Edit tour

Windows Analysis Report
roger.exe

Overview

General Information

Sample name:	roger.exe
Analysis ID:	1466536
MD5:	b5214f81bf6b76f46d37a434a9cdec39
SHA1:	52082d597ec339b9d1acfe2e77b7c00b6954b1ba
SHA256:	7147ab7f630f08e61ecbb66ca84cccac28f0dd90d11d4036474f0948dc698113
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

roger.exe (PID: 7060 cmdline: "C:\Users\user\Desktop\roger.exe" MD5: B5214F81BF6B76F46D37A434A9CDEC39)

RegSvcs.exe (PID: 7108 cmdline: "C:\Users\user\Desktop\roger.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "versace@myhydropowered.com", "Password": "0TFiRgPxmCJcdSB"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3412f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3422b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34327:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34399:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3442f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: roger.exe PID: 7060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: roger.exe PID: 7060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: roger.exe PID: 7060	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7108	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7108	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.520000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.520000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3412f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3422b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34327:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34399:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3442f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.roger.exe.3d30000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.roger.exe.3d30000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.roger.exe.3d30000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.roger.exe.3d30000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3412f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3422b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34327:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34399:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3442f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.roger.exe.3d30000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.roger.exe.3d30000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.roger.exe.3d30000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3232f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323a1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3242b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324bd:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32527:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32599:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3262f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326bf:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 131.226.2.60, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7108, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49739

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.myhydropowered.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.RegSvcs.exe.520000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "versace@myhydropowered.com", "Password": "0TFiRgPxmCJcdSB"}

Multi AV Scanner detection for domain / URL

Source: mail.myhydropowered.com	Virustotal: Detection: 6%			Perma Link
Source: http://mail.myhydropowered.com	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Source: roger.exe	ReversingLabs: Detection: 34%
Source: roger.exe	Virustotal: Detection: 33%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: roger.exe

Joe Sandbox ML: detected

Source: roger.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: roger.exe, 00000000.00000003.1635152174.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, roger.exe, 00000000.00000003.1635412054.0000000003D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: roger.exe, 00000000.00000003.1635152174.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, roger.exe, 00000000.00000003.1635412054.0000000003D70000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00444696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00444696
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044C93C FindFirstFileW,FindClose,	0_2_0044C93C
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0044C9C7
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0044F200
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0044F35D
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0044F65E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00443A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00443A2B
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00443D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00443D4E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0044BF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 131.226.2.60:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: UNASSIGNED UNASSIGNED

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49739 -> 131.226.2.60:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_004525E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_004525E2

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: mail.myhydropowered.com

Source: roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000024DA000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000001.00000002.4086490674.0000000002613000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002595000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.000000000289A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.000000000258F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.myhydropowered.com
Source: RegSvcs.exe, 00000001.00000002.4088988996.0000000005813000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088713665.0000000005740000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088914931.00000000057EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088939237.00000000057F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4088988996.0000000005813000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088713665.0000000005740000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088914931.00000000057EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088939237.00000000057F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000001.00000002.4086490674.0000000002491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4091716226.0000000008550000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088656823.0000000005720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4091716226.0000000008550000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088656823.0000000005720000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002491000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.roger.exe.3d30000.1.raw.unpack, SKTzxzsJw.cs

.Net Code: IC8sPr4KW

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0045425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0045425A

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00454458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00454458

Source: C:\Users\user\Desktop\roger.exe

0_2_0045425A

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00440219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00440219

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0046CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0046CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.roger.exe.3d30000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\roger.exe	Code function: This is a third-party compiled AutoIt script.	0_2_003E3B4C
Source: roger.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: roger.exe, 00000000.00000000.1626730102.0000000000495000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_33058d88-2
Source: roger.exe, 00000000.00000000.1626730102.0000000000495000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c3b2c044-9
Source: roger.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_821d2a03-7
Source: roger.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_28655b97-2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00444021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00444021

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00438858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00438858

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0044545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0044545F

