255C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00255CF6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e815150de78a2f38bcd817dc83cc05d9ba122d62579d390d1a37f5c67057f9f6
Instruction ID: 132a26c2e276d78f0772ca3cf1d8c1b91f80a24e48680f0d8e04bef7653e34f5
Opcode Fuzzy Hash: e815150de78a2f38bcd817dc83cc05d9ba122d62579d390d1a37f5c67057f9f6
Instruction Fuzzy Hash: 06317C31A20B2AABCB08DF69C49465DB7B1FF48312F14862AEC1993710D770AD64CB94

Function 002900D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 002900E1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 87a9e634221024ea84750492796837a6da429ac5bd2235b50ea9a90437a45bb3
Instruction ID: 8d4117bbdd20794febf6d7babd98c769ed9ec305b25c6bd3b807c3850691d26e
Opcode Fuzzy Hash: 87a9e634221024ea84750492796837a6da429ac5bd2235b50ea9a90437a45bb3
Instruction Fuzzy Hash: 8E411574528351CFDB25DF14C485B1ABBE0BF45319F1989ACE8894B362C332E8A9CF56

Function 002579AB Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002579F9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction ID: 0b2734b5001ed1721e417a0db9e3c0ead5ae6a5efec357b2c642998a12665ff8
Opcode Fuzzy Hash: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction Fuzzy Hash: 7211D631269205AFD714DF28D481C7EB7A9EF45324724851AFD19DB290DB32EC298BD4

Function 00254F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00254D13: FreeLibrary.KERNEL32(00000000,?), ref: 00254D4D

Part of subcall function 0027548B: __wfsopen.LIBCMT ref: 00275496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,003162F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00254F6F

Part of subcall function 00254CC8: FreeLibrary.KERNEL32(00000000), ref: 00254D02

Part of subcall function 00254DD0: _memmove.LIBCMT ref: 00254E1A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: a7d976f9c95e0aa3b529a4f8e0d0a3823e6af3538592913065f077eec0a89118
Instruction ID: f5fd3fc2a7cef319f582616119344fb997a7dc89616db25905bb7ee782f47124
Opcode Fuzzy Hash: a7d976f9c95e0aa3b529a4f8e0d0a3823e6af3538592913065f077eec0a89118
Instruction Fuzzy Hash: F5112732620205ABCB14FF74CC12BAEB3A49F44706F10842AFD42A61D1DA719E689F64

Function 002901AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002901BB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 472faebafb05665f4bc7d7b36e7ab421b88ab7455ef40c28404d624be15ed872
Instruction ID: 4bf0e12d3bc36d265582c368a840bdeff6dbf1061b5aaaae084f5a535922cc43
Opcode Fuzzy Hash: 472faebafb05665f4bc7d7b36e7ab421b88ab7455ef40c28404d624be15ed872
Instruction Fuzzy Hash: B8212474528351CFCB14DF54C486B1ABBE0BF88304F048968E98A57721D731E869CF56

Function 00255D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00255807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00255D76

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0af660f69d76c12c96fff4cd3e35ae3f2b7d66ef12747578b67db858bc7cc6fd
Instruction ID: dfb5e0270dc56fcf21f4998ba161db11c39252b11b0a0bae4ae3764f22dc3f80
Opcode Fuzzy Hash: 0af660f69d76c12c96fff4cd3e35ae3f2b7d66ef12747578b67db858bc7cc6fd
Instruction Fuzzy Hash: C4116A32211B019FD3308F05C498B62B7F8EF44711F10C92EE8AA86A50D7B1E958CF64

Function 00274A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00274AD6

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: c9b417848030b7895b60a0d5ecee00162042aae1709192936d87344d20272af4
Instruction ID: d4c1556753a152f7ef34410491540ebeb8c0017998c2f72b2151c572eaa6ee25
Opcode Fuzzy Hash: c9b417848030b7895b60a0d5ecee00162042aae1709192936d87344d20272af4
Instruction Fuzzy Hash: 3EF0AF319A120AEBDF61BF748C0A79E76A1AF00329F04C514F42CAA1D1CB788A70DF51

Function 00254FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,003162F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00254FDE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 0b031d228b42d6d142b7b1f6d4681b7d43ad6a0926cbc779d14c0739d734c4a4
Instruction ID: 8d7642c9dbf47118efe5425cb8bd27d9acd2ed4db940083dd8e787b608685dda
Opcode Fuzzy Hash: 0b031d228b42d6d142b7b1f6d4681b7d43ad6a0926cbc779d14c0739d734c4a4
Instruction Fuzzy Hash: 59F03071525712CFC734AF68E494812FBE1BF0432A3208A3EE9DB82A10C77198A8DF54

Function 002709D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002709F4

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 4212307c855c711274544f1c640ff0ce68f55e3d6ce0cbdecfd644fc267a6b12
Instruction ID: cf6218e692e8685c8db2e22311af2965bb6ab4d6be07ff37f21b8a4fedb75c17
Opcode Fuzzy Hash: 4212307c855c711274544f1c640ff0ce68f55e3d6ce0cbdecfd644fc267a6b12
Instruction Fuzzy Hash: 63E0CD36D4522C57C720E658AC09FFA77EDDF88791F0401B6FC0CD7248E9709C918A94

Function 002B9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 002B914B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 230ffc75b2b22f34aa48cfa0f9f69f2394e5e73203f0d63bf8cc60681fb22294
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 46E092B0124B019FDB348E28D8107E373E0AB06315F00081DF29A83342EB6378919B59

Function 00255DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0028E16B,?,?,00000000), ref: 00255DBF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cb545517628dab97f44014f65b13ede567ff628e21ff309c4222e5c26ba1001e
Instruction ID: f238e8d0115b5e0a5f40148145118efdaca9b7819e8e9e401a35d7385e8fde70
Opcode Fuzzy Hash: cb545517628dab97f44014f65b13ede567ff628e21ff309c4222e5c26ba1001e
Instruction Fuzzy Hash: 84D0C77564020CBFE710DB80DC46FA9777CD705710F100195FD0456290D6B27D508795

Function 0027548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00275496

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: d636dcaa9a2545f698226f4ea514482b92241b73bb873e05ddaa0239f5330103
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: AAB0927684020C77DE012E92EC02A597B199B40678F808020FB0C18162A6B3A6B0AA89

Function 002BD2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 002BD46A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7f53c93129b94ba67af92e3e83002962104cc635ddc698900074c367f937213e
Instruction ID: bb56458de19ac1817830de69baacf6864abe597afb33f4f7fdb0067dd2da48d6
Opcode Fuzzy Hash: 7f53c93129b94ba67af92e3e83002962104cc635ddc698900074c367f937213e
Instruction Fuzzy Hash: DA717334624302CFC714EF24D491AAAB7E4AF88355F04496DF8968B3A2DB30ED59CF56

Function 00270E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00270EF7

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: d3c8d695638a2084ab5fb2a1900bf36ef1d10a35266949a773dba4e5a9489507
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 1831C170A20106DBC718DE58C4C0969F7A6FB59300B64CAA5E409CB651DB71EDE5CB80

Function 039622A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 039622B1

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 71ba045d96cefe08a01161bea0d426da72cbe89cab1dc6df8c6eb339d1db0629
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: BBE0E67494110EDFDB00EFB8D54969E7FB4EF04701F1005A1FD01D2280D6309D508A72

Non-executed Functions

Function 002DCDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 002DCE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002DCE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 002DCED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002DCF00
SendMessageW.USER32 ref: 002DCF29
_wcsncpy.LIBCMT ref: 002DCFA1
GetKeyState.USER32(00000011), ref: 002DCFC2
GetKeyState.USER32(00000009), ref: 002DCFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002DCFE5
GetKeyState.USER32(00000010), ref: 002DCFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 002DD018
SendMessageW.USER32 ref: 002DD03F
SendMessageW.USER32(?,00001030,?,002DB602), ref: 002DD145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 002DD15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 002DD16E
SetCapture.USER32(?), ref: 002DD177
ClientToScreen.USER32(?,?), ref: 002DD1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 002DD1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002DD203
ReleaseCapture.USER32 ref: 002DD20E
GetCursorPos.USER32(?), ref: 002DD248
ScreenToClient.USER32(?,?), ref: 002DD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 002DD2B1
SendMessageW.USER32 ref: 002DD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 002DD31C
SendMessageW.USER32 ref: 002DD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 002DD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 002DD37B
GetCursorPos.USER32(?), ref: 002DD39B
ScreenToClient.USER32(?,?), ref: 002DD3A8
GetParent.USER32(?), ref: 002DD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 002DD431
SendMessageW.USER32 ref: 002DD462
ClientToScreen.USER32(?,?), ref: 002DD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 002DD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 002DD51A
SendMessageW.USER32 ref: 002DD53D
ClientToScreen.USER32(?,?), ref: 002DD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 002DD5C3

Part of subcall function 002525DB: GetWindowLongW.USER32(?,000000EB), ref: 002525EC

GetWindowLongW.USER32(?,000000F0), ref: 002DD65F

Strings

pr1, xrefs: 002DD1BD
@GUI_DRAGID, xrefs: 002DD1AA
F, xrefs: 002DD543

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pr1
API String ID: 3977979337-427288994
Opcode ID: 3477d4a997cf3e6777fe32c372013c553cbfc53d4a6d99a46edca39559be4923
Instruction ID: beaa1aa17ff84220dc7027b98c3c973cc80c844886a7cb2656439e218a70e918
Opcode Fuzzy Hash: 3477d4a997cf3e6777fe32c372013c553cbfc53d4a6d99a46edca39559be4923
Instruction Fuzzy Hash: 41429C70519242AFC725CF68D848AAABBE9FF48314F24451EF656873A0C731DC64CF92

Function 002D804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 002D873F

Strings

%d/%02d/%02d, xrefs: 002D8478

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 8ed5c7ca96340c23669ce7966ac05e7a248dfb1249e014ccf9ab95a8eea1a448
Instruction ID: 27842e00674c81df5bedef5f07398a1829a1e732fb19cf61bafaa6837d89fb3b
Opcode Fuzzy Hash: 8ed5c7ca96340c23669ce7966ac05e7a248dfb1249e014ccf9ab95a8eea1a448
Instruction Fuzzy Hash: 0112F371921245ABEB258F28DC49FAE7BB8EF45310F20416AF916DA2E0DF709D51CF50

Function 0026710E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002675C2
_memset.LIBCMT ref: 002676B1
_memmove.LIBCMT ref: 00267C4B
_memmove.LIBCMT ref: 00267E4F

Strings

[:>:]], xrefs: 0026760A
Q\E, xrefs: 002681C1
0w0, xrefs: 002A1F5B
Oa&, xrefs: 002A287E
\b(?=\w), xrefs: 002A3C34
[:<:]], xrefs: 002675F1
\b(?<=\w), xrefs: 002A3C41
DEFINE, xrefs: 002A25AF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0w0$DEFINE$Oa&$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-2339167416
Opcode ID: f6de47ed5f63ea0f80736e1613be1a8379b8e53b4830d6abd9681b5fc01c79b2
Instruction ID: 678c59247b9a6dcb74713e14679f284645f3b76d0cfe30091bfeb04009b1cd93
Opcode Fuzzy Hash: f6de47ed5f63ea0f80736e1613be1a8379b8e53b4830d6abd9681b5fc01c79b2
Instruction Fuzzy Hash: D793A371E20216DFDB24CF58D8817ADB7B1FF49714F24816AE945EB280EBB09E91CB50

Function 00254A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00254A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0028DA8E
IsIconic.USER32(?), ref: 0028DA97
ShowWindow.USER32(?,00000009), ref: 0028DAA4
SetForegroundWindow.USER32(?), ref: 0028DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0028DAC4
GetCurrentThreadId.KERNEL32 ref: 0028DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0028DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0028DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0028DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0028DAF8
SetForegroundWindow.USER32(?), ref: 0028DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0028DB10
keybd_event.USER32(00000012,00000000), ref: 0028DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0028DB25
keybd_event.USER32(00000012,00000000), ref: 0028DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0028DB33
keybd_event.USER32(00000012,00000000), ref: 0028DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0028DB42
keybd_event.USER32(00000012,00000000), ref: 0028DB47
SetForegroundWindow.USER32(?), ref: 0028DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0028DB71

Strings

Shell_TrayWnd, xrefs: 0028DA89

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 42c6e06d8947184dec322d2979118277cd74e1ee19ab594bd5ece65ad2a6085a
Instruction ID: efdce47a8ccc10a3d85cd626a3e61f78afea90d12d712b030a20628a551b6408
Opcode Fuzzy Hash: 42c6e06d8947184dec322d2979118277cd74e1ee19ab594bd5ece65ad2a6085a
Instruction Fuzzy Hash: 0631B375E91318BBEB206F61AD49F7E3F6CEB44B50F104066FA01E61D1C6B05D10ABA4

Function 002A8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 002A8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002A8D0D
Part of subcall function 002A8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002A8D3A
Part of subcall function 002A8CC3: GetLastError.KERNEL32 ref: 002A8D47

_memset.LIBCMT ref: 002A889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 002A88ED
CloseHandle.KERNEL32(?), ref: 002A88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002A8915
GetProcessWindowStation.USER32 ref: 002A892E
SetProcessWindowStation.USER32(00000000), ref: 002A8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 002A8952

Part of subcall function 002A8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002A8851), ref: 002A8728
Part of subcall function 002A8713: CloseHandle.KERNEL32(?,?,002A8851), ref: 002A873A

Strings

default, xrefs: 002A894D
winsta0, xrefs: 002A8910
, xrefs: 002A88AA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 1d06943c894ec4230e4c0eebe675e64ec52e26a9af0ca192edb87aba58f2de22
Instruction ID: 957b460e0304ba4633f58817e4cd6c5ab7cc4181d2c3da3b18a8745010653227
Opcode Fuzzy Hash: 1d06943c894ec4230e4c0eebe675e64ec52e26a9af0ca192edb87aba58f2de22
Instruction Fuzzy Hash: F5815E71D1120AAFDF11DFA4DD49AEEBB78EF05304F08416AF915A6161DF318E24DB60

Function 002C425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(002DF910), ref: 002C4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 002C4292
GetClipboardData.USER32(0000000D), ref: 002C429A
CloseClipboard.USER32 ref: 002C42A6
GlobalLock.KERNEL32(00000000), ref: 002C42C2
CloseClipboard.USER32 ref: 002C42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 002C42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 002C42EE
GetClipboardData.USER32(00000001), ref: 002C42F6
GlobalLock.KERNEL32(00000000), ref: 002C4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 002C4337
CloseClipboard.USER32 ref: 002C4447

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: e800cabbba4ec79d97f37797c1de310d8380f6fbdbf3839f8339863211828ae4
Instruction ID: 2d809eb0ae6d67a148baff834220b1f9b66b559880a20d9c36cd44bf2ef82927
Opcode Fuzzy Hash: e800cabbba4ec79d97f37797c1de310d8380f6fbdbf3839f8339863211828ae4
Instruction Fuzzy Hash: DA519031614302ABD311FF60ED9AF6F77A8AF84B01F10462EF956D21A1DB70DD148B6A

Function 002BC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002BC9F8
FindClose.KERNEL32(00000000), ref: 002BCA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 002BCA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 002BCA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 002BCAAF
__swprintf.LIBCMT ref: 002BCAFB
__swprintf.LIBCMT ref: 002BCB3E

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

__swprintf.LIBCMT ref: 002BCB92

Part of subcall function 002738D8: __woutput_l.LIBCMT ref: 00273931

__swprintf.LIBCMT ref: 002BCBE0

Part of subcall function 002738D8: __flsbuf.LIBCMT ref: 00273953
Part of subcall function 002738D8: __flsbuf.LIBCMT ref: 0027396B

__swprintf.LIBCMT ref: 002BCC2F
__swprintf.LIBCMT ref: 002BCC7E
__swprintf.LIBCMT ref: 002BCCCD

Strings

%02d, xrefs: 002BCB86, 002BCB90, 002BCBDE, 002BCC2D, 002BCC7C, 002BCCCB
%4d, xrefs: 002BCB38
%4d%02d%02d%02d%02d%02d, xrefs: 002BCAF5

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 43f9d29545a258d012557fa70f54a415ef127e8c8c185d08c43e4c93b4586099
Instruction ID: 55c0c1c0d98a23030d6c16b583fe3dc095a039adafc9f00083866654603afc37
Opcode Fuzzy Hash: 43f9d29545a258d012557fa70f54a415ef127e8c8c185d08c43e4c93b4586099
Instruction Fuzzy Hash: DBA13EB1428305ABC700EF64D995DAFB7ECFF98701F404929B986C3191EB34DA58CB66

Function 002BF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 002BF221
_wcscmp.LIBCMT ref: 002BF236
_wcscmp.LIBCMT ref: 002BF24D
GetFileAttributesW.KERNEL32(?), ref: 002BF25F
SetFileAttributesW.KERNEL32(?,?), ref: 002BF279
FindNextFileW.KERNEL32(00000000,?), ref: 002BF291
FindClose.KERNEL32(00000000), ref: 002BF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 002BF2B8
_wcscmp.LIBCMT ref: 002BF2DF
_wcscmp.LIBCMT ref: 002BF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 002BF308
SetCurrentDirectoryW.KERNEL32(0030A5A0), ref: 002BF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 002BF330
FindClose.KERNEL32(00000000), ref: 002BF33D
FindClose.KERNEL32(00000000), ref: 002BF34F

Strings

*.*, xrefs: 002BF2B3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: aa4233322d4255a521576d8198fd9459d9cef51ec3f142355394e3582323fc4c
Instruction ID: 4b1aeb34790adddb45aa909c11cd234c34f9daf1a32c91e17f242503dcd6e202
Opcode Fuzzy Hash: aa4233322d4255a521576d8198fd9459d9cef51ec3f142355394e3582323fc4c
Instruction Fuzzy Hash: F631263691124A6ADB90DFB4ED5DAEEB3ECAF093A0F1441B6E845D3090EB30DE50CA54

Function 002D0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002D0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,002DF910,00000000,?,00000000,?,?), ref: 002D0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 002D0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 002D0D1D
RegCloseKey.ADVAPI32(?), ref: 002D103D
RegCloseKey.ADVAPI32(00000000), ref: 002D104A

Strings

REG_EXPAND_SZ, xrefs: 002D0CBA
REG_SZ, xrefs: 002D0D5B
REG_BINARY, xrefs: 002D0FD8
REG_DWORD, xrefs: 002D0F0E
REG_QWORD, xrefs: 002D0F8B
REG_MULTI_SZ, xrefs: 002D0E05

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 71f960699c0923c44cabb6cbb84fe86f4705e5dd7fe3aefb8d0d29c81d726ccc
Instruction ID: 6e51b271afec77b3ad22a13f73b5e692834062a7d7eafb51f50fd5e88210ccc7
Opcode Fuzzy Hash: 71f960699c0923c44cabb6cbb84fe86f4705e5dd7fe3aefb8d0d29c81d726ccc
Instruction Fuzzy Hash: F5025B752246119FCB14EF24C895A2AB7E5EF88714F04885DF88A9B762CB30ED64CF85

Function 002BF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 002BF37E
_wcscmp.LIBCMT ref: 002BF393
_wcscmp.LIBCMT ref: 002BF3AA

Part of subcall function 002B45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 002B45DC

FindNextFileW.KERNEL32(00000000,?), ref: 002BF3D9
FindClose.KERNEL32(00000000), ref: 002BF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 002BF400
_wcscmp.LIBCMT ref: 002BF427
_wcscmp.LIBCMT ref: 002BF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 002BF450
SetCurrentDirectoryW.KERNEL32(0030A5A0), ref: 002BF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 002BF478
FindClose.KERNEL32(00000000), ref: 002BF485
FindClose.KERNEL32(00000000), ref: 002BF497

Strings

*.*, xrefs: 002BF3FB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: c94724e791c7e0e76ecb456b601d85c7f369da101e5532c851c5713fe82ac303
Instruction ID: 0f2ca40455aa648fce58ded33f6cb99bb3d22c27b39314132c4c16295b22958c
Opcode Fuzzy Hash: c94724e791c7e0e76ecb456b601d85c7f369da101e5532c851c5713fe82ac303
Instruction Fuzzy Hash: 6F31183251125A6FCB50DF64ED88AEE77BC9F093A0F1042B6E944E30E0E770DE64CA64

Function 00266843 Relevance: 22.1, Strings: 17, Instructions: 883COMMON

Download Yara Rule

Strings

BSR_ANYCRLF), xrefs: 002A1757
NO_START_OPT), xrefs: 002A1588
ANYCRLF), xrefs: 002A1734
UTF16), xrefs: 002A1508
UTF), xrefs: 002A1533
Oa&, xrefs: 002A1888, 002A192F, 002A19DD
CRLF), xrefs: 002A16FA
UCP), xrefs: 002A1546
NO_AUTO_POSSESS), xrefs: 002A1567
LF), xrefs: 002A16DD
LIMIT_MATCH=, xrefs: 002A15A9
rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr, xrefs: 002A170E, 002A17E1
BSR_UNICODE), xrefs: 002A1771
ANY), xrefs: 002A1717
CR), xrefs: 002A16C0
PJ/, xrefs: 002668B3
LIMIT_RECURSION=, xrefs: 002A1635

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa&$PJ/$UCP)$UTF)$UTF16)$rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
API String ID: 0-3443878948
Opcode ID: 178b538b4af80d8a7ae5f0323b94486dd8e25e0c4010c17c5e4448771c6efc76
Instruction ID: 3a2208e93db283506052b7c83ca2057e00c2e82c063cebbbf8f875043f35c5f8
Opcode Fuzzy Hash: 178b538b4af80d8a7ae5f0323b94486dd8e25e0c4010c17c5e4448771c6efc76
Instruction Fuzzy Hash: 17728275E2021ADBDF14CF58C8847AEB7B5FF49720F14816AE845EB280DB709DA1CB90

Function 002A81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002A8766
Part of subcall function 002A874A: GetLastError.KERNEL32(?,002A822A,?,?,?), ref: 002A8770
Part of subcall function 002A874A: GetProcessHeap.KERNEL32(00000008,?,?,002A822A,?,?,?), ref: 002A877F
Part of subcall function 002A874A: HeapAlloc.KERNEL32(00000000,?,002A822A,?,?,?), ref: 002A8786
Part of subcall function 002A874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002A879D

Part of subcall function 002A87E7: GetProcessHeap.KERNEL32(00000008,002A8240,00000000,00000000,?,002A8240,?), ref: 002A87F3
Part of subcall function 002A87E7: HeapAlloc.KERNEL32(00000000,?,002A8240,?), ref: 002A87FA
Part of subcall function 002A87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,002A8240,?), ref: 002A880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 002A825B
_memset.LIBCMT ref: 002A8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 002A828F
GetLengthSid.ADVAPI32(?), ref: 002A82A0
GetAce.ADVAPI32(?,00000000,?), ref: 002A82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002A82F9
GetLengthSid.ADVAPI32(?), ref: 002A8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 002A8325
HeapAlloc.KERNEL32(00000000), ref: 002A832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 002A834D
CopySid.ADVAPI32(00000000), ref: 002A8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 002A8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002A83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 002A83BF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: f181dbe1741f478031f879d9bc1bfa52ebf475ac1f2599b2c94e0f32bcd82bfa
Instruction ID: aedbd344ee4976cdec722c63469109ce5960afdb5f5552b4f9962f2f923d3d63
Opcode Fuzzy Hash: f181dbe1741f478031f879d9bc1bfa52ebf475ac1f2599b2c94e0f32bcd82bfa
Instruction Fuzzy Hash: 48615B7191020AEBDF00DFA5DD48AAEBBB9FF05700F14816AE916A7291DF319A15CF60

Function 002D0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002D10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002D0038,?,?), ref: 002D10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002D0737

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 002D07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 002D086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 002D0AAD
RegCloseKey.ADVAPI32(00000000), ref: 002D0ABA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: c7e792b9b3b3319dff4c26299f3bf8a2727156d518a53b80249b32cd745763f0
Instruction ID: 39ab3dae8a8754e50ab850d2f31afd28ea954eb0c242366079fc99f78a49f32e
Opcode Fuzzy Hash: c7e792b9b3b3319dff4c26299f3bf8a2727156d518a53b80249b32cd745763f0
Instruction Fuzzy Hash: 85E15B31614211AFCB14DF24D994E6ABBE4EF89714F04846EF84ADB3A2DA30ED54CF51

Function 002B0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 002B0241
GetAsyncKeyState.USER32(000000A0), ref: 002B02C2
GetKeyState.USER32(000000A0), ref: 002B02DD
GetAsyncKeyState.USER32(000000A1), ref: 002B02F7
GetKeyState.USER32(000000A1), ref: 002B030C
GetAsyncKeyState.USER32(00000011), ref: 002B0324
GetKeyState.USER32(00000011), ref: 002B0336
GetAsyncKeyState.USER32(00000012), ref: 002B034E
GetKeyState.USER32(00000012), ref: 002B0360
GetAsyncKeyState.USER32(0000005B), ref: 002B0378
GetKeyState.USER32(0000005B), ref: 002B038A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4457c185a992f815fea27225879726b37316c9ff487bf2578cd8c445998ed2e2
Instruction ID: 70931a6f86f7e7a16b1cbc158f5eced5ac47850b7ac75238b3fe1ba312fb41ca
Opcode Fuzzy Hash: 4457c185a992f815fea27225879726b37316c9ff487bf2578cd8c445998ed2e2
Instruction Fuzzy Hash: 7141A7249247CB6EFF724E64948C3EBBAE0AF11380F4840DED9C6461C2DB945DE88792

Function 00264140 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1132COMMON

Download Yara Rule

Strings

ERCP, xrefs: 0026421F
VUUU, xrefs: 00297B0C
VUUU, xrefs: 002644DB
rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr, xrefs: 00297A61
VUUU, xrefs: 00264520
Oa&, xrefs: 00264984, 00298173
VUUU, xrefs: 002644ED

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: ERCP$Oa&$VUUU$VUUU$VUUU$VUUU$rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
API String ID: 0-859897010
Opcode ID: 0a6b1026b563255bb039267ba81325e0b8844dc100b57de8a080c46307a648da
Instruction ID: a6af00a88ca4fa2e8e191c076716a21b64bd88ab8b46a1a0b3f5200e0e215245
Opcode Fuzzy Hash: 0a6b1026b563255bb039267ba81325e0b8844dc100b57de8a080c46307a648da
Instruction Fuzzy Hash: D9A2A170E2421ACBDF24DF58C9907ADB7B1BF55314F2481AAD89AA7280D7709EE1CF50

Function 002C4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 002C447F
EmptyClipboard.USER32 ref: 002C4485
GlobalAlloc.KERNEL32(00000002,?), ref: 002C449A
CloseClipboard.USER32 ref: 002C4539

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 7fdffa0053181a9f095d40e2ffa37452f9e74580f7470284350f9c7d444d04f6
Instruction ID: 620f1e16de52f0b9948515d54b925d4aec52ae62d2d29c2d23562bcd37cd47cb
Opcode Fuzzy Hash: 7fdffa0053181a9f095d40e2ffa37452f9e74580f7470284350f9c7d444d04f6
Instruction Fuzzy Hash: 6421D1356112119FDB10AF60ED1DF6A7BA8EF14311F14802AF807DB2A1DB70ED10CB98

Function 002B3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002548AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002548A1,?,?,002537C0,?), ref: 002548CE

Part of subcall function 002B4CD3: GetFileAttributesW.KERNEL32(?,002B3947), ref: 002B4CD4

FindFirstFileW.KERNEL32(?,?), ref: 002B3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 002B3B87
MoveFileW.KERNEL32(?,?), ref: 002B3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 002B3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 002B3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 002B3BF5

Strings

\*.*, xrefs: 002B3A8A, 002B3A93, 002B3AA8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 145d77200c814ec72e6e32c4d006ab361a757f20e41c7ec40cc42f9f5533b5b0
Instruction ID: 56a76ab3e3f181f7dfeeba7175184d9ae8a635ee036ad2a3e611140080b7495e
Opcode Fuzzy Hash: 145d77200c814ec72e6e32c4d006ab361a757f20e41c7ec40cc42f9f5533b5b0
Instruction Fuzzy Hash: 045190318112499ACF05EBA0DE929EDB7B8AF14345F6441AAE84277191EF306F1DCFA4

Function 002BF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 002BF6AB
Sleep.KERNEL32(0000000A), ref: 002BF6DB
_wcscmp.LIBCMT ref: 002BF6EF
_wcscmp.LIBCMT ref: 002BF70A
FindNextFileW.KERNEL32(?,?), ref: 002BF7A8
FindClose.KERNEL32(00000000), ref: 002BF7BE

Strings

*.*, xrefs: 002BF690

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 8b6aebff715b2eb691b1608ef3660d53bff2b9f975a079a2627c8a5bffc1a73b
Instruction ID: 9324b9f50b11caf68e2196039f51018248822a2068e6c9ca43b379212e9d3a5b
Opcode Fuzzy Hash: 8b6aebff715b2eb691b1608ef3660d53bff2b9f975a079a2627c8a5bffc1a73b
Instruction Fuzzy Hash: 7E41A27182020AAFCF51DF64CD49AEEBBB4FF05350F1445A6EC15A2191EB309E64DF90

Function 002658C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00265A05
_memmove.LIBCMT ref: 00265A55
_memmove.LIBCMT ref: 00265ABB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b95a5dbf669be0fd9eccd7c04214d12808f7829a2e3314afefeb23e6415262cf
Instruction ID: 87b04e98f939807e20733a9c6e2c25efbc918f812e01c3d43a7118a69486230f
Opcode Fuzzy Hash: b95a5dbf669be0fd9eccd7c04214d12808f7829a2e3314afefeb23e6415262cf
Instruction Fuzzy Hash: F212AB70A20A1ADFDF14CFA4D981AAEB3F5FF48300F108529E806E7251EB35AD65CB54

Function 00265680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00270FF6: std::exception::exception.LIBCMT ref: 0027102C
Part of subcall function 00270FF6: __CxxThrowException@8.LIBCMT ref: 00271041

_memmove.LIBCMT ref: 002A062F
_memmove.LIBCMT ref: 002A0744
_memmove.LIBCMT ref: 002A07EB