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003EE800	0_2_003EE800
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040DBB5	0_2_0040DBB5
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0046804A	0_2_0046804A
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003EE060	0_2_003EE060
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F4140	0_2_003F4140
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00402405	0_2_00402405
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00416522	0_2_00416522
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00460665	0_2_00460665
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0041267E	0_2_0041267E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040283A	0_2_0040283A
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F6843	0_2_003F6843
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_004189DF	0_2_004189DF
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F8A0E	0_2_003F8A0E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00460AE2	0_2_00460AE2
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00416A94	0_2_00416A94
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0043EB07	0_2_0043EB07
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00448B13	0_2_00448B13
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040CD61	0_2_0040CD61
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00417006	0_2_00417006
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F710E	0_2_003F710E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F3190	0_2_003F3190
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003E1287	0_2_003E1287
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_004033C7	0_2_004033C7
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040F419	0_2_0040F419
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_004016C4	0_2_004016C4
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F5680	0_2_003F5680
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_004078D3	0_2_004078D3
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003F58C0	0_2_003F58C0
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00401BB8	0_2_00401BB8
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00419D05	0_2_00419D05
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003EFE40	0_2_003EFE40
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00401FD0	0_2_00401FD0
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040BFE6	0_2_0040BFE6
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_02123610	0_2_02123610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B241F0	1_2_00B241F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B2B31F	1_2_00B2B31F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B24AC0	1_2_00B24AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B23EA8	1_2_00B23EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B2EF69	1_2_00B2EF69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0601C220	1_2_0601C220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06017A28	1_2_06017A28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06015250	1_2_06015250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0601AED0	1_2_0601AED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06013118	1_2_06013118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06017348	1_2_06017348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06012401	1_2_06012401
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0601E430	1_2_0601E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06010040	1_2_06010040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06015993	1_2_06015993
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06010007	1_2_06010007

Source: C:\Users\user\Desktop\roger.exe	Code function: String function: 00400D27 appears 70 times
Source: C:\Users\user\Desktop\roger.exe	Code function: String function: 003E7F41 appears 35 times
Source: C:\Users\user\Desktop\roger.exe	Code function: String function: 00408B40 appears 42 times

Source: roger.exe, 00000000.00000003.1636281672.000000000403D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs roger.exe
Source: roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename18d51a2c-d535-436d-b81d-5afee475c1d2.exe4 vs roger.exe
Source: roger.exe, 00000000.00000003.1635026379.0000000003E93000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs roger.exe

Source: roger.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.roger.exe.3d30000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.roger.exe.3d30000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.roger.exe.3d30000.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@4/3

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0044A2D5 GetLastError,FormatMessageW,

0_2_0044A2D5

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00438713 AdjustTokenPrivileges,CloseHandle,		0_2_00438713
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00438CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00438CC3

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0044B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0044B59E

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0045F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0045F121

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0044C602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0044C602

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_003E4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\roger.exe

File created: C:\Users\user\AppData\Local\Temp\autBE4A.tmp

Jump to behavior

Source: roger.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: roger.exe	ReversingLabs: Detection: 34%
Source: roger.exe	Virustotal: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\roger.exe "C:\Users\user\Desktop\roger.exe"
Source: C:\Users\user\Desktop\roger.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\roger.exe"
Source: C:\Users\user\Desktop\roger.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\roger.exe"	Jump to behavior

Source: C:\Users\user\Desktop\roger.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: roger.exe

Static file information: File size 1056768 > 1048576

Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: roger.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: roger.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: roger.exe, 00000000.00000003.1635152174.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, roger.exe, 00000000.00000003.1635412054.0000000003D70000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: roger.exe, 00000000.00000003.1635152174.0000000003F10000.00000004.00001000.00020000.00000000.sdmp, roger.exe, 00000000.00000003.1635412054.0000000003D70000.00000004.00001000.00020000.00000000.sdmp

Source: roger.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: roger.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: roger.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: roger.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: roger.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0045C304 LoadLibraryA,GetProcAddress,

0_2_0045C304

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00448719 push FFFFFF8Bh; iretd	0_2_0044871B
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040E94F push edi; ret	0_2_0040E951
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040EA68 push esi; ret	0_2_0040EA6A
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00408B85 push ecx; ret	0_2_00408B98
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040EC43 push esi; ret	0_2_0040EC45
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040ED2C push edi; ret	0_2_0040ED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00B20C55 push edi; retf	1_2_00B20C7A

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_003E4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_003E4A35
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_004655FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004655FD

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_004033C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004033C7

Source: C:\Users\user\Desktop\roger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\roger.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: roger.exe PID: 7060, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\roger.exe

API/Special instruction interceptor: Address: 2123234

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596424	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1649			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8213			Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98407

Source: C:\Users\user\Desktop\roger.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00444696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00444696
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044C93C FindFirstFileW,FindClose,	0_2_0044C93C
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0044C9C7
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0044F200
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0044F35D
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0044F65E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00443A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00443A2B
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00443D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00443D4E
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0044BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0044BF27

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003E4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596424	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595730	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: RegSvcs.exe, 00000001.00000002.4088713665.0000000005740000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\roger.exe

API call chain: ExitProcess graph end node

graph_0-97267

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_00B27ED0 CheckRemoteDebuggerPresent,

1_2_00B27ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_004541FD BlockInput,

0_2_004541FD

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_003E3B4C

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00415CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00415CCC

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0045C304 LoadLibraryA,GetProcAddress,

0_2_0045C304

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_021234A0 mov eax, dword ptr fs:[00000030h]	0_2_021234A0
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_02123500 mov eax, dword ptr fs:[00000030h]	0_2_02123500
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_02121E70 mov eax, dword ptr fs:[00000030h]	0_2_02121E70

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_004381F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_004381F7

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040A364 SetUnhandledExceptionFilter,		0_2_0040A364
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_0040A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040A395

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\roger.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\roger.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 266008

Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00438C93 LogonUserW,

0_2_00438C93

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_003E3B4C

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_003E4A35

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00444EC9 mouse_event,

0_2_00444EC9

Source: C:\Users\user\Desktop\roger.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\roger.exe"

Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

0_2_004381F7

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00444C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00444C03

Source: roger.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: roger.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0040886B cpuid

0_2_0040886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_004150D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004150D7

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_00422230 GetUserNameW,

0_2_00422230

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_0041418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0041418A

Source: C:\Users\user\Desktop\roger.exe

Code function: 0_2_003E4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_003E4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roger.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7108, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: roger.exe	Binary or memory string: WIN_81
Source: roger.exe	Binary or memory string: WIN_XP
Source: roger.exe	Binary or memory string: WIN_XPe
Source: roger.exe	Binary or memory string: WIN_VISTA
Source: roger.exe	Binary or memory string: WIN_7
Source: roger.exe	Binary or memory string: WIN_8
Source: roger.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roger.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7108, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.520000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.roger.exe.3d30000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roger.exe PID: 7060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7108, type: MEMORYSTR

Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00456596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00456596
Source: C:\Users\user\Desktop\roger.exe	Code function: 0_2_00456A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00456A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
roger.exe	34%	ReversingLabs	Win32.Trojan.Strab
roger.exe	34%	Virustotal		Browse
roger.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
mail.myhydropowered.com	6%	Virustotal	Browse
api.ipify.org	0%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://mail.myhydropowered.com	100%	Avira URL Cloud	malware
http://r10.i.lencr.org/0	0%	Avira URL Cloud	safe
http://r10.o.lencr.org0#	0%	Avira URL Cloud	safe
http://mail.myhydropowered.com	6%	Virustotal		Browse
http://r10.i.lencr.org/0	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.myhydropowered.com	131.226.2.60	true	true	6%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false	0%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe URL Reputation: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002491000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.myhydropowered.com	RegSvcs.exe, 00000001.00000002.4086490674.0000000002613000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002595000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.000000000289A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.000000000258F000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000028E0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://r10.o.lencr.org0#	RegSvcs.exe, 00000001.00000002.4088988996.0000000005813000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088713665.0000000005740000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088914931.00000000057EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088939237.00000000057F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	roger.exe, 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4086490674.0000000002491000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4091716226.0000000008550000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088656823.0000000005720000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4091716226.0000000008550000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088656823.0000000005720000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r10.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4088988996.0000000005813000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088713665.0000000005740000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.00000000027AD000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088914931.00000000057EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4086490674.0000000002686000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4088939237.00000000057F7000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
131.226.2.60	mail.myhydropowered.com	United States	16797	UNASSIGNED	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466536
Start date and time:	2024-07-03 03:15:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	roger.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 56 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:15:53	API Interceptor	12374653x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	ip-api.com/line/?fields=hosting
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ServerManager.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
172.67.74.152	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
mail.myhydropowered.com	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	PO_67800Kg+MachineCmO.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	FA46969-OVERSEAS 2024.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	PO_700000_Kg+MachineCWO.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	DF PYR Y89036483.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	PYT W2471234-MLIG.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	Salary List.xls.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
api.ipify.org	Remittance Advice.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	Drawing specification and June PO #07329.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.12.205
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	arrival notice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	FmQx1Fw3VA.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	config.lnk.mal.lnk	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	purchase order - PO-011024-201.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	3z5nZg91qJ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	okmnji.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	208.95.112.1
	AWB DHL#40882993049403.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
UNASSIGNED	doc -scan file.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.60
	Vsl_MV DART TRADER_001.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	DHL Arrival Notice.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	f6RyWmGZLw.elf	Get hash	malicious	Unknown	Browse	153.10.48.141
	Payroll List or Salary List.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	Cosco_RFQ_June_.exe	Get hash	malicious	AgentTesla	Browse	131.226.2.151
	https://bitbucket.oreaillyauto.com/	Get hash	malicious	Unknown	Browse	199.67.80.79
	Payroll List or Salary List.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.151
	arm5-20240623-1330.elf	Get hash	malicious	Mirai	Browse	156.134.188.54
	arm7-20240623-0650.elf	Get hash	malicious	Mirai	Browse	41.220.60.216
CLOUDFLARENETUS	https://townsvilleucc.com.au	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://emea.dcv.ms/xAUEwUn0yq&c=E,1,toHboUmwDMlhwr-wc7dBvpYkcIiHsLy6ICiYedy6zqFMHJPZP4VPyK8zV2e78vqw1ZiSYyf8djJ0Qg64xCBVUCvFvYwJhqpWb_urHJ65A88aoiyybtSIFaPo&typo=1	Get hash	malicious	Unknown	Browse	104.21.55.70
	SecuriteInfo.com.W32.Trojan.FWF.gen.Eldorado.2850.19434.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	104.21.45.251
	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	172.67.221.174
	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://steaemcoonmmunnltly.com/g-friend/golo/gifts-50	Get hash	malicious	Unknown	Browse	104.17.25.14
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	172.67.149.157
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://services.business-manange.com/	Get hash	malicious	Unknown	Browse	172.67.138.117