Strings

yZ&, xrefs: 002A0881, 002A07FF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ&
API String ID: 1300846289-909687534
Opcode ID: 95d4b2d324896af53b6526992fdb2d1d1b0e938b9efde7edd926c4f7bf46aac1
Instruction ID: 3ae362635fa00d53e5fb327dc0c9290e23a7e74d6286c7059ab33c04b20401e8
Opcode Fuzzy Hash: 95d4b2d324896af53b6526992fdb2d1d1b0e938b9efde7edd926c4f7bf46aac1
Instruction Fuzzy Hash: C002AF70E20205DBDF04DF68D992AAEBBB5FF45300F148069E80ADB255EB31DA64CF95

Function 002B545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002A8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002A8D0D
Part of subcall function 002A8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002A8D3A
Part of subcall function 002A8CC3: GetLastError.KERNEL32 ref: 002A8D47

ExitWindowsEx.USER32(?,00000000), ref: 002B549B

Strings

@, xrefs: 002B548E
SeShutdownPrivilege, xrefs: 002B546B
, xrefs: 002B5489

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 44d4d9f2bf2d140a1ec731f19ebdc5060a197b9a1efcbdadf1113bad64f883c8
Instruction ID: 4e720cc20419788b450fd2ac6aba69785c2766f3ed836688c8778fbe7cd3fad8
Opcode Fuzzy Hash: 44d4d9f2bf2d140a1ec731f19ebdc5060a197b9a1efcbdadf1113bad64f883c8
Instruction Fuzzy Hash: 5201FC31675B366BE7686E74EC4ABF67378EB053D3F240521FD07DA0D2DA901CA045A4

Function 00263190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa&, xrefs: 00263482

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa&
API String ID: 674341424-711773428
Opcode ID: e4de16db341f2ea7ee4c9d9f166ab99e2b15e1663dea6cb362681d1bd3af5224
Instruction ID: 81a5ef6757ee7ac7a5ba04c46a42c2ec4b2a472f9c4cf0bb8015aee40378609e
Opcode Fuzzy Hash: e4de16db341f2ea7ee4c9d9f166ab99e2b15e1663dea6cb362681d1bd3af5224
Instruction Fuzzy Hash: 12228E715283019FCB24DF24C891B6FB7E4AF84704F14491DF89A97291DB71EAA8CB92

Function 002C6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 002C65EF
WSAGetLastError.WSOCK32(00000000), ref: 002C65FE
bind.WSOCK32(00000000,?,00000010), ref: 002C661A
listen.WSOCK32(00000000,00000005), ref: 002C6629
WSAGetLastError.WSOCK32(00000000), ref: 002C6643
closesocket.WSOCK32(00000000,00000000), ref: 002C6657

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 0e02717c8522e0d9becb22ac998a6599a744cc6695cd065cb95889b7e1bc6fb6
Instruction ID: befc8705444eaa8326af9a6f13499fb30ed44a88d458f3314892ac186ab8929f
Opcode Fuzzy Hash: 0e02717c8522e0d9becb22ac998a6599a744cc6695cd065cb95889b7e1bc6fb6
Instruction Fuzzy Hash: 3C21CC306102009FDB00EF24D989F6EB7A9EF48321F24826AE917E72D1CB70AD549B55

Function 00251287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

DefDlgProcW.USER32(?,?,?,?,?), ref: 002519FA
GetSysColor.USER32(0000000F), ref: 00251A4E
SetBkColor.GDI32(?,00000000), ref: 00251A61

Part of subcall function 00251290: DefDlgProcW.USER32(?,00000020,?), ref: 002512D8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e4040d4aceded65145035e6a1d7868bbd266680aa1a6a08777f6072ad86450f7
Instruction ID: 4b1717136a1fe58b8d7b55d13ff0da56a2fed27701cc78dedf407a37a393267c
Opcode Fuzzy Hash: e4040d4aceded65145035e6a1d7868bbd266680aa1a6a08777f6072ad86450f7
Instruction Fuzzy Hash: 63A14678136486BAD62BAE285C49FBF255CDB4A347F24011EFC02D21D2CA708D39D779

Function 002C6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002C80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 002C80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 002C6AB1
WSAGetLastError.WSOCK32(00000000), ref: 002C6ADA
bind.WSOCK32(00000000,?,00000010), ref: 002C6B13
WSAGetLastError.WSOCK32(00000000), ref: 002C6B20
closesocket.WSOCK32(00000000,00000000), ref: 002C6B34

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 6136b7c235d8da57260a3054bb5adba3465df25d8191b47a2c5e76396ba167b9
Instruction ID: 53e5103d00d63732b9b0d1a859babb4c3c1d0c9916040b6e0d20f62047404833
Opcode Fuzzy Hash: 6136b7c235d8da57260a3054bb5adba3465df25d8191b47a2c5e76396ba167b9
Instruction Fuzzy Hash: 1D41E275B20210AFEB10AF24DC8AF6E77A9DB08710F04815DFD0AAB3C2CB709D148B95

Function 002D55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 002D564C
IsWindowEnabled.USER32 ref: 002D565A
GetForegroundWindow.USER32(?,?,00000001), ref: 002D5667
IsIconic.USER32 ref: 002D5675
IsZoomed.USER32 ref: 002D5683

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 8f8aa5ac4167e4edb78b298bcfa97e0d454674da1155e3a439f92a8ebde29913
Instruction ID: 89eb66d73c87f21f6c8448b886b220f69428f59177621d034adf28a4be839c72
Opcode Fuzzy Hash: 8f8aa5ac4167e4edb78b298bcfa97e0d454674da1155e3a439f92a8ebde29913
Instruction Fuzzy Hash: 9A11B2317219216FE7211F26EC48A2FBB9CEF84721B84402AE806D7341CBB0DD118EE8

Function 002BC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002BC69D
CoCreateInstance.OLE32(002E2D6C,00000000,00000001,002E2BDC,?), ref: 002BC6B5

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

CoUninitialize.OLE32 ref: 002BC922

Strings

.lnk, xrefs: 002BC631, 002BC659, 002BC663

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 55b5963476aebd75ab5ca1ffe0222d2fee0624073a95c2638f4ffab76bc8c749
Instruction ID: 96bb24a9fd45d7a31c8ba4cb78cc32ef1a554b254eea02f0544ec98d981bdfad
Opcode Fuzzy Hash: 55b5963476aebd75ab5ca1ffe0222d2fee0624073a95c2638f4ffab76bc8c749
Instruction Fuzzy Hash: 98A16D71124201AFD700EF64C891EABB7ECFF85305F00496CF556972A2DB70EA59CB66

Function 002CC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00291D88,?), ref: 002CC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 002CC324

Strings

GetSystemWow64DirectoryW, xrefs: 002CC31E
kernel32.dll, xrefs: 002CC30D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 9c8ec002cf79e20ce273acd2cfab2a414adbccf507fbd6bb2e365b45235ff6ba
Instruction ID: 5becace87a8b302bb3d9da442f353ba1a7a0b85310334625b67bbbb6cea2d93c
Opcode Fuzzy Hash: 9c8ec002cf79e20ce273acd2cfab2a414adbccf507fbd6bb2e365b45235ff6ba
Instruction Fuzzy Hash: 92E08C74621343CFCB214F29E808F86B6D4EB0C305B9084BEE89EC3250E770D8A1CB60

Function 002CF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 002CF151
Process32FirstW.KERNEL32(00000000,?), ref: 002CF15F

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Process32NextW.KERNEL32(00000000,?), ref: 002CF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 002CF22E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 33acb54429455ca89bf9d12c8be3aa78ef04ca4b21f8e53e8740cea3c0db8dec
Instruction ID: a32075b5cbd996382d55cae5d516c0418e94105ab1eae99034c19f892fcbf302
Opcode Fuzzy Hash: 33acb54429455ca89bf9d12c8be3aa78ef04ca4b21f8e53e8740cea3c0db8dec
Instruction Fuzzy Hash: 26517C71514311AFD310EF24DC86E6BBBE8EF88710F14492DF89697291EB70E918CB96

Function 002AEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 002AEB19

Strings

(, xrefs: 002AEB5F
|, xrefs: 002AEB49

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 6586a0553cea9c6e98972ec1883d03723904f4693f7c63eeb918f45b918d0cf3
Instruction ID: 4168d206ec4faa136d3f8c3d266ba1b6101aec62451475f17064fcbe56025554
Opcode Fuzzy Hash: 6586a0553cea9c6e98972ec1883d03723904f4693f7c63eeb918f45b918d0cf3
Instruction Fuzzy Hash: C5323675A107059FDB28CF19C481A6AB7F1FF48320B12C46EE49ACB7A1DB70E952CB50

Function 002C25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 002C26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 002C270C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 20a72e3c5c19d87094cc80998d2850e553640c65f90a3f3f8dc6833e27c0e730
Instruction ID: 41fbd8ff3cd03874d7c350b6acc231cf3f2f943a2f8efa2063271aabada2c4b4
Opcode Fuzzy Hash: 20a72e3c5c19d87094cc80998d2850e553640c65f90a3f3f8dc6833e27c0e730
Instruction Fuzzy Hash: ED41D57192020AFFEB20DE54DCC5FBBB7BCEB40714F20416EF605A6140DEB19D699A64

Function 002BB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002BB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 002BB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 002BB655

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 19c1a7b51d0b76391012efcad083697498aa45e1e8630bddd173e51c9b63b975
Instruction ID: 0138c29dbb932f5958cdfe0e5f927efd4b52b7f6410438352d301df8c36a1b34
Opcode Fuzzy Hash: 19c1a7b51d0b76391012efcad083697498aa45e1e8630bddd173e51c9b63b975
Instruction Fuzzy Hash: C1216035A10218EFCB00EF65D884AEDBBB8FF48311F1480AAE806AB351DB319D55CF55

Function 002A8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00270FF6: std::exception::exception.LIBCMT ref: 0027102C
Part of subcall function 00270FF6: __CxxThrowException@8.LIBCMT ref: 00271041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 002A8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 002A8D3A
GetLastError.KERNEL32 ref: 002A8D47

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 3e194bca4bf5100f2bfcfd284e7350c42a50523dc8c8d5ab4548275e7104baac
Instruction ID: f03e1760b5b32a40e9239ed7bf2629a7bbfafa8331e8424a05182f6a3f625ed0
Opcode Fuzzy Hash: 3e194bca4bf5100f2bfcfd284e7350c42a50523dc8c8d5ab4548275e7104baac
Instruction Fuzzy Hash: AD11BFB1824209AFD7289F64EC89D6BB7FCEB05710B20852EF44683241EF30BC508A20

Function 002B4021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 002B404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 002B4088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 002B4091

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: aee1c5781db0ceda884f179739652d481d21862397ea58f46c3463f50002e3ac
Instruction ID: c113cfeb434d9c34d2dfb3a8403773e47d20a0d737859e7ee11386dab7f98b7b
Opcode Fuzzy Hash: aee1c5781db0ceda884f179739652d481d21862397ea58f46c3463f50002e3ac
Instruction Fuzzy Hash: E71182B1D15229BEE710ABECDC48FEFBBBCEB08750F004656BA15E7191C2B45E1487A1

Function 002B4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 002B4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 002B4C43
FreeSid.ADVAPI32(?), ref: 002B4C53

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 57614fe386a768636e77bda44c71c57c7af39e1575a08513ff256cd561da8781
Instruction ID: 77a37d7d2fc4501f5ed0c1d594b92e286ec7bf5b51b225a1099fa047be120c0a
Opcode Fuzzy Hash: 57614fe386a768636e77bda44c71c57c7af39e1575a08513ff256cd561da8781
Instruction Fuzzy Hash: 28F04F75D1130DBFDF04DFF0DD89AADBBBCEF08201F404469A502E3282D6705A048B54

Function 002B8B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 002B8B25

Part of subcall function 0027543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,002B91F8,00000000,?,?,?,?,002B93A9,00000000,?), ref: 00275443
Part of subcall function 0027543A: __aulldiv.LIBCMT ref: 00275463

Strings

0u1, xrefs: 002B8B1C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0u1
API String ID: 2893107130-3636244747
Opcode ID: 09ee00bd989a8d60c430b362df88f56ad75fb9bc06798cf9fc729d7796f3a279
Instruction ID: 8a0f46a8e2a30b542c9056c47bd2b5caf9f7df6c9580f96fda1ef69bd1d8e922
Opcode Fuzzy Hash: 09ee00bd989a8d60c430b362df88f56ad75fb9bc06798cf9fc729d7796f3a279
Instruction Fuzzy Hash: 5521B472635511CBC72ACF35D441A92B3E5EBA9311F28CE6CD0E9CB2D0CA74B945CB94

Function 0025E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461abf27490add402840fafd9f4e6852f13d97a86a20e2b1f25adab49b41f4f7
Instruction ID: 1c3597b3583141b6372fee88b4c3b668d6974e60f1fe6353c4a7b4e84bcfcd8f
Opcode Fuzzy Hash: 461abf27490add402840fafd9f4e6852f13d97a86a20e2b1f25adab49b41f4f7
Instruction Fuzzy Hash: 47228D70920216DFDF28DF54C480ABEB7B0FF04301F158469EC5A9B341E774AAA9CB95

Function 002BC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 002BC966
FindClose.KERNEL32(00000000), ref: 002BC996

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: d9bbb25b84bc8dcb73082a5a08137e8227aa7e966d8705a089a0c233ab7a46e5
Instruction ID: 261c9bfbba173d6f940a82b2cc2852b761a62b333094162b8f97ab124f588e8a
Opcode Fuzzy Hash: d9bbb25b84bc8dcb73082a5a08137e8227aa7e966d8705a089a0c233ab7a46e5
Instruction Fuzzy Hash: 5D11A5316106009FDB10DF29D84992AF7E5FF44321F14851EF8A6D7291DB70AC14CF95

Function 002BA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,002C977D,?,002DFB84,?), ref: 002BA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,002C977D,?,002DFB84,?), ref: 002BA314

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 383af283d2f79255cac917a40bd9fc376f342946ee3bcdd5fcc29a99dbb382a4
Instruction ID: 6ca1355efcfb76d1fbd31e9176594fe539c7e4c20fb89d15c338cfd02d7ba0dd
Opcode Fuzzy Hash: 383af283d2f79255cac917a40bd9fc376f342946ee3bcdd5fcc29a99dbb382a4
Instruction Fuzzy Hash: 3DF0E23596522DABDB20AFA4DC49FEA736DBF08361F0041A6B809D2180D6309910CBA1

Function 002A8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,002A8851), ref: 002A8728
CloseHandle.KERNEL32(?,?,002A8851), ref: 002A873A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: feffaf198117f492f5d386c770adad6e49891d7b29f16eb2047c296efe443799
Instruction ID: d4f243b0d556138bd2d7a80c5964de89074c8a1cebdfc81eada4f251c62bc245
Opcode Fuzzy Hash: feffaf198117f492f5d386c770adad6e49891d7b29f16eb2047c296efe443799
Instruction Fuzzy Hash: 42E04636020610EFE7612B24FD08D73BBE9EF00350724C82AF89A80430CB32ACA0DB10

Function 0027A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00278F97,?,?,?,00000001), ref: 0027A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0027A3A3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 632a21d1779542346ac6fef68a0c88734ba6e5b3ac3630f622a34311d953dc12
Instruction ID: 9ff05b1e8d1e85512cb73e41824b74a20cfe9277360aed6246e3edda3dc73465
Opcode Fuzzy Hash: 632a21d1779542346ac6fef68a0c88734ba6e5b3ac3630f622a34311d953dc12
Instruction Fuzzy Hash: 99B09231455248ABCAC02B95FD0DB883F68EB44AA2F4180A2FE0E84060CB6258508A99

Function 0027F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5986d9bdd44b58e5de6d31e182df707e97d2fa45c508003d4ba0cf8e1f78dc
Instruction ID: 8b9741144a4ee15cb32387397f151b3c1e97675f98d607cfff726cc24794ac56
Opcode Fuzzy Hash: fa5986d9bdd44b58e5de6d31e182df707e97d2fa45c508003d4ba0cf8e1f78dc
Instruction Fuzzy Hash: 36320421D7DF424DD7639634E976336A248AFB73C8F15D73BE819B99A6EB3884834100

Function 0028267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eb1a77e857704eb8317ded26f6d4ef54ff8e0ff63962f43b603ad1f6456298e
Instruction ID: e46e1b59e984e673e838245b48413fc9c48dd7b18658b27e26f4a78e91a6ec1f
Opcode Fuzzy Hash: 4eb1a77e857704eb8317ded26f6d4ef54ff8e0ff63962f43b603ad1f6456298e
Instruction Fuzzy Hash: 92B12120D6AF804DD323A6399875336B74CAFBB2C5F52D31BFC2638D62EB2190834241

Function 002C41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 002C4218

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 58c47ba090b58bba86f401743c31a8a66b3040ee79834e6a88aa5c30081c97ec
Instruction ID: ea4199b147679b860f35d0d88244f486a31451b32f0d691012b759b447fd4860
Opcode Fuzzy Hash: 58c47ba090b58bba86f401743c31a8a66b3040ee79834e6a88aa5c30081c97ec
Instruction Fuzzy Hash: A9E012312601149FC710AF59D845E9AB7D8AF54761F00801AFC4AC7251DA70EC548BA5

Function 002B4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 002B4F18

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6699ce699c5f55045f18141fd747c74dbffe12d8b706922d507974fe0c70b329
Instruction ID: 59356a08c6b853ecce2ebd906a6fb933aa0a383deb0f0c00974315156e1c9bca
Opcode Fuzzy Hash: 6699ce699c5f55045f18141fd747c74dbffe12d8b706922d507974fe0c70b329
Instruction Fuzzy Hash: B0D067A457460679E8186F20AC9FBF61209A3507D1F9459897202969C398E5B8A0A435

Function 002A8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,002A88D1), ref: 002A8CB3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: c3154eb5025181ffd8357e6ed18d04d79eb7b2920d6f94ebe49b0d21b7ae637e
Instruction ID: 28aae296ab75f9c3c1be57ebc8185d81a69417abbcb9d3fd3790941d82762fc5
Opcode Fuzzy Hash: c3154eb5025181ffd8357e6ed18d04d79eb7b2920d6f94ebe49b0d21b7ae637e
Instruction Fuzzy Hash: 3DD05E3226050EABEF018EA4ED05EAE3B69EB04B01F408111FE16C61A1C775D935AB60

Function 00292230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00292242

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: fc7ec68df081b38aedcdb6b62f41dad16ca816a332ffc8ba3ebc68fb1598d111
Instruction ID: f1b62df488ccb414509c7019112b4e245d67a32e79453c37f9912007d708191f
Opcode Fuzzy Hash: fc7ec68df081b38aedcdb6b62f41dad16ca816a332ffc8ba3ebc68fb1598d111
Instruction Fuzzy Hash: 91C04CF1C11109DBDB05DB90DA98DEE77BCAB04305F104056A102F2140D7749B548A71

Function 0027A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0027A36A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 666793bc01bc300e0e8f2d42c25d927b36fc6c44582d057f1d7725a3a860d072
Instruction ID: 4ef6534a693a9a4c3f29c7bfdc7719f7bacd8f4e3908aa18c591c863a901c23a
Opcode Fuzzy Hash: 666793bc01bc300e0e8f2d42c25d927b36fc6c44582d057f1d7725a3a860d072
Instruction Fuzzy Hash: 80A0123000010CA7CA401B45FC084447F5CD6001907004061FC0D40021873258104584

Function 00268A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee937e9b35a10c20e32567adff04a797a3c79fbb39d79ba7efdeefaa9359255
Instruction ID: fb12cbe2fc4e840bceba2c989ba3aa3f25535592d70fd93ab799374b2a44fcdb
Opcode Fuzzy Hash: 5ee937e9b35a10c20e32567adff04a797a3c79fbb39d79ba7efdeefaa9359255
Instruction Fuzzy Hash: 13221730931627CBDF2C8F14C49467EB7A1EB42304F68866BD9429B2A1DF749DE1CB60

Function 00272405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 55dc55e53faa888554acdadee8b764a410b7a8ef6b47844b31629b09a8608a54
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 8BC194322261934ADB2D4E3D943503EBAE15EA27B131A875DE4BACB5C4EF30D538D620

Function 0027283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 58a4691652ad2d57ce424727ade7b0860515674208a63efb0eb5b718b54088cd
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 87C1C43222619349DB2D4E3E843113EBBE15EA27B131A576DE4BADB5C4EF30D5389620

Function 03963600 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 909b297ea054101785f80a3bc3bb04946ae2d33f3a0a81dbe85ee381c4e42ab2
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 3341A2B1D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB50

Function 03963490 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: fd6d2d0fa6ddadb24f032f43103d7b669b8f6e7b9a8d5aa6ade504463f07bfed
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 97018078A01209EFCB45DF98C5909AEF7B9FB88210B648599D809A7711D730AE41DB80

Function 039634F0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: a1ae488828b6ce7357c395881aa9332308bd8a8d619d776957b7690a99791b9e
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: F401A478A05209EFCB45DF98C5909AEF7F9FF88310F648699D809A7711E730AE41DB80

Function 03961E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1652104101.0000000003960000.00000040.00001000.00020000.00000000.sdmp, Offset: 03960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3960000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 002C7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002C7B70
DeleteObject.GDI32(00000000), ref: 002C7B82
DestroyWindow.USER32 ref: 002C7B90
GetDesktopWindow.USER32 ref: 002C7BAA
GetWindowRect.USER32(00000000), ref: 002C7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 002C7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 002C7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7D4A
GetClientRect.USER32(00000000,?), ref: 002C7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 002C7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7DF8
GlobalFree.KERNEL32(00000000), ref: 002C7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,002E2CAC,00000000), ref: 002C7E2B
GlobalFree.KERNEL32(00000000), ref: 002C7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 002C7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 002C7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 002C808F

Strings

DISPLAY, xrefs: 002C7EF2
AutoIt v3, xrefs: 002C7D42
static, xrefs: 002C7D8A, 002C7EE1
, xrefs: 002C8015

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: ae771f8fdbcfb4f3b3d50138cfffcff7a582b8f6565f00ebea17d5649c193b32
Instruction ID: b343039158586cc0040e8c8eb2da9c92997c35be90a435dc60a62e218405cefe
Opcode Fuzzy Hash: ae771f8fdbcfb4f3b3d50138cfffcff7a582b8f6565f00ebea17d5649c193b32
Instruction Fuzzy Hash: AD02AD71910109EFDB14DFA4DD89EAE7BB8EF48311F14855AF916AB2A0CB30AD11CF64

Function 002D37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,002DF910), ref: 002D38AF
IsWindowVisible.USER32(?), ref: 002D38D3

Strings

ISVISIBLE, xrefs: 002D38BF
TABRIGHT, xrefs: 002D3925
DELSTRING, xrefs: 002D39D1
SETCURRENTSELECTION, xrefs: 002D3A3E
GETLINE, xrefs: 002D3C23
UNCHECK, xrefs: 002D3B0B
ISCHECKED, xrefs: 002D3AC1
GETCURRENTCOL, xrefs: 002D3BB0
GETCURRENTLINE, xrefs: 002D3B75
SHOWDROPDOWN, xrefs: 002D3968
FINDSTRING, xrefs: 002D39FE
HIDEDROPDOWN, xrefs: 002D3988
ADDSTRING, xrefs: 002D399E
GETCURRENTSELECTION, xrefs: 002D3A6B
ISENABLED, xrefs: 002D38F3
SELECTSTRING, xrefs: 002D3A8E
CHECK, xrefs: 002D3AF5
SENDCOMMANDID, xrefs: 002D3C62
EDITPASTE, xrefs: 002D3BE7
GETLINECOUNT, xrefs: 002D3B4E
TABLEFT, xrefs: 002D390F
CURRENTTAB, xrefs: 002D3945
GETSELECTED, xrefs: 002D3B2B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 2b1191a1c51aa3c4f18f9d275381834e096cda893b02400d99086bda1ce5d2a4
Instruction ID: a0c9f1011fc3dffaad0fb33c59fc028d6fec170f59e56be71e9c96ce9ed2f3be
Opcode Fuzzy Hash: 2b1191a1c51aa3c4f18f9d275381834e096cda893b02400d99086bda1ce5d2a4
Instruction Fuzzy Hash: B9D18134234306DBCB14EF11C491A6AB7A5EF54344F14845AB8865B3E2CB71EE6ACF92

Function 002DA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 002DA89F
GetSysColorBrush.USER32(0000000F), ref: 002DA8D0
GetSysColor.USER32(0000000F), ref: 002DA8DC
SetBkColor.GDI32(?,000000FF), ref: 002DA8F6
SelectObject.GDI32(?,?), ref: 002DA905
InflateRect.USER32(?,000000FF,000000FF), ref: 002DA930
GetSysColor.USER32(00000010), ref: 002DA938
CreateSolidBrush.GDI32(00000000), ref: 002DA93F
FrameRect.USER32(?,?,00000000), ref: 002DA94E
DeleteObject.GDI32(00000000), ref: 002DA955
InflateRect.USER32(?,000000FE,000000FE), ref: 002DA9A0
FillRect.USER32(?,?,?), ref: 002DA9D2
GetWindowLongW.USER32(?,000000F0), ref: 002DA9FD

Part of subcall function 002DAB60: GetSysColor.USER32(00000012), ref: 002DAB99
Part of subcall function 002DAB60: SetTextColor.GDI32(?,?), ref: 002DAB9D
Part of subcall function 002DAB60: GetSysColorBrush.USER32(0000000F), ref: 002DABB3
Part of subcall function 002DAB60: GetSysColor.USER32(0000000F), ref: 002DABBE
Part of subcall function 002DAB60: GetSysColor.USER32(00000011), ref: 002DABDB
Part of subcall function 002DAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 002DABE9
Part of subcall function 002DAB60: SelectObject.GDI32(?,00000000), ref: 002DABFA
Part of subcall function 002DAB60: SetBkColor.GDI32(?,00000000), ref: 002DAC03
Part of subcall function 002DAB60: SelectObject.GDI32(?,?), ref: 002DAC10
Part of subcall function 002DAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 002DAC2F
Part of subcall function 002DAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002DAC46
Part of subcall function 002DAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 002DAC5B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 5bcdc3f3d18559c4c3ca3d1565b88b0d6b2be489926965519b2f999d3dddb409
Instruction ID: d2f012af22a32baa40523f3f21b0325a604e014ef359fe8196c1ede658723258
Opcode Fuzzy Hash: 5bcdc3f3d18559c4c3ca3d1565b88b0d6b2be489926965519b2f999d3dddb409
Instruction Fuzzy Hash: 83A1AF72419302AFD7509F64ED0CE5B7BA9FF88321F104A2AF966962A0D770DD44CB52

Function 00252C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00252CA2
DeleteObject.GDI32(00000000), ref: 00252CE8
DeleteObject.GDI32(00000000), ref: 00252CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00252CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00252D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0028C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0028C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0028CAED

Part of subcall function 00251B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00252036,?,00000000,?,?,?,?,002516CB,00000000,?), ref: 00251B9A

SendMessageW.USER32(?,00001053), ref: 0028CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0028CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0028CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0028CB62

Strings

0, xrefs: 0028C981

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 90da34d38519ff3dda8fffd2a761bc7e6e016e61a11500e888a362e69273e2bd
Instruction ID: 203f6cc4c4182e45a0af6b9451cc64a2c2f8fe01e8e5e25c06e3b58c2c4ebbb9
Opcode Fuzzy Hash: 90da34d38519ff3dda8fffd2a761bc7e6e016e61a11500e888a362e69273e2bd
Instruction Fuzzy Hash: 7112D234521202DFDB15DF24C988BA9B7E5BF05302F64416AF856CB692C731EC69CF64

Function 002C77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 002C77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 002C78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 002C78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 002C7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 002C7946
GetClientRect.USER32(00000000,?), ref: 002C7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 002C7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 002C79A5
GetStockObject.GDI32(00000011), ref: 002C79B5
SelectObject.GDI32(00000000,00000000), ref: 002C79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 002C79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002C79D2
DeleteDC.GDI32(00000000), ref: 002C79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002C7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 002C7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 002C7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 002C7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 002C7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 002C7AAE
GetStockObject.GDI32(00000011), ref: 002C7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 002C7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 002C7ACE

Strings

DISPLAY, xrefs: 002C799B
msctls_progress32, xrefs: 002C7A4F
static, xrefs: 002C7990, 002C7AA8
AutoIt v3, xrefs: 002C793E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: b1ed17ce4d36628925cbef1dd36cd8172f7972a8b227d998113090c532591d81
Instruction ID: 91dec428f103f9e074098ab4d0bad9a02e751243ce1c3ad4d27a9116a0de8e15
Opcode Fuzzy Hash: b1ed17ce4d36628925cbef1dd36cd8172f7972a8b227d998113090c532591d81
Instruction Fuzzy Hash: 2EA1AF71A10219BFEB109BA4DD4AFAE7BBDEB48711F008215FA15A72E0C770AD10CF64

Function 002BAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002BAF89
GetDriveTypeW.KERNEL32(?,002DFAC0,?,\\.\,002DF910), ref: 002BB066
SetErrorMode.KERNEL32(00000000,002DFAC0,?,\\.\,002DF910), ref: 002BB1C4

Strings

ATAPI, xrefs: 002BB138
SAS, xrefs: 002BB170
RAMDisk, xrefs: 002BB090
CDROM, xrefs: 002BB09A
Fixed, xrefs: 002BB0AE
Unknown, xrefs: 002BB086, 002BB12A
SSA, xrefs: 002BB14D
FileBackedVirtual, xrefs: 002BB193
\\.\, xrefs: 002BAFDB
Removable, xrefs: 002BB0B8
ATA, xrefs: 002BB13F
SATA, xrefs: 002BB177
iSCSI, xrefs: 002BB169
SSD, xrefs: 002BB0F1
Virtual, xrefs: 002BB18C
PhysicalDrive, xrefs: 002BB012
MMC, xrefs: 002BB185
1394, xrefs: 002BB146
SCSI, xrefs: 002BB131
Network, xrefs: 002BB0A4
USB, xrefs: 002BB15B
RAID, xrefs: 002BB162
Fibre, xrefs: 002BB154

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: cdb71ccd0ccb2745068d049e6b4c5eba906e14f0097c529268491426971adb84
Instruction ID: 939a0301ae61c8e5c74dcb1a965dc5255774edf62add61f52cb662967b672239
Opcode Fuzzy Hash: cdb71ccd0ccb2745068d049e6b4c5eba906e14f0097c529268491426971adb84
Instruction Fuzzy Hash: E25109306B5705DBCB02EF58D9629FD73B0AB187C17208415E54EA72D0C7F59D66CB42