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://steaemcoonmmunnltly.com/g-friend/golo/gifts-50	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	http://www.telegramkv.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://iwahadxi.hosted.phplist.com/lists/lt.php/?tid=eU1SAFEEUlZTABhUAVAGGAZWVFsfXVQLWkkDBQIAUAwCAgcAAldPWwdaBlNRVAgYVwEEXh9QClxcSQcAUlcbWgQGAAJVVwRXBAoBSQcBAVALVA8LHwIEXVtJUg8GVxsAVVMHGA5SB1EBC1YDAQQBDA	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://projeclity-f1d3b6.ingress-daribow.ewp.live/wp-content/plugins/mitaclau/pages/region.php	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://swans-muffin-1id4964-7304421.netlify.app/form	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://pub-fb608504b57048a1b1ca54c74dbf132d.r2.dev/ront.html?ccsend	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\roger.exe
File Type:	data
Category:	dropped
Size (bytes):	243200
Entropy (8bit):	6.508858311348976
Encrypted:	false
SSDEEP:	6144:xU23ceXhnIpNN7Ip0mdauXiAXAN+YU8R0GbfaJ6e7:yIc4nINO0md3XiAXAN+YU8R0OSJ64
MD5:	1F881A604A491F1F502A60126104240F
SHA1:	574830B296FA31FEBBC42739FA19D44CA28CC98A
SHA-256:	9DCAB73636838DBA3AEE703D51A6345F6E981AFAA19A6D00E9C35DFCB1445C50
SHA-512:	7CF111A57BD149A0125E7C52014DE233CDB577B60422BFAFFAE570E75FFA4C75C1458520259DA38E92606DE2E4C111013A49BD9CC6B7405EC7CBE60748E71294
Malicious:	false
Reputation:	low
Preview:	.m.LND7ME5CR..4W.4LMD7MAuCRP54W74LMD7MA5CRP54W74LMD7MA5CRP54.74LC[.CA.J.q.5....%-Dm1G,5"TYwTU"#+Cm#Pc %[.>Y..... .Q&\|]8>s74LMD7M.pCR.47WSQ.+D7MA5CRP.4U6?MFD7.B5CZP54W74.G7Ma5CR.64W7tLMd7MA7CRT54W74LM@7MA5CRP5.S74NMD7MA5AR..4W'4L]D7MA%CR@54W74L]D7MA5CRP54WS.OM.7MA5.QPs1W74LMD7MA5CRP54W74LM@7AA5CRP54W74LMD7MA5CRP54W74LMD7MA5CRP54W74LMD7MA5CRP54w74DMD7MA5CRP54_.4L.D7MA5CRP54W.@)507MA..QP5.W74.ND7OA5CRP54W74LMD7mA5#\|"FF474L.A7MA.@RP34W7.OMD7MA5CRP54W7tLM..?$Y,1P58W74LM@7MC5CR.64W74LMD7MA5CR.54.74LMD7MA5CRP54W7..ND7MA5.RP56W24..F79u4CQP54V74JMD7MA5CRP54W74LMD7MA5CRP54W74LMD7MA5CRP54W74LMD7P...}..J.F/C.k.R.Q..'.M..KvX.NW.~rZ......8G..R.:....E...4.KW)4....u$<<O].%.:U......l5u..V[.-...3v.#G..{...q....89.m..$.4XYb,4G!$..36TF>.6.LD7MA......]4...NN+w@(c....x_<a...,P54374L?D7M 5CR.54WX4LM7MAKCRPK4W7rLMDwMA5tRP5.W74!MD7iA5C,P54.J;C...$2..RP54W...}.Z....g...E.3.Uu..6.~..2g.B,.:.y...;..\x.Z.\Kb{.UQ30R53HNH.C...q70S26KIG;pO~.....q..u..<..*.HW74LMD.MA.CRP..W.4LM.7.A..RP5..7.L.D...5