Function 00256A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00256A91
__wcsnicmp.LIBCMT ref: 00256AA9
__wcsnicmp.LIBCMT ref: 00256AC1
__wcsnicmp.LIBCMT ref: 00256AD9
__wcsnicmp.LIBCMT ref: 00256AF1
__wcsnicmp.LIBCMT ref: 00256B09
__wcsnicmp.LIBCMT ref: 00256B21
__wcsnicmp.LIBCMT ref: 00256B35
__wcsnicmp.LIBCMT ref: 00256B76
__wcsnicmp.LIBCMT ref: 00256B8A
__wcsnicmp.LIBCMT ref: 00256B9E
__wcsnicmp.LIBCMT ref: 00256BB2

Strings

#notrayicon, xrefs: 00256AA3
Bad directive syntax error, xrefs: 0028E743
#requireadmin, xrefs: 00256ABB
#OnAutoItStartRegister, xrefs: 00256AD3
Cannot parse #include, xrefs: 0028E819
#include-once, xrefs: 00256AEB
#comments-end, xrefs: 00256B98
#cs, xrefs: 00256B2F, 00256B84
#comments-start, xrefs: 00256B1B, 00256B70
Unterminated group of comments, xrefs: 0028E82C
#ce, xrefs: 00256BAC
#include, xrefs: 00256B03
#pragma compile, xrefs: 00256A8B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 3cd91eed3e3822d9d0d8457241d3186604283634be454e3b6f38131eb3cd169b
Instruction ID: a8cb855ca3c5e35ebc120dea8fd56e2deef76d2a9262d5c0631b39a11cbd496b
Opcode Fuzzy Hash: 3cd91eed3e3822d9d0d8457241d3186604283634be454e3b6f38131eb3cd169b
Instruction Fuzzy Hash: 2B812770670316AACF21BE20CD87FAE7768AF15305F448021FD45AB1C2EB70DA79CA59

Function 002DAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 002DAB99
SetTextColor.GDI32(?,?), ref: 002DAB9D
GetSysColorBrush.USER32(0000000F), ref: 002DABB3
GetSysColor.USER32(0000000F), ref: 002DABBE
CreateSolidBrush.GDI32(?), ref: 002DABC3
GetSysColor.USER32(00000011), ref: 002DABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 002DABE9
SelectObject.GDI32(?,00000000), ref: 002DABFA
SetBkColor.GDI32(?,00000000), ref: 002DAC03
SelectObject.GDI32(?,?), ref: 002DAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 002DAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 002DAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 002DAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 002DACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 002DACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 002DACEC
DrawFocusRect.USER32(?,?), ref: 002DACF7
GetSysColor.USER32(00000011), ref: 002DAD05
SetTextColor.GDI32(?,00000000), ref: 002DAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 002DAD21
SelectObject.GDI32(?,002DA869), ref: 002DAD38
DeleteObject.GDI32(?), ref: 002DAD43
SelectObject.GDI32(?,?), ref: 002DAD49
DeleteObject.GDI32(?), ref: 002DAD4E
SetTextColor.GDI32(?,?), ref: 002DAD54
SetBkColor.GDI32(?,?), ref: 002DAD5E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 6b614b05b84f0693116f8a8a2158d5bd706adeafb64b7bc92839df31964ab675
Instruction ID: 620eaaa2198cd99850f000175c50a76e241787addeb673566d374fa7ff8c9c48
Opcode Fuzzy Hash: 6b614b05b84f0693116f8a8a2158d5bd706adeafb64b7bc92839df31964ab675
Instruction Fuzzy Hash: 84617D71D11219AFDB109FA4ED48EAE7BB9EB08320F148127F916AB2A1D6719D50CF90

Function 002D8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 002D8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002D8D45
CharNextW.USER32(0000014E), ref: 002D8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 002D8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 002D8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002D8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 002D8DF9
SetWindowTextW.USER32(?,0000014E), ref: 002D8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 002D8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 002D8E8C
_memset.LIBCMT ref: 002D8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 002D8EFA
_memset.LIBCMT ref: 002D8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 002D8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 002D8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 002D9088
InvalidateRect.USER32(?,00000000,00000001), ref: 002D90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 002D90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 002D9121
DrawMenuBar.USER32(?), ref: 002D9130
SetWindowTextW.USER32(?,0000014E), ref: 002D9158

Strings

0, xrefs: 002D90C2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: e30ca3cae7e5822388dbe1ef526e6664d02a34bd1021710a394a7ce0c57fc842
Instruction ID: f48c4b35c453639c02dcd1b907061e28a9c7794f3f4163a1de93ae1a298e8d53
Opcode Fuzzy Hash: e30ca3cae7e5822388dbe1ef526e6664d02a34bd1021710a394a7ce0c57fc842
Instruction Fuzzy Hash: 73E17F7092120AABDF219F60DC88EEE7B79EF05710F108157F9199A2D0DB709E95DF60

Function 002D4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002D4C51
GetDesktopWindow.USER32 ref: 002D4C66
GetWindowRect.USER32(00000000), ref: 002D4C6D
GetWindowLongW.USER32(?,000000F0), ref: 002D4CCF
DestroyWindow.USER32(?), ref: 002D4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 002D4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002D4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 002D4D68
SendMessageW.USER32(?,00000421,?,?), ref: 002D4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 002D4D90
IsWindowVisible.USER32(?), ref: 002D4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 002D4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 002D4DDF
GetWindowRect.USER32(?,?), ref: 002D4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 002D4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 002D4E37
CopyRect.USER32(?,?), ref: 002D4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 002D4EB9

Strings

0, xrefs: 002D4BFC
(, xrefs: 002D4E2A
tooltips_class32, xrefs: 002D4D1D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 0d0b0dc7c38555d080de5f1460e718f694545b2434406f32bef9357f8292f212
Instruction ID: 2c03ccd0db0624c6cfe6c16a14c51cd1dc7c00b5e7d4770420d82447d3edc124
Opcode Fuzzy Hash: 0d0b0dc7c38555d080de5f1460e718f694545b2434406f32bef9357f8292f212
Instruction Fuzzy Hash: 54B1AC70628341AFDB44EF24C949B5ABBE4FF88300F00891EF9999B2A1D770EC54CB95

Function 002527D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002528BC
GetSystemMetrics.USER32(00000007), ref: 002528C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 002528EF
GetSystemMetrics.USER32(00000008), ref: 002528F7
GetSystemMetrics.USER32(00000004), ref: 0025291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00252939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00252949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0025297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00252990
GetClientRect.USER32(00000000,000000FF), ref: 002529AE
GetStockObject.GDI32(00000011), ref: 002529CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 002529D5

Part of subcall function 00252344: GetCursorPos.USER32(?), ref: 00252357
Part of subcall function 00252344: ScreenToClient.USER32(003167B0,?), ref: 00252374
Part of subcall function 00252344: GetAsyncKeyState.USER32(00000001), ref: 00252399
Part of subcall function 00252344: GetAsyncKeyState.USER32(00000002), ref: 002523A7

SetTimer.USER32(00000000,00000000,00000028,00251256), ref: 002529FC

Strings

AutoIt v3 GUI, xrefs: 00252974

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3cb519be69491d468a29cdafe3da2dafc7b7f55f371c07b07a69820ed6f486a2
Instruction ID: a7202162fca2ed77e2ee0c8d5db92fc34a362e9fa384639bf6c68f96091ac3f8
Opcode Fuzzy Hash: 3cb519be69491d468a29cdafe3da2dafc7b7f55f371c07b07a69820ed6f486a2
Instruction Fuzzy Hash: 89B19D34A1120AEFDB15DFA8DD49BED7BA4FB08311F108129FA16A62D0CB70D865CB64

Function 002D4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002D40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 002D41B6

Strings

SELECTINVERT, xrefs: 002D4286
SELECT, xrefs: 002D4250
VIEWCHANGE, xrefs: 002D4375
ISSELECTED, xrefs: 002D41C1
GETSUBITEMCOUNT, xrefs: 002D4141
FINDITEM, xrefs: 002D4329
SELECTALL, xrefs: 002D421D
GETITEMCOUNT, xrefs: 002D4128
GETTEXT, xrefs: 002D415F
DESELECT, xrefs: 002D42A4
SELECTCLEAR, xrefs: 002D4235
GETSELECTED, xrefs: 002D42E4
GETSELECTEDCOUNT, xrefs: 002D4199

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: b1f3542e8b1c2cd0c68a8190a6f40bae479744a781e518fba3ac8205a1b5d449
Instruction ID: b7771f76927a3f284a298df860582abf9a992b4e599e937c201f6e6363ed8413
Opcode Fuzzy Hash: b1f3542e8b1c2cd0c68a8190a6f40bae479744a781e518fba3ac8205a1b5d449
Instruction Fuzzy Hash: BFA1A130234301DFCB14FF14C951A6AB3A5AF45314F14886AB89A5B7D2DB30ED69CF51

Function 002C52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 002C5309
LoadCursorW.USER32(00000000,00007F8A), ref: 002C5314
LoadCursorW.USER32(00000000,00007F00), ref: 002C531F
LoadCursorW.USER32(00000000,00007F03), ref: 002C532A
LoadCursorW.USER32(00000000,00007F8B), ref: 002C5335
LoadCursorW.USER32(00000000,00007F01), ref: 002C5340
LoadCursorW.USER32(00000000,00007F81), ref: 002C534B
LoadCursorW.USER32(00000000,00007F88), ref: 002C5356
LoadCursorW.USER32(00000000,00007F80), ref: 002C5361
LoadCursorW.USER32(00000000,00007F86), ref: 002C536C
LoadCursorW.USER32(00000000,00007F83), ref: 002C5377
LoadCursorW.USER32(00000000,00007F85), ref: 002C5382
LoadCursorW.USER32(00000000,00007F82), ref: 002C538D
LoadCursorW.USER32(00000000,00007F84), ref: 002C5398
LoadCursorW.USER32(00000000,00007F04), ref: 002C53A3
LoadCursorW.USER32(00000000,00007F02), ref: 002C53AE
GetCursorInfo.USER32(?), ref: 002C53BE
GetLastError.KERNEL32(00000001,00000000), ref: 002C53E9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 8bab174778084916be153dc87273d75639729e920e3432c52ffc73ab3e79ef51
Instruction ID: 872f3c04365d57e550a015ef99d909f50f444eb0b0b34fbf5d51132f603060e7
Opcode Fuzzy Hash: 8bab174778084916be153dc87273d75639729e920e3432c52ffc73ab3e79ef51
Instruction Fuzzy Hash: 64418670E143296ADB209FB68C49D6FFFF8EF51B10B10452FE509E7290DAB8A440CE61

Function 002AAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 002AAAA5
__swprintf.LIBCMT ref: 002AAB46
_wcscmp.LIBCMT ref: 002AAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 002AABAE
_wcscmp.LIBCMT ref: 002AABEA
GetClassNameW.USER32(?,?,00000400), ref: 002AAC21
GetDlgCtrlID.USER32(?), ref: 002AAC73
GetWindowRect.USER32(?,?), ref: 002AACA9
GetParent.USER32(?), ref: 002AACC7
ScreenToClient.USER32(00000000), ref: 002AACCE
GetClassNameW.USER32(?,?,00000100), ref: 002AAD48
_wcscmp.LIBCMT ref: 002AAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 002AAD82
_wcscmp.LIBCMT ref: 002AAD96

Part of subcall function 0027386C: _iswctype.LIBCMT ref: 00273874

Strings

%s%u, xrefs: 002AAB40

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 400542082af294f9e6f58ed9e1a383b70b5d57bc7e5faeea13d69aecc1877bbe
Instruction ID: 709b0ffd3a182539823258072041fc32beae4d13eb37065ba15dad87471b942c
Opcode Fuzzy Hash: 400542082af294f9e6f58ed9e1a383b70b5d57bc7e5faeea13d69aecc1877bbe
Instruction Fuzzy Hash: 95A1C071224707AFD714DF24C884BEAF7E8FF06315F00862AF99982591DB30E965CB92

Function 002AB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 002AB3DB
_wcscmp.LIBCMT ref: 002AB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 002AB414
CharUpperBuffW.USER32(?,00000000), ref: 002AB431
_wcscmp.LIBCMT ref: 002AB44F
_wcsstr.LIBCMT ref: 002AB460
GetClassNameW.USER32(00000018,?,00000400), ref: 002AB498
_wcscmp.LIBCMT ref: 002AB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 002AB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 002AB518
_wcscmp.LIBCMT ref: 002AB528
GetClassNameW.USER32(00000010,?,00000400), ref: 002AB550
GetWindowRect.USER32(00000004,?), ref: 002AB5B9

Strings

@, xrefs: 002AB3BC
ThumbnailClass, xrefs: 002AB4A3, 002AB523

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 4f18a93a15363820cb0ae2ee73505a3c10cd71efef6b0791d8349899036c3611
Instruction ID: 544d62f71628ef0428d371c0c8617392af5ace66f9c30e6777c8ed97aef9af19
Opcode Fuzzy Hash: 4f18a93a15363820cb0ae2ee73505a3c10cd71efef6b0791d8349899036c3611
Instruction Fuzzy Hash: 7D81C0714243069BDB06DF10D885FAABBE8EF45714F0481AAFD898A093DF30DD69CB61

Function 002DC8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

DragQueryPoint.SHELL32(?,?), ref: 002DC917

Part of subcall function 002DADF1: ClientToScreen.USER32(?,?), ref: 002DAE1A
Part of subcall function 002DADF1: GetWindowRect.USER32(?,?), ref: 002DAE90
Part of subcall function 002DADF1: PtInRect.USER32(?,?,002DC304), ref: 002DAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 002DC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 002DC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 002DC9AE
_wcscat.LIBCMT ref: 002DC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 002DC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 002DCA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 002DCA25
SendMessageW.USER32(?,000000B1,?,?), ref: 002DCA47
DragFinish.SHELL32(?), ref: 002DCA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 002DCB41

Strings

@GUI_DRAGFILE, xrefs: 002DCAF0
@GUI_DRAGID, xrefs: 002DCAB9
@GUI_DROPID, xrefs: 002DCA6E
pr1, xrefs: 002DCA8B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pr1
API String ID: 169749273-2184659058
Opcode ID: 5fb83230029b37b35ac8a0e5bcfaaeb8cf56461bf51a83a598ba15715255346e
Instruction ID: e30d828521bbfa72c727a3f4d5bbd1929c0a79919d377793023a72f9f02c16d5
Opcode Fuzzy Hash: 5fb83230029b37b35ac8a0e5bcfaaeb8cf56461bf51a83a598ba15715255346e
Instruction Fuzzy Hash: C7617B71518301AFC701DF64DC89D9FBBE8EF88710F104A2EF992922A1DB709A59CF56

Function 002AB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 002AB23F

Strings

[CLASS:, xrefs: 002AB28F
LAST, xrefs: 002AB204
[LAST, xrefs: 002AB2EC
HANDLE=, xrefs: 002AB238
REGEXP=, xrefs: 002AB254
ALL, xrefs: 002AB2D3
[REGEXPTITLE:, xrefs: 002AB267
ACTIVE, xrefs: 002AB21A
CLASSNAME=, xrefs: 002AB27C
[HANDLE:, xrefs: 002AB24B
[ALL, xrefs: 002AB2E5
[ACTIVE, xrefs: 002AB22C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: eff6b0c3de63ec115d574b64c4e330d30f53c40a5fc68dee358f62f5fa9fd6fb
Instruction ID: 398286b50348ddc78b0a71acb6184ce25bffed6b77e6167d028225e3a6bcea53
Opcode Fuzzy Hash: eff6b0c3de63ec115d574b64c4e330d30f53c40a5fc68dee358f62f5fa9fd6fb
Instruction Fuzzy Hash: 6F31F031A64209A6DB12FA60DC63FEE77A89F25711F600026F805710D3EFB26E28C955

Function 002AC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 002AC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 002AC4E6
SetWindowTextW.USER32(?,?), ref: 002AC4FD
GetDlgItem.USER32(?,000003EA), ref: 002AC512
SetWindowTextW.USER32(00000000,?), ref: 002AC518
GetDlgItem.USER32(?,000003E9), ref: 002AC528
SetWindowTextW.USER32(00000000,?), ref: 002AC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 002AC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 002AC569
GetWindowRect.USER32(?,?), ref: 002AC572
SetWindowTextW.USER32(?,?), ref: 002AC5DD
GetDesktopWindow.USER32 ref: 002AC5E3
GetWindowRect.USER32(00000000), ref: 002AC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 002AC636
GetClientRect.USER32(?,?), ref: 002AC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 002AC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 002AC693

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: eb72e017ac9dbd770709a95e0f6ccb3568207accb7fb3e1a9991e82639209668
Instruction ID: 8669e10c68a8d2ff94ba9c4257c968ba757cfb73b13219fef85068e575097147
Opcode Fuzzy Hash: eb72e017ac9dbd770709a95e0f6ccb3568207accb7fb3e1a9991e82639209668
Instruction Fuzzy Hash: 22516070D00709AFDB20DFA8DE89B6EBBF9FF04704F104529E692A25A0DB74E914CB54

Function 002DA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002DA4C8
DestroyWindow.USER32(?,?), ref: 002DA542

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 002DA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 002DA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002DA5F1
DestroyWindow.USER32(00000000), ref: 002DA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00250000,00000000), ref: 002DA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 002DA663
GetDesktopWindow.USER32 ref: 002DA67C
GetWindowRect.USER32(00000000), ref: 002DA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 002DA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 002DA6B3

Part of subcall function 002525DB: GetWindowLongW.USER32(?,000000EB), ref: 002525EC

Strings

tooltips_class32, xrefs: 002DA5B5, 002DA643
0, xrefs: 002DA4DE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: f2ef1db47d899478773879b0a21566f7035aaac302aec013a07e1af1d2bc70c8
Instruction ID: 65a2855b0a6116243fc71c783a4ca1bb60e77f56bb80f1b429dd5e3f25139a37
Opcode Fuzzy Hash: f2ef1db47d899478773879b0a21566f7035aaac302aec013a07e1af1d2bc70c8
Instruction Fuzzy Hash: 0E718A71551205AFDB21CF28D849FA677E9EB88300F08492EF996872A0D770ED16CB96

Function 002D4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002D46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 002D46F6

Strings

EXPAND, xrefs: 002D47A8
GETTOTALCOUNT, xrefs: 002D46DD
GETITEMCOUNT, xrefs: 002D47D8
SELECT, xrefs: 002D48A7
GETTEXT, xrefs: 002D4849
CHECK, xrefs: 002D4716
UNCHECK, xrefs: 002D48D2
COLLAPSE, xrefs: 002D473C
ISCHECKED, xrefs: 002D4879
EXISTS, xrefs: 002D475F
GETSELECTED, xrefs: 002D4806

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 8c1ed2a59bf875694f8f05e553b301da995e4d05640115930ee3166ae2cf9395
Instruction ID: 4eb00beb247a4dab93fc4185e8eeb2f6242895c272eb0fcc88b97ec60af9045f
Opcode Fuzzy Hash: 8c1ed2a59bf875694f8f05e553b301da995e4d05640115930ee3166ae2cf9395
Instruction Fuzzy Hash: A6918F34224305DFCB14EF20C891A6AB7A1AF59314F04845EFC965B7A2CB71ED6ACF85

Function 002DBAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 002DBB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,002D6D80,?), ref: 002DBBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 002DBC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 002DBC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 002DBC7D
FreeLibrary.KERNEL32(?), ref: 002DBC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 002DBC99
DestroyIcon.USER32(?), ref: 002DBCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 002DBCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 002DBCD1

Part of subcall function 0027313D: __wcsicmp_l.LIBCMT ref: 002731C6

Strings

.exe, xrefs: 002DBB04
.icl, xrefs: 002DBAE4
.dll, xrefs: 002DBB27

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a055931698f428427983fe7747f99b61d25d441ede441f4eb227968c87b9482a
Instruction ID: 76594e9bb53199060dcb49436fcdaf67cc3e33538aa3c5dd5207a27cd67272f5
Opcode Fuzzy Hash: a055931698f428427983fe7747f99b61d25d441ede441f4eb227968c87b9482a
Instruction Fuzzy Hash: 9E61BD71A20219FEEB15DF64DD45BBA77A8FB08711F108117F815D62C0DBB4AEA4CBA0

Function 002BA0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,002DFB78), ref: 002BA0FC

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 002BA11E
__swprintf.LIBCMT ref: 002BA177
__swprintf.LIBCMT ref: 002BA190
_wprintf.LIBCMT ref: 002BA246
_wprintf.LIBCMT ref: 002BA264

Strings

Error: , xrefs: 002BA20E
^ ERROR, xrefs: 002BA1E8
%., xrefs: 002BA0C9
Line %d (File "%s"):, xrefs: 002BA171, 002BA18A
"%s" (%d) : ==> %s:, xrefs: 002BA25F
"%s" (%d) : ==> %s:%s%s, xrefs: 002BA241

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%.
API String ID: 311963372-3105223538
Opcode ID: 6313160c8fbff4d3fa126bc31fdeda28ee57c8827f509f3b4343cf3acc1991b9
Instruction ID: abbd639db831fe30bee09d092badafea0f8efbde1165c216e8ef293c8b2e78b1
Opcode Fuzzy Hash: 6313160c8fbff4d3fa126bc31fdeda28ee57c8827f509f3b4343cf3acc1991b9
Instruction Fuzzy Hash: FA51B131860209ABCF15EBE0DD92EEEB779AF08301F104165F905721A1EB316F69DF51

Function 002BA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

CharLowerBuffW.USER32(?,?), ref: 002BA636
GetDriveTypeW.KERNEL32 ref: 002BA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002BA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002BA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002BA730

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Strings

wait, xrefs: 002BA6ED
close, xrefs: 002BA63C
open , xrefs: 002BA692
open, xrefs: 002BA65D
close cd wait, xrefs: 002BA71B
type cdaudio alias cd wait, xrefs: 002BA6AE
set cd door , xrefs: 002BA6D1
closed, xrefs: 002BA64A, 002BA653

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 0acc2afb317910aeacb704088a7b770470c5509944e4b156de075d2d772fc7e3
Instruction ID: d637bfaea3e9eff11e62ea896bb5d029f1d1d110a4aac977b9cc7f8643c27b77
Opcode Fuzzy Hash: 0acc2afb317910aeacb704088a7b770470c5509944e4b156de075d2d772fc7e3
Instruction Fuzzy Hash: 6D516A711287099FC700EF20D8918AAB3F4EF94758F14896DF886572A1DB31EE1ACF52

Function 002BA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 002BA47A
__swprintf.LIBCMT ref: 002BA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 002BA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 002BA4FE
_memset.LIBCMT ref: 002BA51D
_wcsncpy.LIBCMT ref: 002BA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 002BA58E
CloseHandle.KERNEL32(00000000), ref: 002BA599
RemoveDirectoryW.KERNEL32(?), ref: 002BA5A2
CloseHandle.KERNEL32(00000000), ref: 002BA5AC

Strings

\??\%s, xrefs: 002BA496
:, xrefs: 002BA4BD
\, xrefs: 002BA4B2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 8f8b558cef77844d7c3ee2ff8f13b7bcfd2aff2e5e8cfd0aef6600039be2ea3a
Instruction ID: fe0ab0705b666e3f36d207abe5d4a8dfe60edcc44d3fd4f88c7fbdd9437f244c
Opcode Fuzzy Hash: 8f8b558cef77844d7c3ee2ff8f13b7bcfd2aff2e5e8cfd0aef6600039be2ea3a
Instruction Fuzzy Hash: 3E31D4B591011AABDB21DFA0DC48FEB33BCEF88741F5040B6F909D2160E7709B548B25

Function 0028AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0028AB7B
___wtomb_environ.LIBCMT ref: 0028AB9D

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

__malloc_crt.LIBCMT ref: 0028ABC5
__malloc_crt.LIBCMT ref: 0028ABE2
_free.LIBCMT ref: 0028AC19
__recalloc_crt.LIBCMT ref: 0028AC52
__recalloc_crt.LIBCMT ref: 0028AC97
_strlen.LIBCMT ref: 0028ACC3
__calloc_crt.LIBCMT ref: 0028ACCD
_strlen.LIBCMT ref: 0028ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0028AD0A
_free.LIBCMT ref: 0028AD24
_free.LIBCMT ref: 0028AD31
_free.LIBCMT ref: 0028AD43
__invoke_watson.LIBCMT ref: 0028AD5D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 49b83021533893cbdefdc78713c24c7092742a52e3450607da84c630c45989fd
Instruction ID: 0ea4d26f5580f07dbd0d19b82de17a220249edf9c2beb1bfc80307f392d67bf8
Opcode Fuzzy Hash: 49b83021533893cbdefdc78713c24c7092742a52e3450607da84c630c45989fd
Instruction Fuzzy Hash: A061F476923202EFFB217F24D842B6977A9EF21325F14812BE805DB1D1DF749861CB92

Function 002BDB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 002BDC7B
_wcscat.LIBCMT ref: 002BDC93
_wcscat.LIBCMT ref: 002BDCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 002BDCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 002BDCCE
GetFileAttributesW.KERNEL32(?), ref: 002BDCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 002BDD00
SetCurrentDirectoryW.KERNEL32(?), ref: 002BDD12

Strings

*.*, xrefs: 002BDD51

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: a46d151dfacfc7f099b2ae0301dfda36b6d7acc1f1bfd16e50ecc90e8f2538b7
Instruction ID: 7e328396406a0f7f13b5c11815b78f1eb456db7f32666064a68af20441682992
Opcode Fuzzy Hash: a46d151dfacfc7f099b2ae0301dfda36b6d7acc1f1bfd16e50ecc90e8f2538b7
Instruction Fuzzy Hash: A18182765242429FCB64EF24C8459EEB7E8BB88394F19882EF889C7250F770DD54CB52

Function 002DC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 002DC4EC
GetFocus.USER32 ref: 002DC4FC
GetDlgCtrlID.USER32(00000000), ref: 002DC507
_memset.LIBCMT ref: 002DC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 002DC65D
GetMenuItemCount.USER32(?), ref: 002DC67D
GetMenuItemID.USER32(?,00000000), ref: 002DC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 002DC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 002DC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 002DC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 002DC779

Strings

0, xrefs: 002DC62A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: b96636791d072210e71a94c783df101cdbedc888ae57af1c21f85a87b7145565
Instruction ID: 2f01160ae3881f3b69b1081685ff7cb1b298f629575aa4ec10d8cbb6ef4b3645
Opcode Fuzzy Hash: b96636791d072210e71a94c783df101cdbedc888ae57af1c21f85a87b7145565
Instruction Fuzzy Hash: 53815B706283029FD711CF14D984AABBBE8EB88314F20452EF99597391D770ED25CF92

Function 002A83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002A8766
Part of subcall function 002A874A: GetLastError.KERNEL32(?,002A822A,?,?,?), ref: 002A8770
Part of subcall function 002A874A: GetProcessHeap.KERNEL32(00000008,?,?,002A822A,?,?,?), ref: 002A877F
Part of subcall function 002A874A: HeapAlloc.KERNEL32(00000000,?,002A822A,?,?,?), ref: 002A8786
Part of subcall function 002A874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002A879D

Part of subcall function 002A87E7: GetProcessHeap.KERNEL32(00000008,002A8240,00000000,00000000,?,002A8240,?), ref: 002A87F3
Part of subcall function 002A87E7: HeapAlloc.KERNEL32(00000000,?,002A8240,?), ref: 002A87FA
Part of subcall function 002A87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,002A8240,?), ref: 002A880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 002A8458
_memset.LIBCMT ref: 002A846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 002A848C
GetLengthSid.ADVAPI32(?), ref: 002A849D
GetAce.ADVAPI32(?,00000000,?), ref: 002A84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 002A84F6
GetLengthSid.ADVAPI32(?), ref: 002A8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 002A8522
HeapAlloc.KERNEL32(00000000), ref: 002A8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 002A854A
CopySid.ADVAPI32(00000000), ref: 002A8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 002A8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 002A85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 002A85BC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 4c8edffb0edc7e5b770a66905a5f4cca2943ed5d1095fcda1a836393c8e7fbde
Instruction ID: 6c2836f7f2fd11e2974f8f9567fc34837ee2a63ea3ba3364514d850e842ad538
Opcode Fuzzy Hash: 4c8edffb0edc7e5b770a66905a5f4cca2943ed5d1095fcda1a836393c8e7fbde
Instruction Fuzzy Hash: 11615B71D1020AABDF04DFA0DD48AAEBBB9FF05301F44812AE915A7291DF309A24CF60

Function 002C762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 002C76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 002C76AE
CreateCompatibleDC.GDI32(?), ref: 002C76BA
SelectObject.GDI32(00000000,?), ref: 002C76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 002C771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 002C7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 002C777B
SelectObject.GDI32(00000006,?), ref: 002C7783
DeleteObject.GDI32(?), ref: 002C778C
DeleteDC.GDI32(00000006), ref: 002C7793
ReleaseDC.USER32(00000000,?), ref: 002C779E

Strings

(, xrefs: 002C7723

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: eb895b341d9f774bb5ef88f972daeb6f25af06d36eedc8ef3b666d8b9684cc7b
Instruction ID: 8b0da6275a7db81d74cbcc591a1bb76f07bbffb8cdc1aaa50d0c7b8952a0ed09
Opcode Fuzzy Hash: eb895b341d9f774bb5ef88f972daeb6f25af06d36eedc8ef3b666d8b9684cc7b
Instruction Fuzzy Hash: DE513875914209EFCB15CFA8DC88EAEBBB9EF48710F14852EE95A97210D631AD508F60

Function 00256BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00270B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00256C6C,?,00008000), ref: 00270BB7

Part of subcall function 002548AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,002548A1,?,?,002537C0,?), ref: 002548CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00256D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00256E5A

Part of subcall function 002559CD: _wcscpy.LIBCMT ref: 00255A05

Part of subcall function 0027387D: _iswctype.LIBCMT ref: 00273885

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0028E8BF
AU3!, xrefs: 00256CC1
Error opening the file, xrefs: 0028E866, 0028E8E1
Unterminated string, xrefs: 0028EC0D
Bad directive syntax error, xrefs: 0028EBC6
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0028E84A
EA06, xrefs: 0028E87B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: d1644f53a2b9c71faa856b82e91f8bfb8b7ce52e5f8991f06242b49fedfd845b
Instruction ID: be635a8e861d43781a312f600982207411cbfc1fa0fe1ef8dcff15b9c91f7b75
Opcode Fuzzy Hash: d1644f53a2b9c71faa856b82e91f8bfb8b7ce52e5f8991f06242b49fedfd845b
Instruction Fuzzy Hash: A402B0351283419FCB24EF24C891AAFBBE5BF99314F04491DF886932A1DB30D969CF46

Function 002545DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002545F9
GetMenuItemCount.USER32(00316890), ref: 0028D7CD
GetMenuItemCount.USER32(00316890), ref: 0028D87D
GetCursorPos.USER32(?), ref: 0028D8C1
SetForegroundWindow.USER32(00000000), ref: 0028D8CA
TrackPopupMenuEx.USER32(00316890,00000000,?,00000000,00000000,00000000), ref: 0028D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0028D8E9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 0f2ef2d7c3ef523d8b3a571fb2b9a663667b86316d24a33bec36aa32d6f04561
Instruction ID: 9ef59abd1934033fc3f7a9520f8a9eba2750f2a6414674fe9830fc5219fc85ce
Opcode Fuzzy Hash: 0f2ef2d7c3ef523d8b3a571fb2b9a663667b86316d24a33bec36aa32d6f04561
Instruction Fuzzy Hash: 2C714934662206BEEB20AF14DC49FAAFF69FF05358F100216F925661D0C7B19C78DB94

Function 002C8BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002C8BEC
CoInitialize.OLE32(00000000), ref: 002C8C19
CoUninitialize.OLE32 ref: 002C8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 002C8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 002C8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,002E2C0C), ref: 002C8E84
CoGetObject.OLE32(?,00000000,002E2C0C,?), ref: 002C8EA7
SetErrorMode.KERNEL32(00000000), ref: 002C8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 002C8F3A
VariantClear.OLEAUT32(?), ref: 002C8F4A

Strings

,,., xrefs: 002C8BD6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,.
API String ID: 2395222682-737214711
Opcode ID: 19629521603088c3ae0ff31b346f27896a38450fa52ce0534014cec9b4853fa9
Instruction ID: 09ffbdab82ec37572f887b99dacbb52c2b0f0e611b046f90b79d7d5144d34ad0
Opcode Fuzzy Hash: 19629521603088c3ae0ff31b346f27896a38450fa52ce0534014cec9b4853fa9
Instruction Fuzzy Hash: 68C13371618305AFD700DF24C884E2AB7E9BF89348F008A2DF98A9B251DB71ED15CB52

Function 002D10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,002D0038,?,?), ref: 002D10BC

Strings

HKCU, xrefs: 002D11AC
HKLM, xrefs: 002D113A
HKEY_CURRENT_USER, xrefs: 002D119B
HKU, xrefs: 002D11CE
HKCC, xrefs: 002D118A
HKEY_CLASSES_ROOT, xrefs: 002D114F
HKEY_LOCAL_MACHINE, xrefs: 002D1125
HKEY_CURRENT_CONFIG, xrefs: 002D1179
HKCR, xrefs: 002D1164
HKEY_USERS, xrefs: 002D11BD

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: a42108a6b18bdd85dd301230aa26e8c43d6b33add18eaeb308001df2e5f817f4
Instruction ID: 6e7662e2a9fd88abbe8b316e2d478210d4e91463b4477fef2b7ae516bc1bc092
Opcode Fuzzy Hash: a42108a6b18bdd85dd301230aa26e8c43d6b33add18eaeb308001df2e5f817f4
Instruction Fuzzy Hash: BF416A3016125AEBCF25EF90D8A5AEB3724EF19300F108456FC955B792DB71AD3ACB60

Function 002B5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Part of subcall function 00257A84: _memmove.LIBCMT ref: 00257B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 002B55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 002B55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 002B55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 002B560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 002B561C

Strings

status PlayMe mode, xrefs: 002B55CD
open , xrefs: 002B5581
play PlayMe, xrefs: 002B5617
play PlayMe wait, xrefs: 002B5606
alias PlayMe, xrefs: 002B55AB
close PlayMe, xrefs: 002B55E3, 002B5610

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: b03bf0602b98cdedc90bc2d8a72e29f49592cf379ba31b9e981c61cc7ddbaaea
Instruction ID: ad8b4aeb8d47ee673bc1f91f69f9eb8eeec8a9adf42660ff5d96306f26324110
Opcode Fuzzy Hash: b03bf0602b98cdedc90bc2d8a72e29f49592cf379ba31b9e981c61cc7ddbaaea
Instruction Fuzzy Hash: 721108209B166979D721F671EC5ADFFBB7CEF95B40F400459B801960C1DEB00D58C9A1

Function 002B48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002B490E
gethostname.WSOCK32(?,00000100), ref: 002B4928
gethostbyname.WSOCK32(?), ref: 002B4935
_wcscpy.LIBCMT ref: 002B495D
_memmove.LIBCMT ref: 002B4970
inet_ntoa.WSOCK32(?), ref: 002B497B
_strcat.LIBCMT ref: 002B4989
_wcscpy.LIBCMT ref: 002B49A0
WSACleanup.WSOCK32 ref: 002B49AE
_wcscpy.LIBCMT ref: 002B49BC

Strings

0.0.0.0, xrefs: 002B4957

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: eb8e31811009e333485c6430ad5195a4a8fdb049092695234a8e3c0af5e38537
Instruction ID: 2813da69e1212e0a4cd587610e670a4fa2d5e118a88e8717f27814b037f3a9d1
Opcode Fuzzy Hash: eb8e31811009e333485c6430ad5195a4a8fdb049092695234a8e3c0af5e38537
Instruction Fuzzy Hash: 3911D231924115ABDB24FB24AD4AEDB77AC9F01750F0481B6F40996092EFB09EA19A62

Function 002B5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 002B521C

Part of subcall function 00270719: timeGetTime.WINMM(?,75C0B400,00260FF9), ref: 0027071D

Sleep.KERNEL32(0000000A), ref: 002B5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 002B526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 002B528E
SetActiveWindow.USER32 ref: 002B52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 002B52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 002B52DA
Sleep.KERNEL32(000000FA), ref: 002B52E5
IsWindow.USER32 ref: 002B52F1
EndDialog.USER32(00000000), ref: 002B5302

Strings

BUTTON, xrefs: 002B5280

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b497d08cf7ed30b8702c871f6fe9d3143b194f27cf7eb27bc71e456c04eea2c6
Instruction ID: d81dd3bfa7ac25ef83dc2a54d9ed38e47fe6ed22950ea2f1eeb7df78f8dde562
Opcode Fuzzy Hash: b497d08cf7ed30b8702c871f6fe9d3143b194f27cf7eb27bc71e456c04eea2c6
Instruction Fuzzy Hash: 53210470516705AFE7425F60FE8DBE53B6EEB093C6F088469F402852B1CBB19C248B65

Function 002BD7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

CoInitialize.OLE32(00000000), ref: 002BD855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 002BD8E8
SHGetDesktopFolder.SHELL32(?), ref: 002BD8FC
CoCreateInstance.OLE32(002E2D7C,00000000,00000001,0030A89C,?), ref: 002BD948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 002BD9B7
CoTaskMemFree.OLE32(?,?), ref: 002BDA0F
_memset.LIBCMT ref: 002BDA4C
SHBrowseForFolderW.SHELL32(?), ref: 002BDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 002BDAAB
CoTaskMemFree.OLE32(00000000), ref: 002BDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 002BDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 002BDAEB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 76a232133cf040507dcaa8a2c641a8f9420e85faf2c12fa8f327ffeed5e85794
Instruction ID: d164649bee3a0b43e5995cab723d7021322a6b1c0cd68db058d83f2970c121c0
Opcode Fuzzy Hash: 76a232133cf040507dcaa8a2c641a8f9420e85faf2c12fa8f327ffeed5e85794
Instruction Fuzzy Hash: 55B11975A10109AFDB04DFA4C888EAEBBB9EF48305B148469E90AEB251DB30ED55CF54

Function 002B052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 002B05A7
SetKeyboardState.USER32(?), ref: 002B0612
GetAsyncKeyState.USER32(000000A0), ref: 002B0632
GetKeyState.USER32(000000A0), ref: 002B0649
GetAsyncKeyState.USER32(000000A1), ref: 002B0678
GetKeyState.USER32(000000A1), ref: 002B0689
GetAsyncKeyState.USER32(00000011), ref: 002B06B5
GetKeyState.USER32(00000011), ref: 002B06C3
GetAsyncKeyState.USER32(00000012), ref: 002B06EC
GetKeyState.USER32(00000012), ref: 002B06FA
GetAsyncKeyState.USER32(0000005B), ref: 002B0723
GetKeyState.USER32(0000005B), ref: 002B0731

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fc0a4a8eec429f9a03c5cb97456fa99d648e9ca7bad8c20e3d4c44cd01ef4c13
Instruction ID: 9ccb25d06aa19a034308cdc30d4bed959189d8675f85305dc7609bb7131be1b2
Opcode Fuzzy Hash: fc0a4a8eec429f9a03c5cb97456fa99d648e9ca7bad8c20e3d4c44cd01ef4c13
Instruction Fuzzy Hash: D2510A20A1478919FB36DFA084947EFFFB4AF013C0F48459AC5C2565C2DA64ABACCF65

Function 002AC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 002AC746
GetWindowRect.USER32(00000000,?), ref: 002AC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 002AC7B6
GetDlgItem.USER32(?,00000002), ref: 002AC7C1
GetWindowRect.USER32(00000000,?), ref: 002AC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 002AC827
GetDlgItem.USER32(?,000003E9), ref: 002AC835
GetWindowRect.USER32(00000000,?), ref: 002AC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 002AC889
GetDlgItem.USER32(?,000003EA), ref: 002AC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 002AC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 002AC8C1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f899a1b9cd995a0f180a9a1eab12f9bad8dc4befda5d358e302ed5c71d4b608c
Instruction ID: 5711b7f6851562cc88b959f0d7bdb560873499f86bd68c1e61d51d1aff7ae833
Opcode Fuzzy Hash: f899a1b9cd995a0f180a9a1eab12f9bad8dc4befda5d358e302ed5c71d4b608c
Instruction Fuzzy Hash: CF513F71F10205AFDB18CF69DD89AAEBBBAFB89310F24812DF516D6690DB709D008B54

Function 0025201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00251B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00252036,?,00000000,?,?,?,?,002516CB,00000000,?), ref: 00251B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 002520D3
KillTimer.USER32(-00000001,?,?,?,?,002516CB,00000000,?,?,00251AE2,?,?), ref: 0025216E
DestroyAcceleratorTable.USER32(00000000), ref: 0028BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002516CB,00000000,?,?,00251AE2,?,?), ref: 0028BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002516CB,00000000,?,?,00251AE2,?,?), ref: 0028BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,002516CB,00000000,?,?,00251AE2,?,?), ref: 0028BF5A
DeleteObject.GDI32(00000000), ref: 0028BF6C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: eb57ce9a7d88cc8cb2a669337527c24c34b2004ce84840fc3f489dc48d3cfa94
Instruction ID: d6e1598f9604d78c2023fae2df7094822abb78304fba74bd795a3b6dd5cba9ec
Opcode Fuzzy Hash: eb57ce9a7d88cc8cb2a669337527c24c34b2004ce84840fc3f489dc48d3cfa94
Instruction Fuzzy Hash: D461BB34522601DFCB36AF14DD49B6AB7F1FB65312F10842DE942869E1C771ACA9CF88

Function 002521A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 002525DB: GetWindowLongW.USER32(?,000000EB), ref: 002525EC

GetSysColor.USER32(0000000F), ref: 002521D3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: d2d57e836c1171c08f8d5acb7c765a66618b273c38cc60eb71867effcb5263a2
Instruction ID: f72b04e7435c6cf2af571cdf03f01e559b310aca90ee96ebb7d770e597e91daa
Opcode Fuzzy Hash: d2d57e836c1171c08f8d5acb7c765a66618b273c38cc60eb71867effcb5263a2
Instruction Fuzzy Hash: E041D535411101DFDB255F28EC88BB93765EB07332F688266FD6ACA1E2C7318C5ADB25

Function 002BAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,002DF910), ref: 002BAB76
GetDriveTypeW.KERNEL32(00000061,0030A620,00000061), ref: 002BAC40
_wcscpy.LIBCMT ref: 002BAC6A

Strings

all, xrefs: 002BAB7C
unknown, xrefs: 002BAC01
cdrom, xrefs: 002BAB92
ramdisk, xrefs: 002BABEA
network, xrefs: 002BABD4
fixed, xrefs: 002BABBE
removable, xrefs: 002BABA8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: a358ced1e74d562b56068a8cbd518ddeea0904a8a4d60a6c6413b583a421acf3
Instruction ID: 74590baa046a09ce68a2127fa0372567fa92e541ff3a15734fdfe97e48df4b73
Opcode Fuzzy Hash: a358ced1e74d562b56068a8cbd518ddeea0904a8a4d60a6c6413b583a421acf3
Instruction Fuzzy Hash: 72519D301283029BC720EF14D891AAFB7A5FF95345F14882AF896572E2DB31DD69CA53

Function 002DC27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

Part of subcall function 00252344: GetCursorPos.USER32(?), ref: 00252357
Part of subcall function 00252344: ScreenToClient.USER32(003167B0,?), ref: 00252374
Part of subcall function 00252344: GetAsyncKeyState.USER32(00000001), ref: 00252399
Part of subcall function 00252344: GetAsyncKeyState.USER32(00000002), ref: 002523A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 002DC2E4
ImageList_EndDrag.COMCTL32 ref: 002DC2EA
ReleaseCapture.USER32 ref: 002DC2F0
SetWindowTextW.USER32(?,00000000), ref: 002DC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 002DC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 002DC48F

Strings

@GUI_DRAGFILE, xrefs: 002DC424
pr1, xrefs: 002DC438
@GUI_DROPID, xrefs: 002DC3E1
pr1, xrefs: 002DC3FD

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$pr1$pr1
API String ID: 1924731296-64955891
Opcode ID: bfa0a276300eec9ee71a32328f9bc7bc7dc7f0ff098d311e442b4a98fa254a7b
Instruction ID: 486fa7567af1564147d3237ff74519a35fea1cc3a3d81322e6416b878060972f
Opcode Fuzzy Hash: bfa0a276300eec9ee71a32328f9bc7bc7dc7f0ff098d311e442b4a98fa254a7b
Instruction Fuzzy Hash: 47519C30614305AFD705EF24C856FAA7BF5EB88311F10852EF9568B2E1CB709969CF52

Function 00259997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 002599C2
__swprintf.LIBCMT ref: 00259A0C
__i64tow.LIBCMT ref: 0028FA0F

Strings

False, xrefs: 0028F9D7
%.15g, xrefs: 00259A06
True, xrefs: 0028F9D0
0x%p, xrefs: 0028F9F1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: e3334dc1e446631d81dab9f3d497ded05305e217a63731486264a186b4db1a94
Instruction ID: 6b0c98ed2799df193d612db7fc12e5100321e34cbc358c38515c36738192532c
Opcode Fuzzy Hash: e3334dc1e446631d81dab9f3d497ded05305e217a63731486264a186b4db1a94
Instruction Fuzzy Hash: 32412475634206EBDB24EF38D942E7A73E8EF05300F20446EE949C7281EA71A865CB12

Function 002D73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D73D9
CreateMenu.USER32 ref: 002D73F4
SetMenu.USER32(?,00000000), ref: 002D7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002D7490
IsMenu.USER32(?), ref: 002D74A6
CreatePopupMenu.USER32 ref: 002D74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002D74DD
DrawMenuBar.USER32 ref: 002D74E5

Strings

0, xrefs: 002D73CF
F, xrefs: 002D74D1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 6a36d6bf955e700c037e56f6061558d6c363d0694da9f3124abfb27e45f62ebe
Instruction ID: 950cda9c4f64cfc763c6e69996bffc5da26ec83473a7d735ae2e0861663d1f74
Opcode Fuzzy Hash: 6a36d6bf955e700c037e56f6061558d6c363d0694da9f3124abfb27e45f62ebe
Instruction Fuzzy Hash: FA416A74A15205EFDB21DF64E949A9ABBB9FF09300F14402AED0697390E734AD20CF50

Function 002D772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 002D77CD
CreateCompatibleDC.GDI32(00000000), ref: 002D77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 002D77E7
SelectObject.GDI32(00000000,00000000), ref: 002D77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 002D77FA
DeleteDC.GDI32(00000000), ref: 002D7803
GetWindowLongW.USER32(?,000000EC), ref: 002D780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 002D7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 002D782D

Strings

static, xrefs: 002D7765

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 49e6cb6f53e2b62107ccd7e0050258103d254faf11a6fad9ab872555a675c995
Instruction ID: 40ef01fde25285bac413508daac4f735368dc384fe11096970f58b772dd64e93
Opcode Fuzzy Hash: 49e6cb6f53e2b62107ccd7e0050258103d254faf11a6fad9ab872555a675c995
Instruction Fuzzy Hash: B931AF31515115ABDF125F64EC09FDA3B69FF09321F114226FA16E21A0D735DC21DBA8

Function 00277040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0027707B

Part of subcall function 00278D68: __getptd_noexit.LIBCMT ref: 00278D68

__gmtime64_s.LIBCMT ref: 00277114
__gmtime64_s.LIBCMT ref: 0027714A
__gmtime64_s.LIBCMT ref: 00277167
__allrem.LIBCMT ref: 002771BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002771D9
__allrem.LIBCMT ref: 002771F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0027720E
__allrem.LIBCMT ref: 00277225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00277243
__invoke_watson.LIBCMT ref: 002772B4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 5c15b071a04684982c83ac902be43b2eb27d6e5eef7a3afa60eb4a519ac108af
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: E971C875A25717ABE714EE79CC41B5AB3A8AF10720F14823AF918D76C1E770DD608BD0

Function 002B2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B2A31
GetMenuItemInfoW.USER32(00316890,000000FF,00000000,00000030), ref: 002B2A92
SetMenuItemInfoW.USER32(00316890,00000004,00000000,00000030), ref: 002B2AC8
Sleep.KERNEL32(000001F4), ref: 002B2ADA
GetMenuItemCount.USER32(?), ref: 002B2B1E
GetMenuItemID.USER32(?,00000000), ref: 002B2B3A
GetMenuItemID.USER32(?,-00000001), ref: 002B2B64
GetMenuItemID.USER32(?,?), ref: 002B2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 002B2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B2C24

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 6a9f3b26cfeeb3316b842bc224c29a237c55d382806275137210fdceb473a8c7
Instruction ID: 13cda8f8e52ab77195554a9aa2eb16e8ba3dc613ed41bd4007a8f7a10e35bc12
Opcode Fuzzy Hash: 6a9f3b26cfeeb3316b842bc224c29a237c55d382806275137210fdceb473a8c7
Instruction Fuzzy Hash: AA61C27092034AEFDB11CF54DD88EFE7BB8EB05388F14455AE84293251DB31AD69DB21

Function 002D7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 002D7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 002D7217
GetWindowLongW.USER32(?,000000F0), ref: 002D723B
_memset.LIBCMT ref: 002D724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002D725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 002D72D6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 7f12104b5585226432d53ce8d975d596271147e5e37c3891dc654cae73743564
Instruction ID: b75e63a3f53fbf0f60c0326cc7abe24390674a22482452f3a8fccb607c22e97b
Opcode Fuzzy Hash: 7f12104b5585226432d53ce8d975d596271147e5e37c3891dc654cae73743564
Instruction Fuzzy Hash: 25619970A00208AFDB11DFA8CC81EEE77F8EB09300F10419AFA15A73A1D774AD51DBA0

Function 002A710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 002A7135
SafeArrayAllocData.OLEAUT32(?), ref: 002A718E
VariantInit.OLEAUT32(?), ref: 002A71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 002A71C0
VariantCopy.OLEAUT32(?,?), ref: 002A7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 002A7227
VariantClear.OLEAUT32(?), ref: 002A723C
SafeArrayDestroyData.OLEAUT32(?), ref: 002A7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 002A7252
VariantClear.OLEAUT32(?), ref: 002A7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 002A726F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 30b932c1c760012d5dcafa9004e33a7c350b2538539eaa4c47ad91c4374493a3
Instruction ID: e6310b87c11a06a6e2ec9a2c193ac74318e3ab45f8fe2cb26b832a9283339f11
Opcode Fuzzy Hash: 30b932c1c760012d5dcafa9004e33a7c350b2538539eaa4c47ad91c4374493a3
Instruction Fuzzy Hash: A7413D35D10219EFCB00DF64DD48AAEBBB8EF49354F00806AFA56A7261CB30AD55CF94

Function 002C86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

CoInitialize.OLE32 ref: 002C8718
CoUninitialize.OLE32 ref: 002C8723
CoCreateInstance.OLE32(?,00000000,00000017,002E2BEC,?), ref: 002C8783
IIDFromString.OLE32(?,?), ref: 002C87F6
VariantInit.OLEAUT32(?), ref: 002C8890
VariantClear.OLEAUT32(?), ref: 002C88F1

Strings

Invalid parameter, xrefs: 002C880F
NULL Pointer assignment, xrefs: 002C87C8
Failed to create object, xrefs: 002C878E, 002C8844

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: cd94cd58307bb1b9ca71589d79f6e77ce9299ef5c016621530778fe253f77466
Instruction ID: f56ca9f7e19e9415d10baff660a279c67c7366652203e4a544e2f543811fc664
Opcode Fuzzy Hash: cd94cd58307bb1b9ca71589d79f6e77ce9299ef5c016621530778fe253f77466
Instruction Fuzzy Hash: 5C61D134628302DFD710DF24C948F6AB7E8AF49714F108A1DF9859B291DB70ED58CB96

Function 002C5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002C5AA6
inet_addr.WSOCK32(?,?,?), ref: 002C5AEB
gethostbyname.WSOCK32(?), ref: 002C5AF7
IcmpCreateFile.IPHLPAPI ref: 002C5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 002C5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 002C5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 002C5C00
WSACleanup.WSOCK32 ref: 002C5C06

Strings

Ping, xrefs: 002C5B29

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 44936e4afe844b1819e87f85063b8b6c9c17595d2edd48fcf54c9a335ebc20ae
Instruction ID: 0017759146c7fc21a3593fe03f97e0181170007e8a20697728cf0f8c6171f1d0
Opcode Fuzzy Hash: 44936e4afe844b1819e87f85063b8b6c9c17595d2edd48fcf54c9a335ebc20ae
Instruction Fuzzy Hash: 2B519D31624B119FD7109F24DC49F2ABBE0EB48314F148A2AF95ADB2A1DB70FC948B05

Function 002BB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002BB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 002BB7B1
GetLastError.KERNEL32 ref: 002BB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 002BB828

Strings

READY, xrefs: 002BB801
READONLY, xrefs: 002BB7F3
UNKNOWN, xrefs: 002BB7E0
NOTREADY, xrefs: 002BB7E7
INVALID, xrefs: 002BB7FA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 60c2e60e19953c94827d57a20d354071cdbfc767728d06e3d0ae0f81e5e0abe1
Instruction ID: b960cfdc2944cc32a5d52ba07582477b648daff59e979afd1f44ed6a17d2f135
Opcode Fuzzy Hash: 60c2e60e19953c94827d57a20d354071cdbfc767728d06e3d0ae0f81e5e0abe1
Instruction Fuzzy Hash: 3F31E635A102059FDB02EF64D889EFEBBB8EF44341F14802AE806D7291DBB19D56DB51

Function 002A9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 002A94F6
GetDlgCtrlID.USER32 ref: 002A9501
GetParent.USER32 ref: 002A951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 002A9520
GetDlgCtrlID.USER32(?), ref: 002A9529
GetParent.USER32(?), ref: 002A9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 002A9548

Strings

ListBox, xrefs: 002A94B3
ComboBox, xrefs: 002A947E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cb4fb88d4eb6e3e62cad343428ac4490284a21d754135fb53350d46a33d06d43
Instruction ID: 72486bf8d6e237addb273b65c1e46a530d46342d544d9a5dcfcefded8a0bc381
Opcode Fuzzy Hash: cb4fb88d4eb6e3e62cad343428ac4490284a21d754135fb53350d46a33d06d43
Instruction Fuzzy Hash: 2021E270D10104ABCF01AF65DC89EFEBB68EF4A300F104126B922972E2DF759929DE60

Function 002A955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 002A95DF
GetDlgCtrlID.USER32 ref: 002A95EA
GetParent.USER32 ref: 002A9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 002A9609
GetDlgCtrlID.USER32(?), ref: 002A9612
GetParent.USER32(?), ref: 002A962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 002A9631

Strings

ListBox, xrefs: 002A959E
ComboBox, xrefs: 002A9569

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ba8b3d0161b6d0e5697b7daf558b7156920bec32f25e0f20c3d96153d7dd7b1b
Instruction ID: 38a358b22a9724a62f58f542cb013c33debe403d36f7c0492850441c2a17ed17
Opcode Fuzzy Hash: ba8b3d0161b6d0e5697b7daf558b7156920bec32f25e0f20c3d96153d7dd7b1b
Instruction Fuzzy Hash: E621D670D11204BBDF01AB61DC95EFEBBB8EF49300F104056F922972E2DB759969DE24

Function 002A9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 002A9651
GetClassNameW.USER32(00000000,?,00000100), ref: 002A9666
_wcscmp.LIBCMT ref: 002A9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 002A96F3

Strings

list, xrefs: 002A96D5
smallicons, xrefs: 002A96BB
largeicons, xrefs: 002A9687
SHELLDLL_DefView, xrefs: 002A9672
details, xrefs: 002A96A1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: f08c1b75ce1c0912194016ec80047ea68431ba1fdf9bc2006061568af938cff8
Instruction ID: 5dc6f78c39442675c69705221ead86dcfad2a7b0a831262d469f1a1fce921852
Opcode Fuzzy Hash: f08c1b75ce1c0912194016ec80047ea68431ba1fdf9bc2006061568af938cff8
Instruction Fuzzy Hash: 521120775653077BFA012622DC1BEE6779C8F07B60F204017F905A50D2FEA199B05D58

Function 002B4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 002B419D
__swprintf.LIBCMT ref: 002B41AA

Part of subcall function 002738D8: __woutput_l.LIBCMT ref: 00273931

FindResourceW.KERNEL32(?,?,0000000E), ref: 002B41D4
LoadResource.KERNEL32(?,00000000), ref: 002B41E0
LockResource.KERNEL32(00000000), ref: 002B41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 002B420D
LoadResource.KERNEL32(?,00000000), ref: 002B421F
SizeofResource.KERNEL32(?,00000000), ref: 002B422E
LockResource.KERNEL32(?), ref: 002B423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 002B429B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 3dc4746c51aefbd54d5fadc730bb87e7ae9ec286cc90897d74cfed21acdef9dd
Instruction ID: 8d7211d8d048629662fea1b3d44ac535171cb1869fcfed01285abb396549d042
Opcode Fuzzy Hash: 3dc4746c51aefbd54d5fadc730bb87e7ae9ec286cc90897d74cfed21acdef9dd
Instruction Fuzzy Hash: C631B271A1520AABDB01AF60ED88EFF7BADEF08341F048526FC06D6151D770DE619BA4

Function 002B16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002B1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,002B0778,?,00000001), ref: 002B1714
GetWindowThreadProcessId.USER32(00000000), ref: 002B171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,002B0778,?,00000001), ref: 002B172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 002B173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,002B0778,?,00000001), ref: 002B1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,002B0778,?,00000001), ref: 002B1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,002B0778,?,00000001), ref: 002B17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,002B0778,?,00000001), ref: 002B17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,002B0778,?,00000001), ref: 002B17CC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: b648db3a0f0f422eaeec80864b480e6826bc29f06b389a858cf21cbdc3ff6921
Instruction ID: b3a53d07db42ce46709828f84bf3211b9adc4e5611798b8e4157621e8ac41087
Opcode Fuzzy Hash: b648db3a0f0f422eaeec80864b480e6826bc29f06b389a858cf21cbdc3ff6921
Instruction Fuzzy Hash: CF31E371610205BBEB129F10ED98FFAB7FEEB09791F548065F801C72A0DB709D609B90

Function 002C9428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C947C
VariantInit.OLEAUT32(?), ref: 002C954D
VariantInit.OLEAUT32(?), ref: 002C964E
VariantClear.OLEAUT32(?), ref: 002C9658
VariantClear.OLEAUT32(?), ref: 002C96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 002C9631
,,., xrefs: 002C94FA
Null Object assignment in FOR..IN loop, xrefs: 002C94DD, 002C960B, 002C96C3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,.$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-1389923024
Opcode ID: c58a62be5f9b4943e9da4ee65548b37b242727aa84727698a3914a69992fcc67
Instruction ID: 798b5e861839e959aa470d1f865a71487ad9bab56dbf90dad50642247edb3c90
Opcode Fuzzy Hash: c58a62be5f9b4943e9da4ee65548b37b242727aa84727698a3914a69992fcc67
Instruction Fuzzy Hash: 8691C171A20215AFDF24DFA5D848FAEB7B8EF45710F10825DF509AB280D7709995CFA0

Function 002AA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,002AAA64), ref: 002AA9A2

Strings

CLASS, xrefs: 002AA721
INSTANCE, xrefs: 002AA8B0
CLASSNN, xrefs: 002AA744
NAME, xrefs: 002AA7D4
REGEXPCLASS, xrefs: 002AA767
TEXT, xrefs: 002AA8D9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 5503ad19a84047d7c1cf05850c42564c576bef10ccc851bf9004ca54a14b6f9a
Instruction ID: 4b32a42455300b33a21664b1baf700e7e26b95617ea1ba62f1347c8ea132417c
Opcode Fuzzy Hash: 5503ad19a84047d7c1cf05850c42564c576bef10ccc851bf9004ca54a14b6f9a
Instruction Fuzzy Hash: C9917230A20607EBDB58DF60C491BEEFB75BF05314F10811AD89AA7191DF306A69DF91

Function 00252E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00252EAE

Part of subcall function 00251DB3: GetClientRect.USER32(?,?), ref: 00251DDC
Part of subcall function 00251DB3: GetWindowRect.USER32(?,?), ref: 00251E1D
Part of subcall function 00251DB3: ScreenToClient.USER32(?,?), ref: 00251E45