C:\Users\user\AppData\Local\Temp\autBE4A.tmp

Download File

Process:	C:\Users\user\Desktop\roger.exe
File Type:	data
Category:	dropped
Size (bytes):	146004
Entropy (8bit):	7.927745796135455
Encrypted:	false
SSDEEP:	3072:OqNLhD699GTXKFuv1VsLQ6wWnblugSnj4upoif1Hpb7yzUJgLXPo:9De99GTXKKVsLQgnbEgSnj4uvjb+zUJl
MD5:	E414977518BC589D86035E95A8CD2463
SHA1:	AA2F1440BFD197FAAB2AB0583EF90708B2C6BCDD
SHA-256:	087C94DC9535B691F41A60BB635139BD73DFEBD0264E9915773E11070B3442EA
SHA-512:	8E8BDAD2656EBE303FD0D410719D12A49972AAF6D00782B517009F9AC9A86E96792EF914BC9B0C31D6B214883EF10A4E3F076C5960CE04B37DD894E92F70B100
Malicious:	false
Reputation:	low
Preview:	EA06.....[t..u.oM..hu-.iW..)....u...Y.^n..........(u.m....g.8.o...Ie.Kl.,.....R."...v..B. .....R........].O.`.y..(u(..oW..b....uf.Y...F.M.4).......7..@.....<.S).@..oC.U.%.@...R.7.S.)qA.D6.J..iL....Z.J..[....j..}6&....5......M. ..H...w..(.......(.oc4.L.`..\|}...@...........A...5.h..B. ..V.R.L....<..... .....,..&....P...$..[..Mf.P.O.)...h3XX.y6......o9..(`...7.R.<?....=.....}.G.P.4.....\...'.a.(...X.S.....Z.n.Y..BqG.B.X......y._..i....3N....]d...>.....U]..u...V....V...V..3.n$tx.j...b.1NN.y..Nc....I...+....iG..#q...F.c..j`.+...pY..CC].A..u:Ww.J,y.?c.x..,>n.k.,..&`.d.....i.p."...J...X..K...@.%.....x....B..Z@?...J....~..e....P..&..w<Z8.... 4\..?U..9.......J...:.^`....m..^4...r.b......5..).U....a.3y.Ne6..h.>....".{...u......3K..h)....Sh;P.Sk......$.A...!..o..l..~o.k..Lj...^.#..S.ufk7._l.;<Ry?...p.4.U&s%.....oT9....L..I.'. ...z\6o4.L...$v.R.G.0.......3Z.b[S.U.sk%z.7......k4...t.m..(..h..t.,.-l.Zt..bG.....G..(.X..]4.jf..5.G7...y...tX...R..

C:\Users\user\AppData\Local\Temp\autBE89.tmp

Download File

Process:	C:\Users\user\Desktop\roger.exe
File Type:	data
Category:	dropped
Size (bytes):	9846
Entropy (8bit):	7.59858476859658
Encrypted:	false
SSDEEP:	192:65jwEiqxwzMZTG3c6Vg0X9O1JZUv3QfyYxvoc1HCu30xA9mfXkRzh2E1:I6qxwzMZy3QU9Obysvoc1HCuExAgfGzX
MD5:	E24A12B1F3CAC427B0E383977D52E9F0
SHA1:	B276EF783FAB6F81FAA8AFA152DF27537BF939BA
SHA-256:	50EBDFCFB172A842DE042E601B9E5D6E5CB80294E14E57B1C04D8A7CA35F2AA0
SHA-512:	0B7FA8D671C4F6ED7E760533982C279848DA2582359E7017CC40E569ED420A685377A739838D497EB94AD418064265528A32BEBF220C7534AB511F066499FE22
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\inhumation