GetDC.USER32 ref: 0028CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0028CF95
SelectObject.GDI32(00000000,00000000), ref: 0028CFA3
SelectObject.GDI32(00000000,00000000), ref: 0028CFB8
ReleaseDC.USER32(?,00000000), ref: 0028CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0028D04B

Strings

U, xrefs: 0028CF20

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 4e068ca2aa077f246fe691bb75d028807e3d99e878f87356d53979cef9afd8c9
Instruction ID: 0428de61e2f1d20dbacc984c7cfb55fbe022897f4491835a3f623b7bb63bdbab
Opcode Fuzzy Hash: 4e068ca2aa077f246fe691bb75d028807e3d99e878f87356d53979cef9afd8c9
Instruction Fuzzy Hash: C3712534421206DFCF219F64C885AFA3BB5FF09311F24826AEE555A2E6C7319C69DF60

Function 002C8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,002DF910), ref: 002C903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,002DF910), ref: 002C9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 002C91EB
SysFreeString.OLEAUT32(?), ref: 002C9215

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 9087aa67415b4af7bec004fe1952240a031a7a4e49ea44714f5c09287c3aa199
Instruction ID: 46fc82cd81ac1ff39df3fdb15f208ba24254e1209730bbedc067bf5ff91fb082
Opcode Fuzzy Hash: 9087aa67415b4af7bec004fe1952240a031a7a4e49ea44714f5c09287c3aa199
Instruction Fuzzy Hash: 93F13A71A1010AEFDB04DF94C888FAEB7B9FF49314F148199F916AB250CB71AE95CB50

Function 002CF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002CFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 002CFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002CFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 002CFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 002CFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 002CFD90
CloseHandle.KERNEL32(?), ref: 002CFDBF
CloseHandle.KERNEL32(?), ref: 002CFE36

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 63fbc75051da357e6bc18cde8ecff74de5d1e86aa27fe45cb8edc7110316aa3c
Instruction ID: 5e3d3ea1da95bfcac1a020cb5c73a3ebbb5598f75e2dd3f302dd55e441b255d1
Opcode Fuzzy Hash: 63fbc75051da357e6bc18cde8ecff74de5d1e86aa27fe45cb8edc7110316aa3c
Instruction Fuzzy Hash: 9EE1B131224241DFCB54EF24C591F6ABBE1AF85354F14856DF89A8B2A2CB31EC64CF52

Function 002B4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002B48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002B38D3,?), ref: 002B48C7

Part of subcall function 002B48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002B38D3,?), ref: 002B48E0

Part of subcall function 002B4CD3: GetFileAttributesW.KERNEL32(?,002B3947), ref: 002B4CD4

lstrcmpiW.KERNEL32(?,?), ref: 002B4FE2
_wcscmp.LIBCMT ref: 002B4FFC
MoveFileW.KERNEL32(?,?), ref: 002B5017

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: ea31503da19924a99b7f322b4245275cbc46381242f8a488acd992ff06e30e35
Instruction ID: afcfbcd7f5b32b8046214f990f67052a9206baf92a196f469a820866fdfaa533
Opcode Fuzzy Hash: ea31503da19924a99b7f322b4245275cbc46381242f8a488acd992ff06e30e35
Instruction Fuzzy Hash: D55196B24183859BC724EF64D881ADFB3ECAF84341F00492EF589D7152EF70A59C8B66

Function 002D88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 002D896E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f66a661372a15ae2f63350d0a7b22e77945fba00a0298d7e8ce2b8d8f6d46da8
Instruction ID: b44d03297507ef648bff2aca13d75c96fd6fcf32f2c697d0dfd30f36378404e9
Opcode Fuzzy Hash: f66a661372a15ae2f63350d0a7b22e77945fba00a0298d7e8ce2b8d8f6d46da8
Instruction Fuzzy Hash: 4D51A230620209BFEB209F28DC89BA97B65FF05310F604117F915E67E1DFB1ADA49B81

Function 00252B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0028C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0028C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0028C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0028C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0028C5C0
DestroyIcon.USER32(00000000), ref: 0028C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0028C5EC
DestroyIcon.USER32(?), ref: 0028C5FB

Part of subcall function 002DA71E: DeleteObject.GDI32(00000000), ref: 002DA757

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 96f13bcdc073e3a6c7e9dfcb202590afbbd11dd89deff1f76ffaf6db37407b2f
Instruction ID: 435578f4e7cc295d4d88f08a1677e061021855964b8751353c8b18eb48ed2e9f
Opcode Fuzzy Hash: 96f13bcdc073e3a6c7e9dfcb202590afbbd11dd89deff1f76ffaf6db37407b2f
Instruction Fuzzy Hash: 89519C74A21205EFDB20DF24DC45FAA77B9EB49311F104529F902A72D0D770EDA4DB64

Function 002A8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,002A8A84,00000B00,?,?), ref: 002A8E0C
HeapAlloc.KERNEL32(00000000,?,002A8A84,00000B00,?,?), ref: 002A8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,002A8A84,00000B00,?,?), ref: 002A8E28
GetCurrentProcess.KERNEL32(?,00000000,?,002A8A84,00000B00,?,?), ref: 002A8E30
DuplicateHandle.KERNEL32(00000000,?,002A8A84,00000B00,?,?), ref: 002A8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,002A8A84,00000B00,?,?), ref: 002A8E43
GetCurrentProcess.KERNEL32(002A8A84,00000000,?,002A8A84,00000B00,?,?), ref: 002A8E4B
DuplicateHandle.KERNEL32(00000000,?,002A8A84,00000B00,?,?), ref: 002A8E4E
CreateThread.KERNEL32(00000000,00000000,002A8E74,00000000,00000000,00000000), ref: 002A8E68

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: eeacc33af349bd5cb5123532800ba1ecb8a59bdce470b06e3250df380411573a
Instruction ID: efb55a5da28d01dbe68725038553452ce280791dbb61dbce2a7e8b3de9c8e7ba
Opcode Fuzzy Hash: eeacc33af349bd5cb5123532800ba1ecb8a59bdce470b06e3250df380411573a
Instruction Fuzzy Hash: 5901A8B5641348FFE650ABA5ED4DF6B3BACEB89711F004421FA09DB1A1CA70DC008A24

Function 002C9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 002A7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?,?,002A799D), ref: 002A766F
Part of subcall function 002A7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?), ref: 002A768A
Part of subcall function 002A7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?), ref: 002A7698
Part of subcall function 002A7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?), ref: 002A76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 002C9B1B
_memset.LIBCMT ref: 002C9B28
_memset.LIBCMT ref: 002C9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 002C9C97
CoTaskMemFree.OLE32(?), ref: 002C9CA2

Strings

NULL Pointer assignment, xrefs: 002C9CF0

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 71ee4bb43d4a01a0490b4304b4ef7c97e07a353fbd8e097f8682437afbdd8665
Instruction ID: 5b0dc707c65c9bbef5a70958ca74ff5dc295d15ff38272845c0c58d852c6d5b6
Opcode Fuzzy Hash: 71ee4bb43d4a01a0490b4304b4ef7c97e07a353fbd8e097f8682437afbdd8665
Instruction Fuzzy Hash: C3913971D10229EBDB10DFA4DC84EDEBBB9BF08710F20415AF51AA7281DB719A54CFA0

Function 002D6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 002D7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 002D70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 002D70C1
_wcscat.LIBCMT ref: 002D711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 002D7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 002D7161

Strings

SysListView32, xrefs: 002D7065

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: de923962f1407e3ed9589bfd57b60dbd6cb56b2bc100e3f8fcc609cece18a9e2
Instruction ID: 20397cfd25cd7e29150aa70b3b565737578b7155f034db513ccf45d33f2d255f
Opcode Fuzzy Hash: de923962f1407e3ed9589bfd57b60dbd6cb56b2bc100e3f8fcc609cece18a9e2
Instruction Fuzzy Hash: 8D41C270914309AFDB219FA4CC85BEE77A8EF08350F10452BF549E72D1E7759D948B50

Function 002CEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 002B3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 002B3EB6
Part of subcall function 002B3E91: Process32FirstW.KERNEL32(00000000,?), ref: 002B3EC4
Part of subcall function 002B3E91: CloseHandle.KERNEL32(00000000), ref: 002B3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 002CECB8
GetLastError.KERNEL32 ref: 002CECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 002CECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 002CED77
GetLastError.KERNEL32(00000000), ref: 002CED82
CloseHandle.KERNEL32(00000000), ref: 002CEDB7

Strings

SeDebugPrivilege, xrefs: 002CECD6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 646f6682d20b3fd97b80300af0d9140bcf9c9713a48d1485c85630312f4dd4ad
Instruction ID: a411ee201f9a2eb3002d2b28cc63b35c984b27076e154cf4500eb31150a6f5ed
Opcode Fuzzy Hash: 646f6682d20b3fd97b80300af0d9140bcf9c9713a48d1485c85630312f4dd4ad
Instruction Fuzzy Hash: C341BB302202019FCB14EF24C899F6EB7A4AF40710F19805DF8439B2C2CBB5A964CF96

Function 002B3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 002B32C5

Strings

info, xrefs: 002B3266
question, xrefs: 002B327E
blank, xrefs: 002B3247
warning, xrefs: 002B32AE
stop, xrefs: 002B3296

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: f7b9e57fcebd06fc2a1e20b65e6ce11cac874430537255718bf61974a5dd551f
Instruction ID: e03672de4c35841d8d34c1ffbf7ea2d8ca4b8ed26b53594c22ee7f4e74fe1011
Opcode Fuzzy Hash: f7b9e57fcebd06fc2a1e20b65e6ce11cac874430537255718bf61974a5dd551f
Instruction Fuzzy Hash: CB115732269357BAEB01DE54EC52DEAB3DCDF193B0F20402AFD04A61C1E6B15F200AA5

Function 002B4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 002B454E
LoadStringW.USER32(00000000), ref: 002B4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 002B456B
LoadStringW.USER32(00000000), ref: 002B4572
_wprintf.LIBCMT ref: 002B4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 002B45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 002B4593

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 576575313dfd6d084e284daca6103795ca6833b94850eef3b9cdbb629a661677
Instruction ID: d5dfa3fb7a3dfcd179d53213f33077782e178917b9b51310ae32ea10a969032e
Opcode Fuzzy Hash: 576575313dfd6d084e284daca6103795ca6833b94850eef3b9cdbb629a661677
Instruction Fuzzy Hash: C901A7F2801208BFE751EB94DE8DEE7736CD708300F4044A6B70AD2051E6709E848B74

Function 002DD74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

GetSystemMetrics.USER32(0000000F), ref: 002DD78A
GetSystemMetrics.USER32(0000000F), ref: 002DD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 002DD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 002DDA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 002DDA24
ShowWindow.USER32(00000003,00000000), ref: 002DDA43
InvalidateRect.USER32(?,00000000,00000001), ref: 002DDA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 002DDA8B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 7d3ba6b71bf9312653ceb6d8e237f1a9f99516a1493e647a2ea50f4de62b6994
Instruction ID: 9dddf7881452be3a75ce2cd4df0c601511ba3383bdbba489f5011b476087f81d
Opcode Fuzzy Hash: 7d3ba6b71bf9312653ceb6d8e237f1a9f99516a1493e647a2ea50f4de62b6994
Instruction Fuzzy Hash: 36B18871A00626EFDF14CF68C9997ED7BB1BF08711F08C06AEC499A295D731AD60CB90

Function 00252A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0028C417,00000004,00000000,00000000,00000000), ref: 00252ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0028C417,00000004,00000000,00000000,00000000,000000FF), ref: 00252B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0028C417,00000004,00000000,00000000,00000000), ref: 0028C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0028C417,00000004,00000000,00000000,00000000), ref: 0028C4D6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: fd6413fd42e1ae8799be7b0f7fc92db5cce55cb80fca1e605a5e4dab3d2b26d1
Instruction ID: 96bf6737a7d9e5be8a6931f614b3c8426423660b046dc0b0d41ddad90af3f5d0
Opcode Fuzzy Hash: fd6413fd42e1ae8799be7b0f7fc92db5cce55cb80fca1e605a5e4dab3d2b26d1
Instruction Fuzzy Hash: E2414B34634281DAD7359F289D9C77A7B95AB47306F24C41EE887425E0C77198ADC728

Function 002B7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 002B737F

Part of subcall function 00270FF6: std::exception::exception.LIBCMT ref: 0027102C
Part of subcall function 00270FF6: __CxxThrowException@8.LIBCMT ref: 00271041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 002B73B6
EnterCriticalSection.KERNEL32(?), ref: 002B73D2
_memmove.LIBCMT ref: 002B7420
_memmove.LIBCMT ref: 002B743D
LeaveCriticalSection.KERNEL32(?), ref: 002B744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 002B7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 002B7480

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: acfa41ec92095e41c850b9ce4a690259f17ad11abef9a963c89b6e491170fc82
Instruction ID: 2395ef58438fa9cfb29e973e99fde635f9012d1f77f98a0e9b4b871ccdd4621e
Opcode Fuzzy Hash: acfa41ec92095e41c850b9ce4a690259f17ad11abef9a963c89b6e491170fc82
Instruction Fuzzy Hash: E8317031914205EBCF10DF68DD89AAE7BB8EF45710B1481A6FD04AB246DB309E64CBA4

Function 002D6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002D645A
GetDC.USER32(00000000), ref: 002D6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002D646D
ReleaseDC.USER32(00000000,00000000), ref: 002D6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 002D64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 002D64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,002D9299,?,?,000000FF,00000000,?,000000FF,?), ref: 002D6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 002D6520

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 40ce32acbbd9d975535e2ba4c24b740548e0aaac2e61f9412ebce25f7f0c9d42
Instruction ID: 315633ebffc1f92f80d4ede870c9676ee0373cb3846ba69301fd42071cb235b0
Opcode Fuzzy Hash: 40ce32acbbd9d975535e2ba4c24b740548e0aaac2e61f9412ebce25f7f0c9d42
Instruction Fuzzy Hash: 71319F72601210BFEB118F50ED4AFEA3FADEF0A761F044066FE099A295C6759C51CBA4

Function 002AC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 002AC087
_memcmp.LIBCMT ref: 002AC0A9
_memcmp.LIBCMT ref: 002AC0C1
_memcmp.LIBCMT ref: 002AC0D4
_memcmp.LIBCMT ref: 002AC0EE
_memcmp.LIBCMT ref: 002AC101
_memcmp.LIBCMT ref: 002AC119
_memcmp.LIBCMT ref: 002AC134

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 369d7758186d3598846d7969f6846cc8c4ccb822eaa9353e4e04dafd659a1b41
Instruction ID: e869bdfac74a911832646fa1883c0b20c51b572765356d39fd7fc110cef7fd8a
Opcode Fuzzy Hash: 369d7758186d3598846d7969f6846cc8c4ccb822eaa9353e4e04dafd659a1b41
Instruction Fuzzy Hash: F821D771771206FBD614AD258C42FBB239DAF23394B644021FE0E96282EF61ED3589A5

Function 002BED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

Part of subcall function 0026FEC6: _wcscpy.LIBCMT ref: 0026FEE9

_wcstok.LIBCMT ref: 002BEEFF
_wcscpy.LIBCMT ref: 002BEF8E
_memset.LIBCMT ref: 002BEFC1

Strings

X, xrefs: 002BEFFE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 4609c4e4b98d1fdb476701004b266842cfee62874d6b86ef106f3bf7b1223126
Instruction ID: 1642c36c475bcb99b691c6adbeed709b71df79b4511ac36f4a62967f5dadad43
Opcode Fuzzy Hash: 4609c4e4b98d1fdb476701004b266842cfee62874d6b86ef106f3bf7b1223126
Instruction Fuzzy Hash: E3C1A131528301DFC754EF24D981AAAB7E4BF84350F04492DF899972A2DB30EC69CF86

Function 00251424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70985f45726e4715720a1e33baa1dfee8a2c1751c987e9e7a210737105a2e3a4
Instruction ID: 5240708308168f39fbdc7903785d10ef1b70133bf18d4a93f80d5f678639144c
Opcode Fuzzy Hash: 70985f45726e4715720a1e33baa1dfee8a2c1751c987e9e7a210737105a2e3a4
Instruction Fuzzy Hash: 4A717C34920109EFCB059F98CC49ABEBB79FF85311F148149F915AA291C730AA25CFA8

Function 002C6E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2844ea16ae51c172c3ea483a9fb37035db53d7be860aef390c09f121906c85
Instruction ID: 137545d7dcf0d326e0b959c51c91682083dc0b55a0729d61724610c2751faa72
Opcode Fuzzy Hash: ab2844ea16ae51c172c3ea483a9fb37035db53d7be860aef390c09f121906c85
Instruction Fuzzy Hash: 6B61CD31528300ABD710EF24CC86F6FB3E9AF84714F104A1DF94697292DB70AD28CB96

Function 002DB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01016978), ref: 002DB6A5
IsWindowEnabled.USER32(01016978), ref: 002DB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 002DB795
SendMessageW.USER32(01016978,000000B0,?,?), ref: 002DB7CC
IsDlgButtonChecked.USER32(?,?), ref: 002DB809
GetWindowLongW.USER32(01016978,000000EC), ref: 002DB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 002DB843

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 3818b1b868f5b78e5b12f793979e2d26f5150ea5ef5a9860c984d9da9bab4473
Instruction ID: 16cf35970032ab308975bd4cadc078e6de34686dd5badecf279b80a3f7aaf4f3
Opcode Fuzzy Hash: 3818b1b868f5b78e5b12f793979e2d26f5150ea5ef5a9860c984d9da9bab4473
Instruction Fuzzy Hash: 7771B335A10205EFEB269F64C8A5FAAB7B9FF49300F16405AE956973A1C731EC60CF50

Function 002CF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002CF75C
_memset.LIBCMT ref: 002CF825
ShellExecuteExW.SHELL32(?), ref: 002CF86A

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

Part of subcall function 0026FEC6: _wcscpy.LIBCMT ref: 0026FEE9

GetProcessId.KERNEL32(00000000), ref: 002CF8E1
CloseHandle.KERNEL32(00000000), ref: 002CF910

Strings

@, xrefs: 002CF839

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 4a9fa55c32a9a37c7b583be0670f78f560f0fe6fc355c15717a67d02da05fb1e
Instruction ID: d4da1fb3ccb8194145e51ea17d4831b8f6ea9fd3cade579fa2943c4d035491a6
Opcode Fuzzy Hash: 4a9fa55c32a9a37c7b583be0670f78f560f0fe6fc355c15717a67d02da05fb1e
Instruction Fuzzy Hash: E2618C75A20619DFCF14DF54C980AAEBBB5FF48310B14856DE84AAB351CB30AD64CF94

Function 002B145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 002B149C
GetKeyboardState.USER32(?), ref: 002B14B1
SetKeyboardState.USER32(?), ref: 002B1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 002B1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 002B155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 002B15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 002B15C8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 48c96f72bf52eb1bfc8a2808205f2a2f2c56b18db50809c74c8d20931ced30b6
Instruction ID: 3aabeb5156f40aed353231c8928d6fc8950b18fed12d1a071e0a643df9a64af3
Opcode Fuzzy Hash: 48c96f72bf52eb1bfc8a2808205f2a2f2c56b18db50809c74c8d20931ced30b6
Instruction Fuzzy Hash: 065104A0A243D63DFB364A348C65BFABFA95B46384F8C4489E1D6468C2C3D4ECB4D750

Function 002B1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 002B12B5
GetKeyboardState.USER32(?), ref: 002B12CA
SetKeyboardState.USER32(?), ref: 002B132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 002B1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 002B1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 002B13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 002B13D9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cfe1965dc2349d6df31d6297a5e4a3734bf394ca8e01d12cb2d2e393273e7857
Instruction ID: 9faf3d09a2ab050a4c4d18a9ddcfae81f9fa4595e4b5299f976aa3cfc43f7ef8
Opcode Fuzzy Hash: cfe1965dc2349d6df31d6297a5e4a3734bf394ca8e01d12cb2d2e393273e7857
Instruction Fuzzy Hash: 755107A09246D63DFB324B248C65BFABFE95F06380F4884C9E1D5468C2E795ECB4D750

Function 002B589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 002B58AC
_wcsncpy.LIBCMT ref: 002B58E1
_wcsncpy.LIBCMT ref: 002B5913
_wcsncpy.LIBCMT ref: 002B5946
_wcsncpy.LIBCMT ref: 002B5988
_wcsncpy.LIBCMT ref: 002B59C2
_wcsncpy.LIBCMT ref: 002B59F1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 10854718d11eae27fc2e8a0e63f44e7fb1c073ddca10505cbff7c71cbb4ecb50
Instruction ID: 8a67c1ba2692740b9c7cfe1a754ad1e4b16f8eaf743bca6b39f119c6944195d0
Opcode Fuzzy Hash: 10854718d11eae27fc2e8a0e63f44e7fb1c073ddca10505cbff7c71cbb4ecb50
Instruction Fuzzy Hash: 19414365C31528B6CB11FBB4888AACFB7AC9F05310F50C956F918E3122E734E765CBA5

Function 002ADA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 002ADAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 002ADAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 002ADB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 002ADB8E

Strings

DllGetClassObject, xrefs: 002ADB01
,,., xrefs: 002ADA69

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,.$DllGetClassObject
API String ID: 753597075-1173203973
Opcode ID: 56c41b0511ea225c1575c0733d7569da24d01221bbcdeae50a090ffeb18fe56d
Instruction ID: 36fba968a482084780136bcffdfafb83d6dff7815710482693c8c3508f4dc089
Opcode Fuzzy Hash: 56c41b0511ea225c1575c0733d7569da24d01221bbcdeae50a090ffeb18fe56d
Instruction Fuzzy Hash: D541C2B1611209EFDB05CF14C884B9ABBB9EF45714F1584AAED0A9F205DBB0DE50CBA0

Function 002B38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002B48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,002B38D3,?), ref: 002B48C7

Part of subcall function 002B48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,002B38D3,?), ref: 002B48E0

lstrcmpiW.KERNEL32(?,?), ref: 002B38F3
_wcscmp.LIBCMT ref: 002B390F
MoveFileW.KERNEL32(?,?), ref: 002B3927
_wcscat.LIBCMT ref: 002B396F
SHFileOperationW.SHELL32(?), ref: 002B39DB

Strings

\*.*, xrefs: 002B3969

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 47086f6a8e7c4655ad4cf65765fba36cef88d37c841ae03d1c83b633e3d047ff
Instruction ID: 10f46a3ec90b9a1a6d5450205d8e5858f2334bdc2338d315142a8e57ced0d0ef
Opcode Fuzzy Hash: 47086f6a8e7c4655ad4cf65765fba36cef88d37c841ae03d1c83b633e3d047ff
Instruction Fuzzy Hash: 5A41B1724193859EC751EF64D485AEFB7ECAF88380F00482EF48AC3151EA74D69CCB52

Function 002D7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002D7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002D75C0
IsMenu.USER32(?), ref: 002D75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002D7620
DrawMenuBar.USER32 ref: 002D7633

Strings

0, xrefs: 002D750D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 2b26fea46e641f21aef621bef7a95fc618ef76edb94efcaa8e75a970e8d61333
Instruction ID: 9a67f9a4708d501d8b74ea48873195fab4bc346ad7dd295dc554f5fb292d5536
Opcode Fuzzy Hash: 2b26fea46e641f21aef621bef7a95fc618ef76edb94efcaa8e75a970e8d61333
Instruction Fuzzy Hash: 5A413875A15609EFDB10DF54E884E9ABBF8FB08310F44812AE96597390E735ED60CF90

Function 002D122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 002D125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002D1286
FreeLibrary.KERNEL32(00000000), ref: 002D133D

Part of subcall function 002D122D: RegCloseKey.ADVAPI32(?), ref: 002D12A3
Part of subcall function 002D122D: FreeLibrary.KERNEL32(?), ref: 002D12F5
Part of subcall function 002D122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 002D1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 002D12E0

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 9d0940f007455697683dedf3133adf23347930df38099a39e2da3a71b8a74bb8
Instruction ID: 00799c89d05b146387213038cdd2e6c4d8ac0a5113d05f3c2b1c4c690d4fc42f
Opcode Fuzzy Hash: 9d0940f007455697683dedf3133adf23347930df38099a39e2da3a71b8a74bb8
Instruction Fuzzy Hash: 05314D71D11119BFDB549F90EC89EFEB7BCEF08300F0041AAE902E2641DB749E659AA4

Function 002D653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 002D655B
GetWindowLongW.USER32(01016978,000000F0), ref: 002D658E
GetWindowLongW.USER32(01016978,000000F0), ref: 002D65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 002D65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 002D661F
GetWindowLongW.USER32(00000000,000000F0), ref: 002D6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 002D664A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: fc35ce94569b9a7c76b366a448b82fccd28cff92da06fc923de8792db224012d
Instruction ID: c457e11a6337c56c4e31f4d56f85a50a29eb6d2dec27f739abf5c2c5ad34e607
Opcode Fuzzy Hash: fc35ce94569b9a7c76b366a448b82fccd28cff92da06fc923de8792db224012d
Instruction Fuzzy Hash: 9C310330615151AFDB21CF58EC89F5537E9FB4A310F5841AAF5128B3B5CB62ECA0DB81

Function 002C6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002C80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 002C80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 002C64D9
WSAGetLastError.WSOCK32(00000000), ref: 002C64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 002C6521
connect.WSOCK32(00000000,?,00000010), ref: 002C652A
WSAGetLastError.WSOCK32 ref: 002C6534
closesocket.WSOCK32(00000000), ref: 002C655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 002C6576

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: a7cd3c5c75bb85c01fe2de06180526007a4c831078e6740abc0f751feab70c02
Instruction ID: 4d6a4ae671626e1b33e734dcb617559b85496a190b3f52de0d4692968f8455ad
Opcode Fuzzy Hash: a7cd3c5c75bb85c01fe2de06180526007a4c831078e6740abc0f751feab70c02
Instruction Fuzzy Hash: 7C31A131620118AFDB209F24DC89FBE7BA9EB44751F14812EFD0AD7291CB70AD54CB65

Function 002AE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002AE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 002AE120
SysAllocString.OLEAUT32(00000000), ref: 002AE123
SysAllocString.OLEAUT32 ref: 002AE144
SysFreeString.OLEAUT32 ref: 002AE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 002AE167
SysAllocString.OLEAUT32(?), ref: 002AE175

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a670060d3a566bd9aeddf3ac3f5470310d3e7f8ac428b7b3cceaeee6d7ffcd66
Instruction ID: db80818a0fa59f7a16cbf38ad3f76c1ed8abc8783e768013e440a26cc91ef7a7
Opcode Fuzzy Hash: a670060d3a566bd9aeddf3ac3f5470310d3e7f8ac428b7b3cceaeee6d7ffcd66
Instruction Fuzzy Hash: 6321B831611119AFDF50AFA8DC89CAB77ECEB0A760B018135F919CB260DE70DC528B64

Function 002D783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00251D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00251D73
Part of subcall function 00251D35: GetStockObject.GDI32(00000011), ref: 00251D87
Part of subcall function 00251D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00251D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 002D78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 002D78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 002D78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 002D78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 002D78D4

Strings

Msctls_Progress32, xrefs: 002D7872

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 999d1f0a7ea84694e06c9a3924780fe28bfb81f65c6482df19d964b07e7f5c19
Instruction ID: 3cc00b4234cbb3a66041b31a2d357771da5c0be80797d4629a857b83eb611c65
Opcode Fuzzy Hash: 999d1f0a7ea84694e06c9a3924780fe28bfb81f65c6482df19d964b07e7f5c19
Instruction Fuzzy Hash: 5611C4B252021ABFEF159F60CC85EE77F6DEF08798F014115FA04A2190DB729C21EBA4

Function 002741C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00274292,?), ref: 002741E3
GetProcAddress.KERNEL32(00000000), ref: 002741EA
EncodePointer.KERNEL32(00000000), ref: 002741F6
DecodePointer.KERNEL32(00000001,00274292,?), ref: 00274213

Strings

combase.dll, xrefs: 002741DE
RoInitialize, xrefs: 002741D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 1464a5235dacabfacfbd6682bdb707e30c0daa13b3fe6094c88b2642cfb7129f
Instruction ID: 78725638dcacff2a52d5cc1d3ef0e6f73a1350facca5d52cfec4e041e72cb46d
Opcode Fuzzy Hash: 1464a5235dacabfacfbd6682bdb707e30c0daa13b3fe6094c88b2642cfb7129f
Instruction Fuzzy Hash: 36E092B09A1341BEDB512F71FC0CB443698B716702F40C434B916D50A0D7B044A58F04

Function 0027429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,002741B8), ref: 002742B8
GetProcAddress.KERNEL32(00000000), ref: 002742BF
EncodePointer.KERNEL32(00000000), ref: 002742CA
DecodePointer.KERNEL32(002741B8), ref: 002742E5

Strings

combase.dll, xrefs: 002742B3
RoUninitialize, xrefs: 002742A7

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 7a2f65ab8b7f7c71f5841f2d4277c362e0242a46c54cf1ca40b9b098bd955c43
Instruction ID: 4220917fca544df38bcb316994ca504ccbf66b13e0c92ee2353822bf47c9ac09
Opcode Fuzzy Hash: 7a2f65ab8b7f7c71f5841f2d4277c362e0242a46c54cf1ca40b9b098bd955c43
Instruction Fuzzy Hash: 85E0BF78992341FBEB929F61FD0DB443BA8B718742F548076F516E10A0CBB44974CA18

Function 002B675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002B68AD
_memmove.LIBCMT ref: 002B67E8

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

_memmove.LIBCMT ref: 002B685B
_memmove.LIBCMT ref: 002B6942
_memmove.LIBCMT ref: 002B695B
_memmove.LIBCMT ref: 002B6977

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: e327b8897fd19e936d1eee5e2f0421ae7c7c5f06ec1c6915e15c0605240b16d7
Instruction ID: ac3910ec5da70d1e7e313f96641d64990e2c4d661bc474c99cdcbd1e3d073a43
Opcode Fuzzy Hash: e327b8897fd19e936d1eee5e2f0421ae7c7c5f06ec1c6915e15c0605240b16d7
Instruction Fuzzy Hash: A761AC3052065A9FDF11EF24CC86EFE77A4AF04348F088559FC5A5B292DB38A969CF50

Function 002D046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002D10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002D0038,?,?), ref: 002D10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002D0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002D0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 002D05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 002D05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 002D0617
RegCloseKey.ADVAPI32(00000000), ref: 002D0624

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 0be282eeeff8fd4a6ceec394110738936859e56ea2c0a7fbf207d8170d72a5a9
Instruction ID: dacbe72984dff2aedb86fad38f45c267108b6aa508a088cb434aa1cf60f9214a
Opcode Fuzzy Hash: 0be282eeeff8fd4a6ceec394110738936859e56ea2c0a7fbf207d8170d72a5a9
Instruction Fuzzy Hash: 19514931528201AFC714EF24D885E6EBBE8FF89314F04891EF945872A1DB71E928CF56

Function 002D5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 002D5A82
GetMenuItemCount.USER32(00000000), ref: 002D5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 002D5AE1
GetMenuItemID.USER32(?,?), ref: 002D5B50
GetSubMenu.USER32(?,?), ref: 002D5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 002D5BAF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 6ce2b6ca222807f1080a40d931b938caa5fbf823e432a50fae181d0117c7567f
Instruction ID: 208a228119e016d0880c281792baaf53624bfb76ff3106a3b34b886a44d6da12
Opcode Fuzzy Hash: 6ce2b6ca222807f1080a40d931b938caa5fbf823e432a50fae181d0117c7567f
Instruction Fuzzy Hash: 7A518E35A10625EFCF11DF64C945AAEB7B4EF48310F14446AEC16BB351CBB0AE518F94

Function 002AF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002AF3F7
VariantClear.OLEAUT32(00000013), ref: 002AF469
VariantClear.OLEAUT32(00000000), ref: 002AF4C4
_memmove.LIBCMT ref: 002AF4EE
VariantClear.OLEAUT32(?), ref: 002AF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 002AF569

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 958cdec2e699725e1a7ee6fa497630b852685fbb0aae523ad53ddb5dc015e46a
Instruction ID: b3da43fd9a1d8d5490e8e782d76cb17832270075613aa820db6255b479e951a2
Opcode Fuzzy Hash: 958cdec2e699725e1a7ee6fa497630b852685fbb0aae523ad53ddb5dc015e46a
Instruction Fuzzy Hash: 175169B5A10209EFDB10CF58D884AAAB7B8FF4D354B15856AEE59DB300D734E911CFA0

Function 002B26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002B2792
IsMenu.USER32(00000000), ref: 002B27B2
CreatePopupMenu.USER32 ref: 002B27E6
GetMenuItemCount.USER32(000000FF), ref: 002B2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 002B2875

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 7cdad829114c939fd546a5d82074906a604b38671ed9626284c4fb097706dbc2
Instruction ID: d60bcd9341ad31f08423887b91e6b029d0bdb8ae5109f7b557153d91e82dace0
Opcode Fuzzy Hash: 7cdad829114c939fd546a5d82074906a604b38671ed9626284c4fb097706dbc2
Instruction Fuzzy Hash: 7051C370920306DFDF25CF68D888BEEBBF5AF44394F144229E4159B290D7709928CB61

Function 00251765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0025179A
GetWindowRect.USER32(?,?), ref: 002517FE
ScreenToClient.USER32(?,?), ref: 0025181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0025182C
EndPaint.USER32(?,?), ref: 00251876

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 01ebd133abad88a03f523feb217e31ef4a396766b1b3047bca7eb10ee1b5febc
Instruction ID: daa15f567833400512cdcef3b83eeed8bd12081a1bed36c8b9ffb0da7d234b12
Opcode Fuzzy Hash: 01ebd133abad88a03f523feb217e31ef4a396766b1b3047bca7eb10ee1b5febc
Instruction Fuzzy Hash: 9241E030511301AFD721EF64CC89FB67BE8EB49325F044629F9A5872A1C7309C69CB65

Function 002DB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(003167B0,00000000,01016978,?,?,003167B0,?,002DB862,?,?), ref: 002DB9CC
EnableWindow.USER32(00000000,00000000), ref: 002DB9F0
ShowWindow.USER32(003167B0,00000000,01016978,?,?,003167B0,?,002DB862,?,?), ref: 002DBA50
ShowWindow.USER32(00000000,00000004,?,002DB862,?,?), ref: 002DBA62
EnableWindow.USER32(00000000,00000001), ref: 002DBA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 002DBAA9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 8d19ec214c2f86cb1ea7771e899cc73b63d40e0bc253ed2d65c69af6e6f556ea
Instruction ID: 275e607117cb4e2ddfb282511cbc7a3d3e9c47e9c112128ffb88da396d125d69
Opcode Fuzzy Hash: 8d19ec214c2f86cb1ea7771e899cc73b63d40e0bc253ed2d65c69af6e6f556ea
Instruction Fuzzy Hash: C6415134601242EFDB22CF14D5A9BD57BE0BB09310F1A41ABEA598F7A2C731AC55CF90

Function 002C73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,002C5134,?,?,00000000,00000001), ref: 002C73BF

Part of subcall function 002C3C94: GetWindowRect.USER32(?,?), ref: 002C3CA7

GetDesktopWindow.USER32 ref: 002C73E9
GetWindowRect.USER32(00000000), ref: 002C73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 002C7422

Part of subcall function 002B54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002B555E

GetCursorPos.USER32(?), ref: 002C744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 002C74AC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: b27f6ba941c27fbe93b54ecd011b8dc24cfb04b267c16952e58c2705a6dd504a
Instruction ID: 7c4e9915335228110870f5df7189bf1ecb54dbe9aa2934d5f3fc1125c159e753
Opcode Fuzzy Hash: b27f6ba941c27fbe93b54ecd011b8dc24cfb04b267c16952e58c2705a6dd504a
Instruction Fuzzy Hash: B331F672509306ABD724DF14E849F9BBBE9FF88314F00091EF48997191C630EE14CB92

Function 002A8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002A8608
Part of subcall function 002A85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002A8612
Part of subcall function 002A85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002A8621
Part of subcall function 002A85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002A8628
Part of subcall function 002A85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002A863E

GetLengthSid.ADVAPI32(?,00000000,002A8977), ref: 002A8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002A8DB8
HeapAlloc.KERNEL32(00000000), ref: 002A8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 002A8DD8
GetProcessHeap.KERNEL32(00000000,00000000,002A8977), ref: 002A8DEC
HeapFree.KERNEL32(00000000), ref: 002A8DF3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: a2a975367c6d97fc5c11d27cc92d8184bf37c85cfd2b48e3d9ca7e5de5a95f9e
Instruction ID: 0c07bbc7bdf6950c19e166de006b0dc2c645aac7dfb9921dd8cc7abd4ff23072
Opcode Fuzzy Hash: a2a975367c6d97fc5c11d27cc92d8184bf37c85cfd2b48e3d9ca7e5de5a95f9e
Instruction Fuzzy Hash: BF11E132921A06FFDB508F64DD08BAE7B69FF42316F10406AE84693250CF319D10CB60

Function 002A8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002A8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 002A8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 002A8B40
CloseHandle.KERNEL32(00000004), ref: 002A8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 002A8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 002A8B8E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 480d3f20842d93a19eb900bbe48e8ebc86c02ef720ad4b8d889015d922733727
Instruction ID: 77a6a4634b0d03459608ede7e13c408f15e3a737d938cff2d89a0c82740ba8bc
Opcode Fuzzy Hash: 480d3f20842d93a19eb900bbe48e8ebc86c02ef720ad4b8d889015d922733727
Instruction Fuzzy Hash: 5D112CB250124AABDF018FA4ED49FEA7BA9EF09308F044465FE05A2160CB759D64DB60

Function 002DC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 002512F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0025134D
Part of subcall function 002512F3: SelectObject.GDI32(?,00000000), ref: 0025135C
Part of subcall function 002512F3: BeginPath.GDI32(?), ref: 00251373
Part of subcall function 002512F3: SelectObject.GDI32(?,00000000), ref: 0025139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 002DC1C4
LineTo.GDI32(00000000,00000003,?), ref: 002DC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 002DC1E6
LineTo.GDI32(00000000,00000000,?), ref: 002DC1F6
EndPath.GDI32(00000000), ref: 002DC206
StrokePath.GDI32(00000000), ref: 002DC216

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 9cb1a2d462c6b87ee537506dbf02211364f6914e697be9941a9d026d5006cd44
Instruction ID: ba82f4a770ccca84566b2ad8a0f2d5114591cd48ccce4e69efe3b934a8ec7bf9
Opcode Fuzzy Hash: 9cb1a2d462c6b87ee537506dbf02211364f6914e697be9941a9d026d5006cd44
Instruction Fuzzy Hash: CF110C7640010DBFDF129F90EC48EDA7FADEB08355F148022BD1956161C7719E55DBA0

Function 002703A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 002703D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 002703DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 002703E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 002703F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 002703F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00270401

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 6b4f097703683ffe54cbce7cee516c31c78cee4b11d62b66a3019bb501dbc2d6
Instruction ID: 5ad20d3ca3b6f2223a3b3cb509e65e079b15f9a2dbdd5fe6d463a9155618187d
Opcode Fuzzy Hash: 6b4f097703683ffe54cbce7cee516c31c78cee4b11d62b66a3019bb501dbc2d6
Instruction Fuzzy Hash: 8B0148B09027597DE3008F5A8C85A52FFA8FF19354F00411BA15847941C7B5A864CBE5

Function 002B568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 002B569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 002B56B1
GetWindowThreadProcessId.USER32(?,?), ref: 002B56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002B56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002B56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 002B56E0

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: caae28fcb469c5966c1376310fc3995ef8162698c8232ee2801e1b2f1c142648
Instruction ID: dd8b62f481cac392259b3d6ac93ea61aca1fcf5686a35ec44b91f77b22251f86
Opcode Fuzzy Hash: caae28fcb469c5966c1376310fc3995ef8162698c8232ee2801e1b2f1c142648
Instruction Fuzzy Hash: D9F09631542158BBD3605B52ED0DEEF7B7CEFC6B11F00016AF905D1050D7A05E0186F9

Function 002B74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 002B74E5
EnterCriticalSection.KERNEL32(?,?,00261044,?,?), ref: 002B74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00261044,?,?), ref: 002B7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00261044,?,?), ref: 002B7510

Part of subcall function 002B6ED7: CloseHandle.KERNEL32(00000000,?,002B751D,?,00261044,?,?), ref: 002B6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 002B7523
LeaveCriticalSection.KERNEL32(?,?,00261044,?,?), ref: 002B752A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: fc76a081231791a7e6621c7979c91d4c43c26832b68be11c1f8ab8a9562f58c3
Instruction ID: 158865ce9a80e7d56380c36b4d6042bd96ffc7106fe0ee23c248f2e7171a2922
Opcode Fuzzy Hash: fc76a081231791a7e6621c7979c91d4c43c26832b68be11c1f8ab8a9562f58c3
Instruction Fuzzy Hash: D5F05E3A942612EBDB512B64FE8CAEB772AEF45302B410532FA43A10B0CB755D11CB64

Function 002A8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 002A8E7F
UnloadUserProfile.USERENV(?,?), ref: 002A8E8B
CloseHandle.KERNEL32(?), ref: 002A8E94
CloseHandle.KERNEL32(?), ref: 002A8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 002A8EA5
HeapFree.KERNEL32(00000000), ref: 002A8EAC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d835e135be6aad7ff31c84b58415485df6a29cd5dad537c2360b155505ee9006
Instruction ID: 2c5f7004c80368be5aaae94cdaa003d7457b9ff3ad298adda50b190ed230e6b5
Opcode Fuzzy Hash: d835e135be6aad7ff31c84b58415485df6a29cd5dad537c2360b155505ee9006
Instruction Fuzzy Hash: 64E0C236505001FBDA812FE5FE0C94ABB69FB89322B108232F21A81170CB329820DB58

Function 002A7A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,002E2C7C,?), ref: 002A7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,002E2C7C,?), ref: 002A7C4A
CLSIDFromProgID.OLE32(?,?,00000000,002DFB80,000000FF,?,00000000,00000800,00000000,?,002E2C7C,?), ref: 002A7C6F
_memcmp.LIBCMT ref: 002A7C90

Strings

,,., xrefs: 002A7A85

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,.
API String ID: 314563124-737214711
Opcode ID: e6329e12a62699ecf5a4f484ed930a5c3ba4b35ee1f2c8ed2b949204983b2e1b
Instruction ID: ea129f003ef386e1aac3d502d8f1e831653e748326dd5e6c06e2f1330ee5df9a
Opcode Fuzzy Hash: e6329e12a62699ecf5a4f484ed930a5c3ba4b35ee1f2c8ed2b949204983b2e1b
Instruction Fuzzy Hash: 93810B71A1010AEFCB04DF94C984EEEB7BAFF89315F204599E506EB250DB71AE05CB64

Function 002C8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002C8928
CharUpperBuffW.USER32(?,?), ref: 002C8A37
VariantClear.OLEAUT32(?), ref: 002C8BAF

Part of subcall function 002B7804: VariantInit.OLEAUT32(00000000), ref: 002B7844
Part of subcall function 002B7804: VariantCopy.OLEAUT32(00000000,?), ref: 002B784D
Part of subcall function 002B7804: VariantClear.OLEAUT32(00000000), ref: 002B7859

Strings

AUTOIT.ERROR, xrefs: 002C8A3D
Incorrect Parameter format, xrefs: 002C8960, 002C8B22

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: acc97dc28eb7d6342811f13acedaa9e656691aed4065e5c5fc2139a71fb87bb8
Instruction ID: 44893924ad05f2d77e250bb03254e8b69a085154e89101104403e1918cb538b3
Opcode Fuzzy Hash: acc97dc28eb7d6342811f13acedaa9e656691aed4065e5c5fc2139a71fb87bb8
Instruction Fuzzy Hash: 33916B75628301DFC710DF24C484E5ABBE4AF89314F148A6EF89A8B361DB31ED59CB52

Function 002B2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0026FEC6: _wcscpy.LIBCMT ref: 0026FEE9

_memset.LIBCMT ref: 002B3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002B30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 002B3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 002B3187

Strings

0, xrefs: 002B3063

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d1f4d0b9cfb9f3fda94f5742a8f0d9e052fa2e7a32bb0de3e6aec72b77b56832
Instruction ID: d811821b312db76b8c4ee93f6f97e54ee1633df768c695cbcd13df2b2b83c3bb
Opcode Fuzzy Hash: d1f4d0b9cfb9f3fda94f5742a8f0d9e052fa2e7a32bb0de3e6aec72b77b56832
Instruction Fuzzy Hash: D051C0316393029AD715EF2CD845AEBB7E8EF453A0F044A2DF899D3191DB70CE648B52

Function 002B2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 002B2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 002B2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00316890,00000000), ref: 002B2D5A

Strings

0, xrefs: 002B2CA4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 0b7540681e32c89e1ddb60029de120dc1b975394365f38502369b4fb4c59c3d8
Instruction ID: 46898d2e58b2c0dca28ceabbd9db4c791af04db7035f8ca458dddd297142f793
Opcode Fuzzy Hash: 0b7540681e32c89e1ddb60029de120dc1b975394365f38502369b4fb4c59c3d8
Instruction Fuzzy Hash: 48419F30215302DFD724DF24D845B9ABBE8BF85360F14461EF9669B291D770E918CBA2

Function 002CDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 002CDAD9

Part of subcall function 002579AB: _memmove.LIBCMT ref: 002579F9

Strings

cdecl, xrefs: 002CDB30
stdcall, xrefs: 002CDB5B
winapi, xrefs: 002CDB4A
none, xrefs: 002CDBB4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: cb4f41a3bd86dd6369af7a56b7aabc26b3adbf17b7a85892727aa9920ad187a9
Instruction ID: fddc7bc4df342f5c586e7e26165c11b80c4262990fe882f61d7dc9499aed0e45
Opcode Fuzzy Hash: cb4f41a3bd86dd6369af7a56b7aabc26b3adbf17b7a85892727aa9920ad187a9
Instruction Fuzzy Hash: 0931737052061A9BCF10EF54CC919AEB3B4FF05314B108629E866976D1DB71AD19CF90

Function 002A9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 002A93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 002A9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 002A9439

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Strings

ListBox, xrefs: 002A93B5
ComboBox, xrefs: 002A9380

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 2f3720750341ac7e9871793ae31b8159825c829dfe47216f22c1a985340a0c19
Instruction ID: f8687998a40aad3410ff258d02546d48ab9e47419bcf1cb4b10fb7ca37dba745
Opcode Fuzzy Hash: 2f3720750341ac7e9871793ae31b8159825c829dfe47216f22c1a985340a0c19
Instruction Fuzzy Hash: 54210471961104ABDB14AB71DC858FFB77CDF06310B10812AF926972E1DF344D6A8A10

Function 002C1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 002C1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002C1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 002C1B96
InternetCloseHandle.WININET(00000000), ref: 002C1BDD

Part of subcall function 002C2777: GetLastError.KERNEL32(?,?,002C1B0B,00000000,00000000,00000001), ref: 002C278C
Part of subcall function 002C2777: SetEvent.KERNEL32(?,?,002C1B0B,00000000,00000000,00000001), ref: 002C27A1

Strings

, xrefs: 002C1B87

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ba7f6fbc647173b46f0ec7428dabe40593359b5d3bc6b72f0c9fb46bf31d8f19
Instruction ID: 01484b1b0e975a8c1b8f7361289499a244cf0935aacff2236fceb20290f6d4ea
Opcode Fuzzy Hash: ba7f6fbc647173b46f0ec7428dabe40593359b5d3bc6b72f0c9fb46bf31d8f19
Instruction Fuzzy Hash: ED21C2B1520208BFEB119F209CC6FBFB7ECEB4A748F10422EF405A2241EB709D255B61

Function 002D6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00251D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00251D73
Part of subcall function 00251D35: GetStockObject.GDI32(00000011), ref: 00251D87
Part of subcall function 00251D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00251D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 002D66D0
LoadLibraryW.KERNEL32(?), ref: 002D66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 002D66EC
DestroyWindow.USER32(?), ref: 002D66F4

Strings

SysAnimate32, xrefs: 002D66AB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: f6a744f89a7dd8b7b1973f377ab4d4a23ac086aacad6589c6201ce429424d041
Instruction ID: 0b6d2250336255244af4da6164eea97a3deb823b2023e9c891132041754ba409
Opcode Fuzzy Hash: f6a744f89a7dd8b7b1973f377ab4d4a23ac086aacad6589c6201ce429424d041
Instruction Fuzzy Hash: 1B21C37112020ABFEF104F64EC88EBB77ADEF59368F10462AF911922D0D775CC619BA0

Function 002B703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 002B705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 002B7091
GetStdHandle.KERNEL32(0000000C), ref: 002B70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 002B70DD

Strings

nul, xrefs: 002B70D8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: a32541537fe262c375c5ee3730ac1b9522a30bb2340919c353c44c0fb6bd1c2e
Instruction ID: efedb0959a2cfc71acdc3fc512e28a8ce40ef313e9de5e23e6d77be6eab7ede5
Opcode Fuzzy Hash: a32541537fe262c375c5ee3730ac1b9522a30bb2340919c353c44c0fb6bd1c2e
Instruction Fuzzy Hash: 642135755143069BDB20AF39DC09ADA77B4BF94760F204A1AFDA1D72D0D7709D60CB50

Function 002B710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 002B712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 002B715D
GetStdHandle.KERNEL32(000000F6), ref: 002B716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 002B71A8

Strings

nul, xrefs: 002B71A3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 8ed8772386aa6caff730afcb963616615eca53501a245e13fa7a7eee6156432a
Instruction ID: a23671b292834c689dae4c1ea5c3b6dd92aba9789daa394b0ea8ccaffd747ac8
Opcode Fuzzy Hash: 8ed8772386aa6caff730afcb963616615eca53501a245e13fa7a7eee6156432a
Instruction Fuzzy Hash: 8621D375524306ABDF209F2C9C08AEAB7E8AF953A0F204619FDB5D32D0D7709861CB70

Function 002BAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 002BAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 002BAF13
__swprintf.LIBCMT ref: 002BAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,002DF910), ref: 002BAF6A

Strings

%lu, xrefs: 002BAF26

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: d0857077b4f28f86b84454e38dc28f13f793aeeb893a9a4a95180ff7fcddc7d2
Instruction ID: 3ae9f65c289e30953d7d71c89a86e4fd674af23cf059eae5bd74d0aba52b2682
Opcode Fuzzy Hash: d0857077b4f28f86b84454e38dc28f13f793aeeb893a9a4a95180ff7fcddc7d2
Instruction Fuzzy Hash: 3A216034A10209AFCB10EF64D985EEE7BB8EF49704B044069F909AB251DB31EE55CF21

Function 002AA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

Part of subcall function 002AA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 002AA399
Part of subcall function 002AA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 002AA3AC
Part of subcall function 002AA37C: GetCurrentThreadId.KERNEL32 ref: 002AA3B3
Part of subcall function 002AA37C: AttachThreadInput.USER32(00000000), ref: 002AA3BA

GetFocus.USER32 ref: 002AA554

Part of subcall function 002AA3C5: GetParent.USER32(?), ref: 002AA3D3

GetClassNameW.USER32(?,?,00000100), ref: 002AA59D
EnumChildWindows.USER32(?,002AA615), ref: 002AA5C5
__swprintf.LIBCMT ref: 002AA5DF

Strings

%s%d, xrefs: 002AA5D9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 41dbec26464dd087f40c06fb005771d9a84adf83ee0357e8ac015c6dbed5dbb7
Instruction ID: 8071595fa2fca6d7cf4716a8585ee0229fc428b25fed0166cad54d584150dcd2
Opcode Fuzzy Hash: 41dbec26464dd087f40c06fb005771d9a84adf83ee0357e8ac015c6dbed5dbb7
Instruction Fuzzy Hash: C1118E71650209ABDF11AF60EC86FEA377C9F4A701F0480B6B909AA152CF709965CF75

Function 002B2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 002B2048

Strings

REMOVE, xrefs: 002B204E
APPEND, xrefs: 002B2081
KEYS, xrefs: 002B205F
EXISTS, xrefs: 002B2070

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 9b1673f9efa338648527c2d9f1b9b13f32b230468024a3edcf370947d5949e57
Instruction ID: 8df06958379327396d097a236da0b7afe860c49ea5347ce1f180cd7f0e114ef4
Opcode Fuzzy Hash: 9b1673f9efa338648527c2d9f1b9b13f32b230468024a3edcf370947d5949e57
Instruction Fuzzy Hash: DB11613492020ADFCF14EFA4D9914EEB7B4FF29304B108869D85567291DB325D2ECF50

Function 002CEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 002CEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 002CEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 002CF07E
CloseHandle.KERNEL32(?), ref: 002CF0FF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: de20e99b6c26062e1d8b5cf69b9d42c49e2f8535c383cae7eef676b9613ebf4d
Instruction ID: 100f11a1c1a778833d7e4bfa4f15ddc17ec56d868356c82cb046b44b7b822244
Opcode Fuzzy Hash: de20e99b6c26062e1d8b5cf69b9d42c49e2f8535c383cae7eef676b9613ebf4d
Instruction Fuzzy Hash: BB8183716203019FD720DF28C846F2AB7E5AF48B10F14891DF99ADB292DBB0EC548F95

Function 002D02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002D10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,002D0038,?,?), ref: 002D10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002D0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002D03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 002D040E
RegCloseKey.ADVAPI32(?,?), ref: 002D043A
RegCloseKey.ADVAPI32(00000000), ref: 002D0447

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: e133fb1f932d88ddc67c8b5bc96b857b4b6e8fd4e2defc6b149490de6450bec0
Instruction ID: 88553ef8172630f427d43e05b7ab6ac8f3a64b8bb87de96c7705989fe88ad6b8
Opcode Fuzzy Hash: e133fb1f932d88ddc67c8b5bc96b857b4b6e8fd4e2defc6b149490de6450bec0
Instruction Fuzzy Hash: FC515E31528205AFD704EF64D885F6EB7E8FF88304F04855EB596872A1DB70ED18CB56

Function 002BE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 002BE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 002BE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 002BE8F2

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 002BE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 002BE91F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: ebf0ca7cd3b02efdb1ab5cdf57634c75075e54e591f62d32ebda02ba963dcd20
Instruction ID: 9536e61db0eafba840604a3d6f954d93771ddecaa6eb15102ae7de53dcfba750
Opcode Fuzzy Hash: ebf0ca7cd3b02efdb1ab5cdf57634c75075e54e591f62d32ebda02ba963dcd20
Instruction Fuzzy Hash: 18512B35A10209DFCF01EF64C9859ADBBF5EF08311B188099E80AAB361CB31ED65CF54

Function 002DA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ae905b4326b198bf9e0b1f210807fc099156cb957078a245cfbdfcb97077a0
Instruction ID: f8f087d20005cc4668f10f6d1edeb048549d1c70dbec7119d1b4aa12ddc52fb3
Opcode Fuzzy Hash: a2ae905b4326b198bf9e0b1f210807fc099156cb957078a245cfbdfcb97077a0
Instruction Fuzzy Hash: 5C412835D21105AFC750DF28DC49FE9BBAAEB09310F1441A7F816A73E0C7B0AD61CA51

Function 00252344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00252357
ScreenToClient.USER32(003167B0,?), ref: 00252374
GetAsyncKeyState.USER32(00000001), ref: 00252399
GetAsyncKeyState.USER32(00000002), ref: 002523A7

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 24321a22f828499be9a53b4e6689cb068978859191c19db6f80e5ba33a0839bc
Instruction ID: 4c5210062f8d87cb0a45679f6f21fc1393b5bd1e84f4e6d2595cddf95bc74cc5
Opcode Fuzzy Hash: 24321a22f828499be9a53b4e6689cb068978859191c19db6f80e5ba33a0839bc
Instruction Fuzzy Hash: 2A41A335524116FBCF159F64C848AE9BB74FB05321F204396FC29922D0C7705D68DFA5

Function 002A6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002A695D
TranslateAcceleratorW.USER32(?,?,?), ref: 002A69A9
TranslateMessage.USER32(?), ref: 002A69D2
DispatchMessageW.USER32(?), ref: 002A69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002A69EB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 8fcd35a4758aa26d984a5846e3615e0f9fe77478cce0bcc1daf66f60a5a45889
Instruction ID: f681994d62f1d8b1d0838d63466cd5e1b6f0b9bac9b5ef3106aaedb3a706dc86
Opcode Fuzzy Hash: 8fcd35a4758aa26d984a5846e3615e0f9fe77478cce0bcc1daf66f60a5a45889
Instruction Fuzzy Hash: 9331E471920247ABDB61CFB49C4DBF77BACAB07300F188569E422C24A1DB70D8A5DB90

Function 002A8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002A8F12
PostMessageW.USER32(?,00000201,00000001), ref: 002A8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 002A8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 002A8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 002A8FDA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 6f8273668e2ee784724f00081c2b08a600d05848076e40f8feea816af1ad1864
Instruction ID: ddf4ebb76fcd184ae1467e5bff046f73b4a2511f6a3719037088dbcc727455bf
Opcode Fuzzy Hash: 6f8273668e2ee784724f00081c2b08a600d05848076e40f8feea816af1ad1864
Instruction Fuzzy Hash: AD31BF7190021AEFDB14CF68D94CA9E7BB6FB05315F104229F925E61D0CBB09D24DB91

Function 002AB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 002AB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 002AB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 002AB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 002AB742
_wcsstr.LIBCMT ref: 002AB74C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: b92ae03744fb35dadcf7c77609e6877e12a2df573ffa33b893c86f66e9070604
Instruction ID: 8d87d937d656d93ff44750698a265e859c073407d1d9856eaf76b58191b85d89
Opcode Fuzzy Hash: b92ae03744fb35dadcf7c77609e6877e12a2df573ffa33b893c86f66e9070604
Instruction Fuzzy Hash: 6921DA32615205BBEB165F399D49E7BBB9CDF46710F00806AFD09CA1A2EFB1DC60D690

Function 002DB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

GetWindowLongW.USER32(?,000000F0), ref: 002DB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 002DB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 002DB489
GetSystemMetrics.USER32(00000004), ref: 002DB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,002C1184,00000000), ref: 002DB4D0

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: b0753836fa42e3b97ef27503cf34d2cc2359ecb495cc29b067058425b04c7b3f
Instruction ID: 55d00a8a49ab1a6668ebcaa7532a24eea33a0946de71a01602f66fa4f40a0648
Opcode Fuzzy Hash: b0753836fa42e3b97ef27503cf34d2cc2359ecb495cc29b067058425b04c7b3f
Instruction Fuzzy Hash: 9C217671920256EFCB11DF789C28A693764FB05721F15873AF926D62E1D7309C20DB90

Function 002A97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 002A9802

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 002A9834
__itow.LIBCMT ref: 002A984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 002A9874
__itow.LIBCMT ref: 002A9885

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: c0deee9af5e5b25cb11bad741915f6b0fd69d018a7494c52ea0fe2961fbef0a1
Instruction ID: 9dff926410ca63baf0086a46c771ad4a43ca6fd2ff412804c8a5c583fb992738
Opcode Fuzzy Hash: c0deee9af5e5b25cb11bad741915f6b0fd69d018a7494c52ea0fe2961fbef0a1
Instruction Fuzzy Hash: 7C210A31B11208AFDB109E669C8AEEE7BACDF4B710F044025FE05DB281DA74CDA59BD1

Function 002512F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0025134D
SelectObject.GDI32(?,00000000), ref: 0025135C
BeginPath.GDI32(?), ref: 00251373
SelectObject.GDI32(?,00000000), ref: 0025139C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 1ab61ac706e9fab05a8c12f04276ffab93bf4e860edd1f48c17353b3019d2ebb
Instruction ID: 40240d0d35668cf275cbb9bd712aa04a03b9c1c587e211b6461927d6dba8d479
Opcode Fuzzy Hash: 1ab61ac706e9fab05a8c12f04276ffab93bf4e860edd1f48c17353b3019d2ebb
Instruction Fuzzy Hash: AD216270C21209EFDB129F69ED097A97BBDFB04322F14C266F811961A0D37198B5DB94

Function 002AC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 002AC176
_memcmp.LIBCMT ref: 002AC194
_memcmp.LIBCMT ref: 002AC1A7
_memcmp.LIBCMT ref: 002AC1BF
_memcmp.LIBCMT ref: 002AC1D7