Download File

Process:	C:\Users\user\Desktop\roger.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.590739809741736
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+IC6bd4vfF3if6gyut:miTZ+2QoioGRk6ZklputwjpjBkCiw2Rp
MD5:	B5495777C049626EEF7FAEB654E8D7C3
SHA1:	B586C75337918713B50F55FB66A675CBFC54009F
SHA-256:	A6B5A7E306F6D8D96B15A54C8292582FFF2B8703296B4384ADC02B579C9809A3
SHA-512:	E92FEBD3F7500B72A5E7233D34A64648D7699EE56A794F7E186AAA521054842E6748CAC152942C397553939E375C2CB74473AB6383B9C5CECD5FB61EFF85938C
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.966551924462203
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	roger.exe
File size:	1'056'768 bytes
MD5:	b5214f81bf6b76f46d37a434a9cdec39
SHA1:	52082d597ec339b9d1acfe2e77b7c00b6954b1ba
SHA256:	7147ab7f630f08e61ecbb66ca84cccac28f0dd90d11d4036474f0948dc698113
SHA512:	69dff04663b4b4072c320cc5549d496a6f7f47ee74a4ba79826c1654c35b83f5e64ea6a1e093ccacdc45150314e7c6c06742e10254f2532aa2987544784e0481
SSDEEP:	24576:AAHnh+eWsN3skA4RV1Hom2KXMmHazPkkB91vR3rn5:3h+ZkldoPK8YazNlR3F
TLSH:	0A25AD0273D1C036FFAB92739B2AF6455ABC79254133852F13981DB9BD701B2263E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x668482DC [Tue Jul 2 22:44:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F3720815B0Dh
jmp 00007F37208088C4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3720808A4Ah
cmp edi, eax
jc 00007F3720808DAEh
bt dword ptr [004C41FCh], 01h
jnc 00007F3720808A49h
rep movsb
jmp 00007F3720808D5Ch
cmp ecx, 00000080h
jc 00007F3720808C14h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F3720808A50h
bt dword ptr [004BF324h], 01h
jc 00007F3720808F20h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F3720808BEDh
test edi, 00000003h
jne 00007F3720808BFEh
test esi, 00000003h
jne 00007F3720808BDDh
bt edi, 02h
jnc 00007F3720808A4Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F3720808A53h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F3720808AA5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x379e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x100000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x379e4	0x37a00	5c9c2d59b0e07023deba523da246dc2e	False	0.8822068117977528	data	7.780058716820653	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x2ecaa	data			1.0003443633973015
RT_GROUP_ICON	0xff464	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xff4dc	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xff4f0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xff504	0x14	data	English	Great Britain	1.25
RT_VERSION	0xff518	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xff5f4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 03:15:53.633948088 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:53.633980989 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:53.634063005 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:53.666882038 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:53.666898966 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.133096933 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.133191109 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.155240059 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.155250072 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.155507088 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.209399939 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.280885935 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.324506044 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.384877920 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.384924889 CEST	443	49730	172.67.74.152	192.168.2.4
Jul 3, 2024 03:15:54.384973049 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.399611950 CEST	49730	443	192.168.2.4	172.67.74.152
Jul 3, 2024 03:15:54.412105083 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:15:54.417167902 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 03:15:54.417244911 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:15:54.417366982 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:15:54.422584057 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 03:15:54.936553001 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 03:15:54.990612984 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:15:55.444734097 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:15:55.537820101 CEST	80	49731	208.95.112.1	192.168.2.4
Jul 3, 2024 03:15:55.537894011 CEST	49731	80	192.168.2.4	208.95.112.1
Jul 3, 2024 03:17:41.986040115 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:41.990933895 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:41.991015911 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:42.583142042 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:42.583350897 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:42.588290930 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:42.701948881 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:42.706800938 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:42.711688995 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:42.984982967 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:42.987457037 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:42.992525101 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.107738018 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.107863903 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.107875109 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.107940912 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.125792980 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.130805016 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.244612932 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.250792027 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.255796909 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.369371891 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.372031927 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.376940012 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.491151094 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.495034933 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.499914885 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.615279913 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.618977070 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.623899937 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.738069057 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.738308907 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.743120909 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.862623930 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.862901926 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.867803097 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.981570959 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.983515024 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.983614922 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.983661890 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.983740091 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.985016108 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.988328934 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.988384962 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.988428116 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.988575935 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.988626003 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.989847898 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.989895105 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.989953995 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.989953995 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.990048885 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.990106106 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.993124008 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.993185997 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.993191957 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.993277073 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.994810104 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.994863987 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.994882107 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.994893074 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.994935989 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.994987011 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.995016098 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.995078087 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.995115042 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.995124102 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.995191097 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.998008013 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.998064995 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.998096943 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.998152971 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.998178959 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.998251915 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.999742985 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.999815941 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:43.999841928 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.999886036 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:43.999896049 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000021935 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000030994 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000091076 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000103951 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000164986 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000231028 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000241041 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000248909 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000258923 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.000309944 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.003207922 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.003217936 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.003245115 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.003330946 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004477024 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004518032 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004543066 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004553080 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004646063 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004659891 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004668951 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004679918 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004688978 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004697084 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004714966 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004724026 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004733086 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.004797935 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.306901932 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:44.350074053 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:48.714831114 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:48.719759941 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:48.834729910 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:48.835946083 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:48.835988998 CEST	587	49739	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:48.841068029 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:48.842160940 CEST	49739	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:48.842163086 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:48.846992016 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:48.854799032 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.551963091 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.552153111 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.556950092 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.671164036 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.671614885 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.676882029 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.790863037 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.791464090 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.796336889 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.910916090 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.911731005 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.912169933 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:49.916532040 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:49.916955948 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.100265980 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.100450039 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.105298996 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.230973959 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.231223106 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.236076117 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.351717949 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.351947069 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.356766939 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.471332073 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.471599102 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.476444006 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.591912985 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.592158079 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.597172976 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.850078106 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.851125002 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.851125956 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.851171017 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.851171017 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.854823112 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.856020927 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.856029987 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.856036901 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.856113911 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.856142998 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.859673023 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859703064 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.859728098 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859735966 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859740019 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859782934 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859823942 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.859859943 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.859869003 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.860704899 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.860713005 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.860742092 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.860953093 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.860984087 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.864569902 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.864605904 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.864645004 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.865009069 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.865040064 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.865649939 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.865885973 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.865957975 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.869864941 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.869916916 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.869921923 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.870582104 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.870613098 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.870835066 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.870938063 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.870990038 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871045113 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871092081 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871114969 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.871145964 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871145964 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.871145964 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:50.871182919 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871228933 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871313095 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871320963 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.871330976 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874775887 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874789953 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874797106 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874876022 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874917984 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874984026 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.874991894 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875031948 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875040054 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875089884 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875097990 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875144958 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875154972 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875197887 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875566006 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875576019 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875669956 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875679016 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875689030 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875703096 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875935078 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875942945 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:50.875950098 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:51.177402020 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:51.290802002 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:17:51.495207071 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:17:51.495276928 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:03.783725977 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:03.788635015 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:03.903247118 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:03.903376102 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:03.903384924 CEST	587	49740	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:03.903429031 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:03.904004097 CEST	49740	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:03.915227890 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:03.921750069 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:03.921844959 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.451486111 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.451678991 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.456497908 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.573666096 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.573820114 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.578618050 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.696913004 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.700453043 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.705265999 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.823132038 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.824192047 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.824192047 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.829011917 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.829098940 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.946698904 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:04.946943045 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:04.951797009 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.069045067 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.071072102 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.075911045 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.193970919 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.194185972 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.199107885 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.452809095 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.454673052 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.459537029 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.578213930 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.582969904 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.587829113 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.705372095 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.705766916 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.705822945 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.705822945 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.705945969 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.707148075 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.710680962 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.710690022 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.710692883 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.710918903 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.711044073 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712045908 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712053061 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712063074 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712069988 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712178946 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.712178946 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.712258101 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.712265968 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.713587046 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.713983059 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.715434074 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.715554953 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.715766907 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.715873003 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.717542887 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.717648029 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.717660904 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.717824936 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.718880892 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.720177889 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.720230103 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.720356941 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.720707893 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.720799923 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.722233057 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.722325087 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.722470045 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.722568989 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.722584009 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.722676992 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.722712040 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:05.722754002 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.722825050 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.723705053 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.724822998 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725249052 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725256920 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725567102 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725574970 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725583076 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725589991 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725596905 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725600004 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725606918 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725614071 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.725629091 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727077961 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727116108 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727123976 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727161884 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727257967 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727428913 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727556944 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727622032 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727628946 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727654934 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727663040 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727665901 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727674961 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:05.727683067 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:06.046797991 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:06.100114107 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.120930910 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.126060963 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.243695974 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.244256020 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.244992018 CEST	587	49741	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.245569944 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.245626926 