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c20f755379cffc83432e2b89e420bd302240b31e5f12a0499cf2fa4dbe773d76
Instruction ID: 0e94b2bf6d28922645cf02e84bd263410b029370407bad4f9c7de2245a9149c9
Opcode Fuzzy Hash: c20f755379cffc83432e2b89e420bd302240b31e5f12a0499cf2fa4dbe773d76
Instruction Fuzzy Hash: AB01B9B17791067BD204A9259C42F6B739D9F23394F648015FD0D96243EEA0EE3587E0

Function 002B4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002B4D5C
__beginthreadex.LIBCMT ref: 002B4D7A
MessageBoxW.USER32(?,?,?,?), ref: 002B4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 002B4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 002B4DAC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 57e41b823963afea6cbe587f3b8b70d2dae3c2e55ec1bbbb76a376249c4603af
Instruction ID: 8ded30b0ab7866ccc514a1d859d093034703ffc65d504476d83c9c0500b0185f
Opcode Fuzzy Hash: 57e41b823963afea6cbe587f3b8b70d2dae3c2e55ec1bbbb76a376249c4603af
Instruction Fuzzy Hash: B3114872D15245BFC701AFA8EC48AEA7FACEB49320F14826AF914D3251C6B08D1087A0

Function 002A874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 002A8766
GetLastError.KERNEL32(?,002A822A,?,?,?), ref: 002A8770
GetProcessHeap.KERNEL32(00000008,?,?,002A822A,?,?,?), ref: 002A877F
HeapAlloc.KERNEL32(00000000,?,002A822A,?,?,?), ref: 002A8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 002A879D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 7aa7ac8b66f8c3a9edb1dd99d389a5db21ade5ab5c10447ad4537d82366244f5
Instruction ID: a599d468850c2a508920962cb92bbf8ad2aad23352aa9fd3472e8d68ce496c78
Opcode Fuzzy Hash: 7aa7ac8b66f8c3a9edb1dd99d389a5db21ade5ab5c10447ad4537d82366244f5
Instruction Fuzzy Hash: 2B014B75611205EFDB204FA6ED8CD6BBBACEF8A355720046AF84AC2260DA31CD10CA60

Function 002B54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002B5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 002B5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 002B5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 002B5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002B555E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e0aeea77db566dc4b15b1db0c176181002efb0afd5af9cabea7cc35218b2fec3
Instruction ID: 222430b0b27ab90b247db51f08b57fd3a9b669a9571db7b7bbd0d3ffddc09a74
Opcode Fuzzy Hash: e0aeea77db566dc4b15b1db0c176181002efb0afd5af9cabea7cc35218b2fec3
Instruction Fuzzy Hash: BF015B35C21A29DBDF10EFE8E94C7EDBB78BB09752F400056E806B6140DB309960CBA5

Function 002A7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?,?,002A799D), ref: 002A766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?), ref: 002A768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?), ref: 002A7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?), ref: 002A76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,002A758C,80070057,?,?), ref: 002A76B4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 4b3c95e34ace9dfb473cd90e1e5f700790385a48ac28167775bb210ab3dc1fff
Instruction ID: f825d0fa930cc7d8799030a1a98262796fc06c535ba6a150ebade95bd72da7d5
Opcode Fuzzy Hash: 4b3c95e34ace9dfb473cd90e1e5f700790385a48ac28167775bb210ab3dc1fff
Instruction Fuzzy Hash: C701D4B2A11604BBDB104F58ED08BAA7BECEB85B51F144029FD05D2211EB31DE5097A4

Function 002A85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002A8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002A8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002A8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002A8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002A863E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: ee86d347d6181f2faf88918d8b85da10d6a873cb2277b229cf125ca7b07e2ad8
Instruction ID: 003aa32a80b8f64a226cbef6f2d8df4428c63222a9e496852690e62ea6a74a29
Opcode Fuzzy Hash: ee86d347d6181f2faf88918d8b85da10d6a873cb2277b229cf125ca7b07e2ad8
Instruction Fuzzy Hash: 04F0CD30212215AFEB100FA4EE8DE6B3BACEF8AB55B04402AF90AC3150CF70DC51DA60

Function 002A8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 002A8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 002A8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002A8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 002A8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002A869F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 412f584d9abc9d4c42a49cd4c71fd735b1c7ebbbfbf5406f1b15fff67f6baeb2
Instruction ID: 7d437cc71904fb9dcd65c1eeb623b5f53c9236c091be836cc6c5c8d959124840
Opcode Fuzzy Hash: 412f584d9abc9d4c42a49cd4c71fd735b1c7ebbbfbf5406f1b15fff67f6baeb2
Instruction Fuzzy Hash: F3F0AF70211215AFEB111FA4EC8CE677BACEF8AB55B140026F90AC2150CE70DD50DA60

Function 002AC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 002AC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 002AC6D1
MessageBeep.USER32(00000000), ref: 002AC6E9
KillTimer.USER32(?,0000040A), ref: 002AC705
EndDialog.USER32(?,00000001), ref: 002AC71F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: a392e6c5c7ed412e234cd311f965a486cdff3b23a24884183223b181ac533023
Instruction ID: e203d3250ec207cd9bc22b8ebf71c9172f5551c560278c1f1703bd03509bbae4
Opcode Fuzzy Hash: a392e6c5c7ed412e234cd311f965a486cdff3b23a24884183223b181ac533023
Instruction Fuzzy Hash: 43014F30911704ABEB619F20ED4EB96B7BCBB01B05F14066AB552A18E1DBE0AD648E84

Function 002513B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 002513BF
StrokeAndFillPath.GDI32(?,?,0028BAD8,00000000,?), ref: 002513DB
SelectObject.GDI32(?,00000000), ref: 002513EE
DeleteObject.GDI32 ref: 00251401
StrokePath.GDI32(?), ref: 0025141C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f76c4f9801ef8b60342eb9fb5f045df8806f49f74c562c9aa2e18ed123dfe33e
Instruction ID: f2298e7eddc31d41748596ffd49355cfe434640435bd189ac0aaf3ea92768f9a
Opcode Fuzzy Hash: f76c4f9801ef8b60342eb9fb5f045df8806f49f74c562c9aa2e18ed123dfe33e
Instruction Fuzzy Hash: 03F0E73041530DEBDB525FAAED0D7983FA9AB05327F04C225E82A994F1C73189B9DF58

Function 00262E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00270FF6: std::exception::exception.LIBCMT ref: 0027102C
Part of subcall function 00270FF6: __CxxThrowException@8.LIBCMT ref: 00271041

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 00257BB1: _memmove.LIBCMT ref: 00257C0B

__swprintf.LIBCMT ref: 0026302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00262EC6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 02c2162cc5fcdd7edd90d8d6ee19669d2d1b503ab043fa0c9dde93ef1992c6b3
Instruction ID: a70e910108d2ec3450b9cbadfd9fb0367a42b59e2a29e822d7217b09d7b7b365
Opcode Fuzzy Hash: 02c2162cc5fcdd7edd90d8d6ee19669d2d1b503ab043fa0c9dde93ef1992c6b3
Instruction Fuzzy Hash: 0D918E311283129FCB18EF24D895C6EB7E4EF95750F00491DF846972A1DA70EEA8CB56

Function 002AB7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 002AB981

Strings

Container, xrefs: 002AB8FE
AutoIt3GUI, xrefs: 002AB8F9
%., xrefs: 002ABA24

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%.
API String ID: 3565006973-783795609
Opcode ID: fdadec4ced60bd595b7539b7bbfe251c907412f6ac9c9a912c787698a5cdb992
Instruction ID: e7bbdf36bd1bdcb7c1623646d383756b95ffe03c02b31fbba159abe813b631b1
Opcode Fuzzy Hash: fdadec4ced60bd595b7539b7bbfe251c907412f6ac9c9a912c787698a5cdb992
Instruction Fuzzy Hash: BA913D746202019FDB15CF68C884B66B7E9FF4A710F24856EE949CB6A2DF70E854CB50

Function 0027524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 002752DD

Part of subcall function 00280340: __87except.LIBCMT ref: 0028037B

Strings

pow, xrefs: 002752B5, 002752D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 386b8642baf1349f292a1feda3df57b0fe64d5fb1dee0dc80ace1535e47eb557
Instruction ID: fd1e63a3ca05c95faca90c678f8daf88ad7fb2c9dea8d49226d651466b2ae977
Opcode Fuzzy Hash: 386b8642baf1349f292a1feda3df57b0fe64d5fb1dee0dc80ace1535e47eb557
Instruction Fuzzy Hash: E9519B24E3BA0387D7517F24D98137EA7949B00350F24C999E48D461E6EFF48CF89B41

Function 0027023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00270280
+, xrefs: 00270277

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 124f0f7cc8ecf1fdd2ef3fece5876ec3e04e830814c4b5b70600677e5adc6a8f
Instruction ID: 00883bead3db4598038341ce982b5763e4dd46e4b36f88b50db86c20a22fa692
Opcode Fuzzy Hash: 124f0f7cc8ecf1fdd2ef3fece5876ec3e04e830814c4b5b70600677e5adc6a8f
Instruction Fuzzy Hash: A4515635524A66CFCF15DF28C488AFA7BA4EF16310F144095FC959B2A0DB749C6ACB60

Function 00263297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002633D7
_memmove.LIBCMT ref: 00263470
_free.LIBCMT ref: 00263496
_memmove.LIBCMT ref: 00263549

Strings

Oa&, xrefs: 00263482

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa&
API String ID: 2620147621-711773428
Opcode ID: b01c15491aaa235600ca32f16ce45a54ed8d8378940e18dd837e12b82011bb35
Instruction ID: c1b6e297ba9f518982c99fcb5db8e0539afcd6fdf78a0528f4ef00337702adb5
Opcode Fuzzy Hash: b01c15491aaa235600ca32f16ce45a54ed8d8378940e18dd837e12b82011bb35
Instruction Fuzzy Hash: F5516D719283429FDB24CF28C491B2BBBE5BF89314F44492DE98A87351DB31D961CF82

Function 002662F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002663A8
_memmove.LIBCMT ref: 00266446
_memset.LIBCMT ref: 0026646A

Strings

ERCP, xrefs: 00266313

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 78e5acc1d245390988eaeda15a499a07935ec29cf3684da7a846a6885981f070
Instruction ID: 7350ee9039fe9a3f7e981fc1eaab5cb54193f096809020b2973bcd90cbcf0c65
Opcode Fuzzy Hash: 78e5acc1d245390988eaeda15a499a07935ec29cf3684da7a846a6885981f070
Instruction Fuzzy Hash: DA51B27192030ADBDB24CF65C8957AABBF4FF04714F20856EE94ACB281EB7195A4CB40

Function 002D7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 002D76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 002D76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 002D7708

Strings

SysMonthCal32, xrefs: 002D769B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 4bbe723f77dfdf482709c77d178ea62b3953b17589f2448d8e19fbf37d537b30
Instruction ID: 42a82cd6097c504bc7f68ea82c030264190255c9cfba9fc4edce6dca42a016e5
Opcode Fuzzy Hash: 4bbe723f77dfdf482709c77d178ea62b3953b17589f2448d8e19fbf37d537b30
Instruction Fuzzy Hash: 77219132514219ABDF118E94CC46FEA3B69EF48754F110215FE156B2D0E6B5EC609BA0

Function 002D6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 002D6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 002D6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 002D6FDF

Strings

Listbox, xrefs: 002D6F77

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f02c2d1cc85201461c62a09dac246fd951f3e8afe12b2d4784e7eaed99ab5c68
Instruction ID: bebd0f915a721e990b2518df307d7d25d63bdc2882e4d349b4861b903107b0b7
Opcode Fuzzy Hash: f02c2d1cc85201461c62a09dac246fd951f3e8afe12b2d4784e7eaed99ab5c68
Instruction Fuzzy Hash: E521D732621119BFDF118F54DC89FEB377AEF89750F018125F91597690C671AC61CBA0

Function 002D797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 002D79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 002D79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 002D7A03

Strings

msctls_trackbar32, xrefs: 002D79B8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: b616d507edddbf3a33ca5a4975136d073dffef440810c2058f4d4f272334f3d2
Instruction ID: e5a6339b23acb31ae36dab158c7d6a821f0f29ae31f7aeaa4a1ce6f8e1c3a523
Opcode Fuzzy Hash: b616d507edddbf3a33ca5a4975136d073dffef440810c2058f4d4f272334f3d2
Instruction Fuzzy Hash: 7A112732264209BADF109F60CC05FDB37ADEF89764F02451AFA01A61D0D271DC21CB60

Function 00254C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00254C2E), ref: 00254CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00254CB5

Strings

GetNativeSystemInfo, xrefs: 00254CAF
kernel32.dll, xrefs: 00254C9E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ed6bec537d3a68d3fc7570c7e9d3581d50f7e90c1696bb2672132f690d4e6f09
Instruction ID: 2ee4209af399822c015a5d854bc7cd717774dc062b86daa315b75e00fffa2a56
Opcode Fuzzy Hash: ed6bec537d3a68d3fc7570c7e9d3581d50f7e90c1696bb2672132f690d4e6f09
Instruction Fuzzy Hash: 2BD01230921723CFD7605F31DB18606B6D5AF06756B15883B9C97D6650D770DCD0C658

Function 00254D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00254D2E,?,00254F4F,?,003162F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00254D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00254D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00254D7B
kernel32.dll, xrefs: 00254D6A

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 586d989d6cc1fc741ef4926a5c21b60a329162a2ca25512e18d16989ba549957
Instruction ID: 39228f47d8b9ec3596a235b8e44bd174e84ddf3243661b9797a3a7826ad2c303
Opcode Fuzzy Hash: 586d989d6cc1fc741ef4926a5c21b60a329162a2ca25512e18d16989ba549957
Instruction Fuzzy Hash: A5D0C731922313CFC720AF30E908202B2E8AF05766B10883BD88BC2290E774D8C0CA68

Function 00254D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00254CE1,?), ref: 00254DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00254DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00254DAE
kernel32.dll, xrefs: 00254D9D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: d50797bcb6c91f42da183a57c043a7cc80574cfdc5d750f66c912360350770a3
Instruction ID: 10cb3c8f56b282f75e20a4f52a625036b1a87e22e0ed4110817a81866ae26af2
Opcode Fuzzy Hash: d50797bcb6c91f42da183a57c043a7cc80574cfdc5d750f66c912360350770a3
Instruction Fuzzy Hash: 4BD01231961713CFD7205F31D908646B6E4AF05359B15883BDCD6D6150D774D8D0CA54

Function 002D1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,002D12C1), ref: 002D1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 002D1092

Strings

advapi32.dll, xrefs: 002D107B
RegDeleteKeyExW, xrefs: 002D108C

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 726b09d7f390d0bb3235ce307c114a38b155284289e925c833847aa3fc5d9663
Instruction ID: 5a31520cf7ee21297b47b76ab0bcde5ce1a888d51c2230a67e2d9c7148d07cc6
Opcode Fuzzy Hash: 726b09d7f390d0bb3235ce307c114a38b155284289e925c833847aa3fc5d9663
Instruction Fuzzy Hash: FFD0C230811313DFC3205F30D828556B2E8AF14352B048C3BE8CAC6690D770CCD0C610

Function 002C93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,002C9009,?,002DF910), ref: 002C9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 002C9415

Strings

GetModuleHandleExW, xrefs: 002C940F
kernel32.dll, xrefs: 002C93FE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 1d4b30b7b125c965ba93e4b745fb6199a7f6102a09b9be8bc70bf6cc54f2e130
Instruction ID: 06ac6ee79cf7c4610b92d9aa56ed938e56147386ab3613a241e293ee26904d28
Opcode Fuzzy Hash: 1d4b30b7b125c965ba93e4b745fb6199a7f6102a09b9be8bc70bf6cc54f2e130
Instruction Fuzzy Hash: B7D0E234925713CFD7209F31EA0CA4676E5AF05351B15C83EA89AE6690E670C8D08A60

Function 00291B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00291B42
__swprintf.LIBCMT ref: 00291B73

Strings

%.3d, xrefs: 00291B4D
WIN_XPe, xrefs: 00291BB2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 66f6d877283f3ef49be724ce11c3a028ebe550155181d1b8619d5c2229252ce4
Instruction ID: 92d830ae9a553943f370321f2a27abe2522214a4764b91ce08b677d27945663b
Opcode Fuzzy Hash: 66f6d877283f3ef49be724ce11c3a028ebe550155181d1b8619d5c2229252ce4
Instruction Fuzzy Hash: 17D0C271C3420AEACF049A92DC648F9737DAB08305F100192F80291040F2B08BB4AB25

Function 002A76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f70dedeaf50ff2409d2c06a6da3f4c078c3d8cb03d974fa6f8cef23b1b8378
Instruction ID: f18274e11e59b3812b8df86ec01f55baafff0f06d6ce52255c3b270009347955
Opcode Fuzzy Hash: f9f70dedeaf50ff2409d2c06a6da3f4c078c3d8cb03d974fa6f8cef23b1b8378
Instruction Fuzzy Hash: F6C18B75A14216EFDB14CF94CC84EAEB7B9FF49310B108599E806EB251DB30EE91CB94

Function 002CE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 002CE3D2
CharLowerBuffW.USER32(?,?), ref: 002CE415

Part of subcall function 002CDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 002CDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 002CE615
_memmove.LIBCMT ref: 002CE628

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 0b46c0b0512105147c3feb31bd35b4c71944a5489005affbdb44194ecddebaa2
Instruction ID: f7c982802d7d723a21065fb6c6e0f7c8045da0bdd15cc228485939aa4d906837
Opcode Fuzzy Hash: 0b46c0b0512105147c3feb31bd35b4c71944a5489005affbdb44194ecddebaa2
Instruction Fuzzy Hash: 52C15A716283019FCB14DF28C480A6ABBE4FF88318F158A6DF8999B351D731E955CF82

Function 002C83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002C83D8
CoUninitialize.OLE32 ref: 002C83E3

Part of subcall function 002ADA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 002ADAC5

VariantInit.OLEAUT32(?), ref: 002C83EE
VariantClear.OLEAUT32(?), ref: 002C86BF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 1ef4b570c4710e752946711cf050731e764ff58cd4a01ace16decb9c2a6a54cd
Instruction ID: 74d3c827a0e325a507fe8288cd6dde25891d554799ec6fc338bceab307b693ab
Opcode Fuzzy Hash: 1ef4b570c4710e752946711cf050731e764ff58cd4a01ace16decb9c2a6a54cd
Instruction Fuzzy Hash: 11A114752247029FCB10DF14C485B2AB7E4BF88354F18854DF99A9B3A1CB70ED64CB96

Function 002A6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002A6E04
SysAllocString.OLEAUT32(00000000), ref: 002A6EAD
VariantCopy.OLEAUT32 ref: 002A6EDC
VariantClear.OLEAUT32(?), ref: 002A6F03

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 1988a2f541c43613088d1607eca7842b0348df5d31d602c4349ba0564ecc2486
Instruction ID: fbb082e1df1d5b1812b0073b1ef98441d3a40282fe4ba199fe10a2fb9f7d8aab
Opcode Fuzzy Hash: 1988a2f541c43613088d1607eca7842b0348df5d31d602c4349ba0564ecc2486
Instruction Fuzzy Hash: 2051E930634302DFDB30AF65D895B2AB3E4AF4A310F24881FE556CB691DF7098A49F09

Function 002D9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0101EBB0,?), ref: 002D9AD2
ScreenToClient.USER32(00000002,00000002), ref: 002D9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 002D9B72

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 5d3e86f40f8097ab040152313fd78d2255c161061f25a6c39b0d3f2a65f78efd
Instruction ID: 10ebdb62bcb2ac6b5671e9b3a796456c26c0481f589b1eee714fa18157814dac
Opcode Fuzzy Hash: 5d3e86f40f8097ab040152313fd78d2255c161061f25a6c39b0d3f2a65f78efd
Instruction Fuzzy Hash: 63514D35A10209EFCF10DF58E881AAE7BB9FB44324F11815BF8159B390D730AD91CB90

Function 002C6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 002C6CE4
WSAGetLastError.WSOCK32(00000000), ref: 002C6CF4

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 002C6D58
WSAGetLastError.WSOCK32(00000000), ref: 002C6D64

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 946d3885ea9cf1ad2c21e23dadf2097f56ed14686673cde44408dbc98de725d7
Instruction ID: ba767c4886474f82afdc9b3ea26515b57431ea99de4558cc7e4c5e640dde27f2
Opcode Fuzzy Hash: 946d3885ea9cf1ad2c21e23dadf2097f56ed14686673cde44408dbc98de725d7
Instruction Fuzzy Hash: 9D41D434750200AFEB10AF24DC8BF3A77E59B04B10F54811CFE1AAB2C2DBB19D508B95

Function 002C672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,002DF910), ref: 002C67BA
_strlen.LIBCMT ref: 002C67EC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 1f3336e3c7dc9e07adcf6f50520a35208b254823a12dc52cec28ec77e555c625
Instruction ID: f1daf20024e64862cf9b2f2f926e79f2362db5e3941a45cf96a3c0945c17080b
Opcode Fuzzy Hash: 1f3336e3c7dc9e07adcf6f50520a35208b254823a12dc52cec28ec77e555c625
Instruction Fuzzy Hash: 8741EB31920104AFCB14EB64DCD5FADB3A8EF44310F148269F91A97292DF30AD68CF55

Function 002BBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 002BBB09
GetLastError.KERNEL32(?,00000000), ref: 002BBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 002BBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 002BBB80

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 9f4bba0b4ea41bcc6c2d3fccb36fe415f2d528cb9cf277e8edca2dd0956f5ebf
Instruction ID: 0ec16685e338039c65ddda209822e569374083692f4d37194f5b20e1152dab88
Opcode Fuzzy Hash: 9f4bba0b4ea41bcc6c2d3fccb36fe415f2d528cb9cf277e8edca2dd0956f5ebf
Instruction Fuzzy Hash: 5D414339610611DFCB11EF14C588A5DBBE1AF89321B198089EC8A9B362CB70FD64CF95

Function 002D8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002D8B4D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 539d9314d01557f564f6ae45bca0c7ebedc526ebc36dd0e711e31810789e07a2
Instruction ID: b6bd1893729b23f10f99f5f49e4018dafc729d8fe45e8590e779da51be207f5a
Opcode Fuzzy Hash: 539d9314d01557f564f6ae45bca0c7ebedc526ebc36dd0e711e31810789e07a2
Instruction Fuzzy Hash: E431E4B4620205BFEF219F58DC45FA937A8EB09318F648917FA52D63E0DE70AD60CB51

Function 002DADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 002DAE1A
GetWindowRect.USER32(?,?), ref: 002DAE90
PtInRect.USER32(?,?,002DC304), ref: 002DAEA0
MessageBeep.USER32(00000000), ref: 002DAF11

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a5f0921905b78b0853d302972c6427d379e6316795e03a9c85b28c76315765c7
Instruction ID: 4cce45f98ca9a099007957e2f33b8dcffed7f08a775192679e78a407036ceee3
Opcode Fuzzy Hash: a5f0921905b78b0853d302972c6427d379e6316795e03a9c85b28c76315765c7
Instruction Fuzzy Hash: 46416A70A1111A9FCB11CF58D885FA97BF5FB88340F1481BAE8159B351D731ED11DB92

Function 002B0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 002B1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 002B1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 002B10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 002B110B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f174229552de80ee41531278a87affe54d83eeff8720e532762b29ce117c3953
Instruction ID: 1a46d080ab61bf78773b2f55160b11786049df5ce925da510093052cde7a24c6
Opcode Fuzzy Hash: f174229552de80ee41531278a87affe54d83eeff8720e532762b29ce117c3953
Instruction Fuzzy Hash: 8F319C30E70689AEFF309F298C197FABBA9AF44390F84462AEC91421D0C3748DF49751

Function 002B1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 002B1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 002B1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 002B11F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 002B1243

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 975b192b549689d55146ce2b1b830cf9fcec7a78bf56a2e63ca0b2bf638e6670
Instruction ID: 70863b69bd2c127246203bdbcf0d4d30de3ca36cbda6215099f9dc334b8d54e0
Opcode Fuzzy Hash: 975b192b549689d55146ce2b1b830cf9fcec7a78bf56a2e63ca0b2bf638e6670
Instruction Fuzzy Hash: 76316830D702195AEF208E698C297FABBBAAB49390F88431BE685921D1C3748DB49751

Function 00286415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0028644B
__isleadbyte_l.LIBCMT ref: 00286479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002864A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 002864DD

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 1602a41fcd51b3824dc8b280009b9907b81adcea484c968e0e6bcb7d02f71fee
Instruction ID: 99954c5e04bb028f259694bf1676451de642bd2956de769542f23f9ff6647688
Opcode Fuzzy Hash: 1602a41fcd51b3824dc8b280009b9907b81adcea484c968e0e6bcb7d02f71fee
Instruction Fuzzy Hash: 5931D039612247AFDB31AF64C849BAF7BA5FF40320F194029E855871D1E731D860DB90

Function 002D5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 002D5189

Part of subcall function 002B387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 002B3897
Part of subcall function 002B387D: GetCurrentThreadId.KERNEL32 ref: 002B389E
Part of subcall function 002B387D: AttachThreadInput.USER32(00000000,?,002B52A7), ref: 002B38A5

GetCaretPos.USER32(?), ref: 002D519A
ClientToScreen.USER32(00000000,?), ref: 002D51D5
GetForegroundWindow.USER32 ref: 002D51DB

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e3e490b113e6caa2e90d66da856bb61d049640db4ddbee76a17ed97ae03c3254
Instruction ID: c59c5f8a92cb7481ad67204dc88da5a9532a8a9673508c218465a48b17611094
Opcode Fuzzy Hash: e3e490b113e6caa2e90d66da856bb61d049640db4ddbee76a17ed97ae03c3254
Instruction Fuzzy Hash: 02311871910108ABDB00EFA5C985AEFB7F9EF98300F10446AE816E7241EA759E55CFA4

Function 002DC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

GetCursorPos.USER32(?), ref: 002DC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0028BBFB,?,?,?,?,?), ref: 002DC7D7
GetCursorPos.USER32(?), ref: 002DC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0028BBFB,?,?,?), ref: 002DC85E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: fe6d8b958ac3a4fad6561eca8f6b7e30051ec0d19318737c9426ad93587a0fd9
Instruction ID: 86dea8411a312fb26cdd1577d5139b8befc1b62306fb14d8d171e87a7d92869d
Opcode Fuzzy Hash: fe6d8b958ac3a4fad6561eca8f6b7e30051ec0d19318737c9426ad93587a0fd9
Instruction Fuzzy Hash: 9B31B635610019EFCB16CF98D898EEA7BBAEB09310F54406AF906CB261C7315D60EF64

Function 002A8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002A8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 002A8669
Part of subcall function 002A8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 002A8673
Part of subcall function 002A8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002A8682
Part of subcall function 002A8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 002A8689
Part of subcall function 002A8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 002A869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002A8BEB
_memcmp.LIBCMT ref: 002A8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002A8C44
HeapFree.KERNEL32(00000000), ref: 002A8C4B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 438445206e7f179a2249b78b97226f1423b1023baabd49fcc390f96878926b54
Instruction ID: b496db1313e6a2475e79951b454cfb510800b617bd1b8368aaa169d78297a84f
Opcode Fuzzy Hash: 438445206e7f179a2249b78b97226f1423b1023baabd49fcc390f96878926b54
Instruction Fuzzy Hash: 64218B71E12209EBDB04DFA4C948BAEB7B9EF41355F04409AE455A7240DB30AE16CF60

Function 00270BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00270BF2

Part of subcall function 00255B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,002B7B20,?,?,00000000), ref: 00255B8C
Part of subcall function 00255B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,002B7B20,?,?,00000000,?,?), ref: 00255BB0

_fprintf.LIBCMT ref: 00270C29
OutputDebugStringW.KERNEL32(?), ref: 002A6331

Part of subcall function 00274CDA: _flsall.LIBCMT ref: 00274CF3

__setmode.LIBCMT ref: 00270C5E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 19780cedf203f68308a994b3340d9dcaa13ca49a5612b085fcdd745df5ebd3ac
Instruction ID: 97c3a91b66e57e452aebb8ad6a983188c7e0568be10179c7e018787af5a996d5
Opcode Fuzzy Hash: 19780cedf203f68308a994b3340d9dcaa13ca49a5612b085fcdd745df5ebd3ac
Instruction Fuzzy Hash: DA115732924208ABCB05B7B49C879BEBB6C9F41320F14815AF20857181DF700DBA8B95

Function 002C1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 002C1A97

Part of subcall function 002C1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 002C1B40
Part of subcall function 002C1B21: InternetCloseHandle.WININET(00000000), ref: 002C1BDD

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 82bc369a4240a0de02e5b341b8025513eacda1a5545e7b65109ea91af60d2043
Instruction ID: 30816c634c01c199a2ca9d911f354c7ffdfa66e379904e8c9014236595fbb415
Opcode Fuzzy Hash: 82bc369a4240a0de02e5b341b8025513eacda1a5545e7b65109ea91af60d2043
Instruction Fuzzy Hash: 4521CF31211601BFEB129F608C06FBAB7A9FF45700F14021EFA0696652EB71E834DBA4

Function 002AE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002AF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,002AE1C4,?,?,?,002AEFB7,00000000,000000EF,00000119,?,?), ref: 002AF5BC
Part of subcall function 002AF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 002AF5E2
Part of subcall function 002AF5AD: lstrcmpiW.KERNEL32(00000000,?,002AE1C4,?,?,?,002AEFB7,00000000,000000EF,00000119,?,?), ref: 002AF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,002AEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 002AE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 002AE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,002AEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 002AE237

Strings

cdecl, xrefs: 002AE22E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a07d2ab5451d9cd0ce9170bbe358ff43c83a516b1337ab0b9c1dce18f852d47b
Instruction ID: f4d452a8c1626396258521e3a4037ed6eb87b4c33b780869e30b9f88ff13bc35
Opcode Fuzzy Hash: a07d2ab5451d9cd0ce9170bbe358ff43c83a516b1337ab0b9c1dce18f852d47b
Instruction Fuzzy Hash: 91118436110345EFCF25AF64D849A7A77A8FF46350B41802AE806C7250EF71D9619BA4

Function 00285332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00285351

Part of subcall function 0027594C: __FF_MSGBANNER.LIBCMT ref: 00275963
Part of subcall function 0027594C: __NMSG_WRITE.LIBCMT ref: 0027596A
Part of subcall function 0027594C: RtlAllocateHeap.NTDLL(01000000,00000000,00000001,00000000,?,?,?,00271013,?), ref: 0027598F

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7089e2a406229220fd648bd7ca0d3b439750eee1a1db5886828866d2f525e204
Instruction ID: 7c6b4d6e8f32194740c087222169e2ec1a9fec06c3830430b8d888881084421e
Opcode Fuzzy Hash: 7089e2a406229220fd648bd7ca0d3b439750eee1a1db5886828866d2f525e204
Instruction Fuzzy Hash: 3E112732926A26EFCB313F70EC4865D37985F143E0F1084AAF9099A0D0DFB08D709B90

Function 00254531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00254560

Part of subcall function 0025410D: _memset.LIBCMT ref: 0025418D
Part of subcall function 0025410D: _wcscpy.LIBCMT ref: 002541E1
Part of subcall function 0025410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 002541F1

KillTimer.USER32(?,00000001,?,?), ref: 002545B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 002545C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0028D6CE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: ce9460d9236bf073fea2c481c2404b204a2ddb7c1c38bc8c7a73c5bdf310d20f
Instruction ID: c797c817e25b92756f841c920d8ce38e4497dd403e783495f1c4e4bc78b57e70
Opcode Fuzzy Hash: ce9460d9236bf073fea2c481c2404b204a2ddb7c1c38bc8c7a73c5bdf310d20f
Instruction Fuzzy Hash: A42128749153989FE7329B20A845BE7FBEC9F11308F00009EE68E561C1D7B41A988B45

Function 002B40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 002B40D1
_memset.LIBCMT ref: 002B40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 002B4144
CloseHandle.KERNEL32(00000000), ref: 002B414D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 97d197e06290d6f917fed6d62fba421d8b25dcd6a242774ce080abb821b974f4
Instruction ID: ac602ce7236210e979d9dc74cbc75550ad3345704cecb6e65b3807dae5d5a652
Opcode Fuzzy Hash: 97d197e06290d6f917fed6d62fba421d8b25dcd6a242774ce080abb821b974f4
Instruction Fuzzy Hash: BF11AB75D112287AD730ABA5AC4DFEBBB7CEF44760F104596F908D7180D6744F808BA4

Function 002C667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00255B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,002B7B20,?,?,00000000), ref: 00255B8C
Part of subcall function 00255B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,002B7B20,?,?,00000000,?,?), ref: 00255BB0

gethostbyname.WSOCK32(?,?,?), ref: 002C66AC
WSAGetLastError.WSOCK32(00000000), ref: 002C66B7
_memmove.LIBCMT ref: 002C66E4
inet_ntoa.WSOCK32(?), ref: 002C66EF

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 7af2cc43d6929d7bb77d068c95df47e5b724d28f63eeadd7c129b951273ee3c2
Instruction ID: 99ed2f98127db0bb04bddb757073a5e5dcd32cd430e86cba6f42807c6fb1cb9f
Opcode Fuzzy Hash: 7af2cc43d6929d7bb77d068c95df47e5b724d28f63eeadd7c129b951273ee3c2
Instruction Fuzzy Hash: DF119335920108AFCB00EBA4DD9ADEEB7B8AF04311B144129F906A7261DF309F28DF55

Function 002A9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 002A9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 002A9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 002A906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 002A9086

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c899876cac3befe7f091f5074c231d3e2521e3ef1601a25702fb7313437f00ae
Instruction ID: fa8d8390852bebb4f2f80949ff695d59d7cad8bb7ef9f68b9091f43bf9c9d0ba
Opcode Fuzzy Hash: c899876cac3befe7f091f5074c231d3e2521e3ef1601a25702fb7313437f00ae
Instruction Fuzzy Hash: 98115E79901218FFDB10DFA5CD84E9DBB78FB48350F204095E904B7290DA726E50DB94

Function 00251290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00252612: GetWindowLongW.USER32(?,000000EB), ref: 00252623

DefDlgProcW.USER32(?,00000020,?), ref: 002512D8
GetClientRect.USER32(?,?), ref: 0028B84B
GetCursorPos.USER32(?), ref: 0028B855
ScreenToClient.USER32(?,?), ref: 0028B860

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 40a530516d2a31c301ca8b042bb7644d4375d4ef8fb84d32d2be956038307384
Instruction ID: dd00455f48d8c5ae98d12b27c6036271cfc1d4d0787a4d02821322a98161beac
Opcode Fuzzy Hash: 40a530516d2a31c301ca8b042bb7644d4375d4ef8fb84d32d2be956038307384
Instruction Fuzzy Hash: F7112B35911029BFCB00DF94D989AFE77B8EB05305F404456FD11E7150C730AA65CBA9

Function 002B1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,002B01FD,?,002B1250,?,00008000), ref: 002B166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,002B01FD,?,002B1250,?,00008000), ref: 002B1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,002B01FD,?,002B1250,?,00008000), ref: 002B169E
Sleep.KERNEL32(?,?,?,?,?,?,?,002B01FD,?,002B1250,?,00008000), ref: 002B16D1

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d2d79b79741cfb7e06b847f5211bcd9394003ecdd84d5ee0cfe8b76ef11c01be
Instruction ID: b7e3fdef6c8c415067516241931caca473551f779668d669d5a2cb85835d6ec0
Opcode Fuzzy Hash: d2d79b79741cfb7e06b847f5211bcd9394003ecdd84d5ee0cfe8b76ef11c01be
Instruction Fuzzy Hash: 0B118E31C2151DE7CF049FA6E958AEEBB7CFF09781F444056E945B2240CB709970CB96

Function 00287207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0028722B

Part of subcall function 00287912: __fltout2.LIBCMT ref: 0028793B

__cftog_l.LIBCMT ref: 00287251
__cftoe_l.LIBCMT ref: 00287283

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 55cc1116e9accffccacdcd6a5e5e494a6675e920fc7b33a6ec4bddf386bc76e3
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: EA01403A06914ABBCF526E84CC418EE3F62BF59351F688615FE1858075D337C9B1AB81

Function 002DB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002DB59E
ScreenToClient.USER32(?,?), ref: 002DB5B6
ScreenToClient.USER32(?,?), ref: 002DB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 002DB5F5

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 9da8d4fe0e6b1d003e4520077af05940d5c573d897b390449344206c145ffe3d
Instruction ID: 31da608cc5e6d592fa7aec13c3ab46adc90d67d9135d62fc0251ed0971202ffc
Opcode Fuzzy Hash: 9da8d4fe0e6b1d003e4520077af05940d5c573d897b390449344206c145ffe3d
Instruction Fuzzy Hash: 7C1166B5D00209EFDB41CF99D5449EEFBB9FB08310F508166E915E3620D731AA618F90

Function 002DB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002DB8FE
_memset.LIBCMT ref: 002DB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00317F20,00317F64), ref: 002DB93C
CloseHandle.KERNEL32 ref: 002DB94E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 81aa0d53f664d16a5df63234c380af75656d1168d3ce160b9efb7f144924d12a
Instruction ID: 4b5a9829c5de6470193b24f3e24bc2d69adb39657dee7d87671068ecb479b214
Opcode Fuzzy Hash: 81aa0d53f664d16a5df63234c380af75656d1168d3ce160b9efb7f144924d12a
Instruction Fuzzy Hash: 8CF082B2554340BBF2516B65AC09FFB3BADEB0C754F048061BB09D5292D7718D118BA9

Function 002B6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 002B6E88

Part of subcall function 002B794E: _memset.LIBCMT ref: 002B7983

_memmove.LIBCMT ref: 002B6EAB
_memset.LIBCMT ref: 002B6EB8
LeaveCriticalSection.KERNEL32(?), ref: 002B6EC8

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: d51e542b5a06a0430359bc15a39a68b2d98dc9afed40f994dfe4fe7373e6680d
Instruction ID: 9fd11ffd3af348fb9c09d00378cc5a134bd64f6e3bc18c8d5e7f013a0e409028
Opcode Fuzzy Hash: d51e542b5a06a0430359bc15a39a68b2d98dc9afed40f994dfe4fe7373e6680d
Instruction Fuzzy Hash: FAF0543A100200ABCF416F55EC89A8ABB29FF45360B04C061FE0D5E216C731AD21DFB5

Function 002DC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 002512F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0025134D
Part of subcall function 002512F3: SelectObject.GDI32(?,00000000), ref: 0025135C
Part of subcall function 002512F3: BeginPath.GDI32(?), ref: 00251373
Part of subcall function 002512F3: SelectObject.GDI32(?,00000000), ref: 0025139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 002DC030
LineTo.GDI32(00000000,?,?), ref: 002DC03D
EndPath.GDI32(00000000), ref: 002DC04D
StrokePath.GDI32(00000000), ref: 002DC05B

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 6aef2ad1a398c11d3a59e4da2467707e30c91c76d89f38bf68896e9d66c8ae01
Instruction ID: 6a09e6274ddf82018bd0ca0fe8322fc556e053abf07345ced53a008e16e3338a
Opcode Fuzzy Hash: 6aef2ad1a398c11d3a59e4da2467707e30c91c76d89f38bf68896e9d66c8ae01
Instruction Fuzzy Hash: A5F0543144125AB7DB136F54AD0EFCE3F596F05312F148001FA12611E1C7755965CF99

Function 002AA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 002AA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 002AA3AC
GetCurrentThreadId.KERNEL32 ref: 002AA3B3
AttachThreadInput.USER32(00000000), ref: 002AA3BA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 74afabe083b992bb721bb30fa5ea16b02b309f225a304c91f87ea37aa66f6639
Instruction ID: 40a752c2afda1f6cef574bceae926535a75a42b6295bbf414befe698bfe473a0
Opcode Fuzzy Hash: 74afabe083b992bb721bb30fa5ea16b02b309f225a304c91f87ea37aa66f6639
Instruction Fuzzy Hash: E4E03931942228BBDB601FA2ED0CEE73F1CEF167A1F048066F50A84460CBB1C950CBE4

Function 00252218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00252231
SetTextColor.GDI32(?,000000FF), ref: 0025223B
SetBkMode.GDI32(?,00000001), ref: 00252250
GetStockObject.GDI32(00000005), ref: 00252258
GetWindowDC.USER32(?,00000000), ref: 0028C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0028C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0028C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0028C112
GetPixel.GDI32(00000000,?,?), ref: 0028C132
ReleaseDC.USER32(?,00000000), ref: 0028C13D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 8e3c7ef9f24a2dc109b6a4514d4822ff7827babf7b68767cb33d73de10c15aac
Instruction ID: 4599301931f6b76c6c947f350ec690808376db6ae225170c138788d151adc76a
Opcode Fuzzy Hash: 8e3c7ef9f24a2dc109b6a4514d4822ff7827babf7b68767cb33d73de10c15aac
Instruction Fuzzy Hash: 65E06D32901245EADF615FA4FD0D7D83B10EB15332F14C367FAAE880E187718994DB21

Function 002A8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 002A8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,002A882E), ref: 002A8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002A882E), ref: 002A8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,002A882E), ref: 002A8C7E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: eb66763343a1fc984fb4ee9aa9a54783b73fac262eab38cc64d3d3d69927c46a
Instruction ID: ab95421b8a66ebd0bbf7e4b129130fd66e4d3930b528bd1960f32c2df61a203b
Opcode Fuzzy Hash: eb66763343a1fc984fb4ee9aa9a54783b73fac262eab38cc64d3d3d69927c46a
Instruction Fuzzy Hash: 87E08636A47211DBD7A05FB07E0CB563BACEF51BA2F098829B687CA040DA348C41CF65

Function 00292187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00292187
GetDC.USER32(00000000), ref: 00292191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 002921B1
ReleaseDC.USER32(?), ref: 002921D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 403a3a3fe9f273c432bf929e75d0800159059a5f3f748c6d3f506b6e666d3ad0
Instruction ID: e2a8afe6e484d2b4c9c094b6bd3ea347b4f69835cabe70d22588c2dc5dda780a
Opcode Fuzzy Hash: 403a3a3fe9f273c432bf929e75d0800159059a5f3f748c6d3f506b6e666d3ad0
Instruction Fuzzy Hash: 7DE03271810204EFCB409F60E90CA9D7BA9EB0C311F208026E82A93620CB788A519F88

Function 0029219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0029219B
GetDC.USER32(00000000), ref: 002921A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 002921B1
ReleaseDC.USER32(?), ref: 002921D2

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e2bf3183a725b9d673dc5580bf61a7f7767b886e02b13bb60b699127dcc59325
Instruction ID: 7b09abbb30b0893b0a9c500e9a54256d1f6c5d9af0f654e1958308a5d3fc6c96
Opcode Fuzzy Hash: e2bf3183a725b9d673dc5580bf61a7f7767b886e02b13bb60b699127dcc59325
Instruction Fuzzy Hash: D0E0E575C11204AFCB419F60E90C69D7BE9EB4C311F108026F96A97620DB789A419F88

Function 002563A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%., xrefs: 002563AE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID:
String ID: %.
API String ID: 0-3490990516
Opcode ID: 94ba3896c5ae9bad42e5c74e4ae106dcab386f9808ea1149192a04ccbbfbff0f
Instruction ID: 054fed2e4f77d9fd191f56e8e318fc0a553e66886e8b25e052e2d8c2a1b9e6f7
Opcode Fuzzy Hash: 94ba3896c5ae9bad42e5c74e4ae106dcab386f9808ea1149192a04ccbbfbff0f
Instruction Fuzzy Hash: 2AB1D57192010A9BCF24EF94C4999FDB7B9FF44312F944026ED02A7291EB309DADCB59

Function 002CB1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 002CB2C3

Strings

xr1, xrefs: 002CB2F9
xr1, xrefs: 002CB325

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __itow_s
String ID: xr1$xr1
API String ID: 3653519197-2703582721
Opcode ID: 494ea7c1b55c04cca7530477fd55653182ca83152ba116731d586b35539176b6
Instruction ID: 7afde252084a008788688f5427b427bd39f835e2475dd354d22e85d9fae6a606
Opcode Fuzzy Hash: 494ea7c1b55c04cca7530477fd55653182ca83152ba116731d586b35539176b6
Instruction Fuzzy Hash: 68B1C030A14209AFCB25DF54C892EAEB7B9FF58300F14855DF9059B282EB70D9A5CB60

Function 002BB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0026FEC6: _wcscpy.LIBCMT ref: 0026FEE9

Part of subcall function 00259997: __itow.LIBCMT ref: 002599C2
Part of subcall function 00259997: __swprintf.LIBCMT ref: 00259A0C

__wcsnicmp.LIBCMT ref: 002BB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 002BB361

Strings

LPT, xrefs: 002BB292

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 2dd4e3d2cf2c7b19817c7ec0ed302a6fb9d3ef2b91a967f3741358efae8fe246
Instruction ID: d93f58b58fe7d52d713cd3532f7a6f5f78017d13bc39458a67300160087f9cbf
Opcode Fuzzy Hash: 2dd4e3d2cf2c7b19817c7ec0ed302a6fb9d3ef2b91a967f3741358efae8fe246
Instruction Fuzzy Hash: C161C475A20215EFCB15DF54C881EEEB7F4EF08310F15409AF846AB291DBB0AE94CB50

Function 00298A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00298B1E
_memmove.LIBCMT ref: 00298B78

Strings

Oa&, xrefs: 00298BF2, 0029E39A, 0029E3B6

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _memmove
String ID: Oa&
API String ID: 4104443479-711773428
Opcode ID: 466d9c76244f1a6bb1de1fbcd2929a63e44dd876e7e773da6efca5abe0ca89af
Instruction ID: 5c95fa628d561e46870c9eeb97339e5a139ab2d880f57ebb45febd95b73767c4
Opcode Fuzzy Hash: 466d9c76244f1a6bb1de1fbcd2929a63e44dd876e7e773da6efca5abe0ca89af
Instruction Fuzzy Hash: C151707091061ADFCF24CF68D484AAEB7F1FF45318F14456AE85AD7240EB31A9A5CB50

Function 00262AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00262AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00262AE1

Strings

@, xrefs: 00262AD5

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: bbfa2784e94a3e05af38aa38e6beb6b501192fe072b4c4d930a46da39249f9c7
Instruction ID: 743e62668ad2a9325d10eb68d9dcbdb0fd2bdd135802c0120152bb409db32268
Opcode Fuzzy Hash: bbfa2784e94a3e05af38aa38e6beb6b501192fe072b4c4d930a46da39249f9c7
Instruction Fuzzy Hash: 0D514571428744DBD320AF10D88ABAFBBE8FB84315F42885DF5D9410A1DB708969CB2A

Function 002B99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0025506B: __fread_nolock.LIBCMT ref: 00255089

_wcscmp.LIBCMT ref: 002B9AAE
_wcscmp.LIBCMT ref: 002B9AC1

Strings

FILE, xrefs: 002B99FA

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 1b2024c5b9f5eb46cfd16b57a00c32283e13b6f42217a31400d012c17c6d5116
Instruction ID: ac2c8fd5a5062efc648ce692cb85df5244c377af4c52528a56b277c5fc77994f
Opcode Fuzzy Hash: 1b2024c5b9f5eb46cfd16b57a00c32283e13b6f42217a31400d012c17c6d5116
Instruction Fuzzy Hash: ED41F971A10619BBDF20AEA4DC45FEFB7FDDF49714F000069FA00A71C1D6719A548BA5

Function 0029099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 002909A9

Strings

Dt1, xrefs: 0025A2B1
Dt1, xrefs: 0025A477

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClearVariant
String ID: Dt1$Dt1
API String ID: 1473721057-1670705480
Opcode ID: 4e3be3734545f7bffdf6e8daea5e78a11182b8435a157ff45c91396563ae3c1f
Instruction ID: af3b314e9d0b3adb1698ab02d8d6b5952ae8044549a15b365aa9ae62f26c8957
Opcode Fuzzy Hash: 4e3be3734545f7bffdf6e8daea5e78a11182b8435a157ff45c91396563ae3c1f
Instruction Fuzzy Hash: 4C5114786283429FC754CF19C081A2ABBF1BB98359F54895CE9818B321D731EC95CB86

Function 002C2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002C2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 002C28C8

Strings

|, xrefs: 002C2899

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 57b45d24ed28e4731beb40caaf0a633a4e15e2db37601dad6fb44873dc2b4638
Instruction ID: c5de945a881e5851ea88ca29286973154e717408ef1033e77658dcd039605200
Opcode Fuzzy Hash: 57b45d24ed28e4731beb40caaf0a633a4e15e2db37601dad6fb44873dc2b4638
Instruction Fuzzy Hash: 95310C71810119AFCF01DFA1DC85EEEBFB9FF08310F104169F815A6165DA31596ADF60

Function 002D6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 002D6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 002D6DC2

Strings

static, xrefs: 002D6D22

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: a585b9dcb95613dbe326398143832a653590da2b4f7cf9cdf9e90fe27ca72ff4
Instruction ID: 96995a8f3b5b41b6b00d219a7bf30735b1b0affe6ccd39e56ea1c4599b7ec6ff
Opcode Fuzzy Hash: a585b9dcb95613dbe326398143832a653590da2b4f7cf9cdf9e90fe27ca72ff4
Instruction Fuzzy Hash: 4331A171220205AEDB109F64DC44BFB73B9FF48720F10851AF8A687290CB31ACA1CB64

Function 002B2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 002B2E3B

Strings

0, xrefs: 002B2DF9

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f0a8e314c50de38914787b10990f75419a0485677e31c3fbda66f2d64599973f
Instruction ID: ad949300621ecc0bfeca0ca438fc40ee2f508e4783406d8bf63a970f4f453e91
Opcode Fuzzy Hash: f0a8e314c50de38914787b10990f75419a0485677e31c3fbda66f2d64599973f
Instruction Fuzzy Hash: 02310931A20306EBEB25CF49D8457EEBBB9FF45380F144029E985A61A1D770F968CB11

Function 002D6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 002D69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 002D69DB

Strings

Combobox, xrefs: 002D699D

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: cdaf80304590d587dd2e8f2baa8fa26271293c975def89312e2d37491877950b
Instruction ID: 0edcb4888ce5d035697bb0e337e0d7296e39f0202a7ae830ac11d42cbdde187d
Opcode Fuzzy Hash: cdaf80304590d587dd2e8f2baa8fa26271293c975def89312e2d37491877950b
Instruction Fuzzy Hash: EE11C47172020A6FEF129F14CCA4EFB376EEB893A4F114126F958973D0D6719C618BA0

Function 002D6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00251D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00251D73
Part of subcall function 00251D35: GetStockObject.GDI32(00000011), ref: 00251D87
Part of subcall function 00251D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00251D91

GetWindowRect.USER32(00000000,?), ref: 002D6EE0
GetSysColor.USER32(00000012), ref: 002D6EFA

Strings

static, xrefs: 002D6EBD

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6eba8b73a07764bf0aa891156009d5268b064dc700554043807665499b14e480
Instruction ID: ddecf11a4d8eeaf48640ca2c6ebd4ceee7ff997f7d3fdd535658e21a66a4194f
Opcode Fuzzy Hash: 6eba8b73a07764bf0aa891156009d5268b064dc700554043807665499b14e480
Instruction Fuzzy Hash: D4215C7292020AAFDB04DFA8DD49EEA7BB8FB08314F004529FD55D3250D734E8619B50

Function 002D6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002D6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002D6C20

Strings

edit, xrefs: 002D6BF5

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: e1d9fb74013ab8d530d7bc435aaeeeddff166e2568bb7b6e63dd1c92cf1527c9
Instruction ID: 2703b58e7064228bf131758cc3d2e431a085a871cfc5ee97e82bf85d7019162e
Opcode Fuzzy Hash: e1d9fb74013ab8d530d7bc435aaeeeddff166e2568bb7b6e63dd1c92cf1527c9
Instruction Fuzzy Hash: 4511BF71521109ABEB108F64DC49AEB376DEB05378F104727F961E32D0C775DCA19B60

Function 002B2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002B2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 002B2F30

Strings

0, xrefs: 002B2F07

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9dfaab8d7b1a209e99a4daeeb3653c00cf9b082b381b55771bd7ca1a154a35df
Instruction ID: 02626bb1ec4ae05d92ef927fa43944478a2e5426fa27e635cbdce2c782b7f423
Opcode Fuzzy Hash: 9dfaab8d7b1a209e99a4daeeb3653c00cf9b082b381b55771bd7ca1a154a35df
Instruction Fuzzy Hash: 6311E231921315EBDB21DF98DC44BE973B9FB05390F0840A1E864A72A0D7B0EE28C791

Function 002C24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 002C2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 002C2549

Strings

<local>, xrefs: 002C2511

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: aec5f0b803b8ae92e9d60312e0a20404683fb82beafe11133e78a84eadb63111
Instruction ID: e020d9939ae08fd0a1219a210ec1dfede45d239f3e8467dd0125ae3464c5bb94
Opcode Fuzzy Hash: aec5f0b803b8ae92e9d60312e0a20404683fb82beafe11133e78a84eadb63111
Instruction Fuzzy Hash: 6C11E370521226FADB288F518C98FFBFF68FB05391F50822EF50552040DAB05968D6E0

Function 002C80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 002C830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,002C80C8,?,00000000,?,?), ref: 002C8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 002C80CB
htons.WSOCK32(00000000,?,00000000), ref: 002C8108

Strings

255.255.255.255, xrefs: 002C80E3

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 3ed0d720a73d050628862d606bfbee2d373901bf4d88fc0277eb1d3ccc6534f4
Instruction ID: d1d61cfd4effe27f990caa17a63dc27f9349473ff062ca0c8e601a96744086bd
Opcode Fuzzy Hash: 3ed0d720a73d050628862d606bfbee2d373901bf4d88fc0277eb1d3ccc6534f4
Instruction Fuzzy Hash: 0411E534610206ABDB10AF64DC56FFDB364FF05310F14862BE91597291DB72A825CA95

Function 00260A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00253C26,003162F8,?,?,?), ref: 00260ACE

Part of subcall function 00257D2C: _memmove.LIBCMT ref: 00257D66

_wcscat.LIBCMT ref: 002950E1

Strings

c1, xrefs: 00260B0E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: c1
API String ID: 257928180-4215254210
Opcode ID: 24299ac5d1e6237cea78978cf0132f73c57503cc3b104fbd7041ab563727e00b
Instruction ID: 3c45f16f2dcd1ebc3e533468918c937e5591f29ed79d019b99230886f74eab73
Opcode Fuzzy Hash: 24299ac5d1e6237cea78978cf0132f73c57503cc3b104fbd7041ab563727e00b
Instruction Fuzzy Hash: BF11A938A2521C9B8B41FBA4DC42DDD73B8EF0C354B0044A6B959D7151EA70DAE85B15

Function 002A92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 002A9355

Strings

ListBox, xrefs: 002A931F
ComboBox, xrefs: 002A92F4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 23d8db4601bb4027c399c5090175c306c36b8da8026ec85595ed058ca45f07c7
Instruction ID: 13309abc6e2037d520397092e8531ef48315f7882fecb4d28641c7c99e7ad098
Opcode Fuzzy Hash: 23d8db4601bb4027c399c5090175c306c36b8da8026ec85595ed058ca45f07c7
Instruction Fuzzy Hash: E701F171A61224ABCF05EBA1CCA18FE73B9BF07320B100659F932572D2DF31582CCA50

Function 002A91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 002A924D

Strings

ListBox, xrefs: 002A9217
ComboBox, xrefs: 002A91EC

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 52db8be334a7c8a86b5c214bc58c4032c343e0f3bc169bed09505359aa0d7407
Instruction ID: 9eea36d9f65695e418dc655f2b28db95668e6c9b3b4cf9353c0449e90a0a0abf
Opcode Fuzzy Hash: 52db8be334a7c8a86b5c214bc58c4032c343e0f3bc169bed09505359aa0d7407
Instruction Fuzzy Hash: E901D471E611047BCB05EBA1C9A2EFF73AC9F47301F140029BD12632C2EE245E2C8AA1

Function 002A9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00257F41: _memmove.LIBCMT ref: 00257F82

Part of subcall function 002AB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 002AB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 002A92D0

Strings

ListBox, xrefs: 002A929C
ComboBox, xrefs: 002A9271

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5b55d98c87eee783920873c34aa067b20e79953be9b67a835dec2c12e6ca8404
Instruction ID: 028df49af5af996a96ed0a8c1c2cd1d6e2c3eb0ccc99806016747fc93573b410
Opcode Fuzzy Hash: 5b55d98c87eee783920873c34aa067b20e79953be9b67a835dec2c12e6ca8404
Instruction Fuzzy Hash: C201A771E6121577CB05EAA5CD92FFF77AC9F12301F140116BC12636C2DE215E2C9A75

Function 00276DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00276DD0
__calloc_crt.LIBCMT ref: 00276DE9

Strings

@R1, xrefs: 00276E00

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: __calloc_crt
String ID: @R1
API String ID: 3494438863-1451780926
Opcode ID: 799ea59942f849e8d9784e3b92e0bb2a6408b71a35ecf0646b8932524ee2de61
Instruction ID: 834e4ab48a94286e8db411450fc6659357894d8499f611c579ef257d5fe62abb
Opcode Fuzzy Hash: 799ea59942f849e8d9784e3b92e0bb2a6408b71a35ecf0646b8932524ee2de61
Instruction Fuzzy Hash: F9F06875776A179FF739CF58BD16AE12799E709720F10C826E108CA1D0EB7488528650

Function 002B51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 002B51E8
_wcscmp.LIBCMT ref: 002B51FA

Strings

#32770, xrefs: 002B51F4

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: eb706633b4f70fa876c0deb9874d75dcd8fb79ed18a0190cd70f0e38cec001fe
Instruction ID: 621a65e837821d6ddb143573e2593ee48cd51dc2489b67686a65c9d686b092f8
Opcode Fuzzy Hash: eb706633b4f70fa876c0deb9874d75dcd8fb79ed18a0190cd70f0e38cec001fe
Instruction Fuzzy Hash: 62E02B3290132916E3109A95AC09BE7F7ACEB45761F000067FD14D3040D57099548BD0

Function 002A81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 002A81CA

Part of subcall function 00273598: _doexit.LIBCMT ref: 002735A2

Strings

Error allocating memory., xrefs: 002A81C3
AutoIt, xrefs: 002A81BE

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 6ef9ef63cf5fb6bb21cf4099dc9025c8dcd0473a2f2e409acba00c2a92bf5c66
Instruction ID: 2c22322ca99580b9584a688549ca0fe388fb5763a535d72612dd1bede412059c
Opcode Fuzzy Hash: 6ef9ef63cf5fb6bb21cf4099dc9025c8dcd0473a2f2e409acba00c2a92bf5c66
Instruction Fuzzy Hash: A3D0C2322E531832D21432A96C0ABC566484B0AB12F508023FF0C954D38DE188B142DD

Function 0028B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0028B564: _memset.LIBCMT ref: 0028B571

Part of subcall function 00270B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0028B540,?,?,?,0025100A), ref: 00270B89

IsDebuggerPresent.KERNEL32(?,?,?,0025100A), ref: 0028B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0025100A), ref: 0028B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0028B54E

Memory Dump Source

Source File: 00000000.00000002.1651632377.0000000000251000.00000020.00000001.01000000.00000003.sdmp, Offset: 00250000, based on PE: true

Associated: 00000000.00000002.1651618061.0000000000250000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.00000000002DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651667997.0000000000305000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651696165.000000000030F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1651708789.0000000000318000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_250000_Attendance list.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: b2dc070c792b23ded0cdd510e8ba1a12692fbdfcb3a3e078f0dfaee225f99eb4
Instruction ID: b2441f036a15135d476c011458d3850dbebf9a9975e4d5030a594fd460ff1437
Opcode Fuzzy Hash: b2dc070c792b23ded0cdd510e8ba1a12692fbdfcb3a3e078f0dfaee225f99eb4
Instruction Fuzzy Hash: 1FE06574521311CFD361EF24E90875277E4AB05744F04892DE846C2691D7B8E418CB61

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Attendance list.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autE4E0.tmp

C:\Users\user\AppData\Local\Temp\autE51F.tmp

C:\Users\user\AppData\Local\Temp\benting

C:\Users\user\AppData\Local\Temp\conged

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
Attendance list.exe

Function 00253B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 00254FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 00254AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 002B93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00253015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00253041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 002571EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00253633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00253A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00253778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 0025F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 039625E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 002539E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 039623B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143
fileCOMMON

Function 0025410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre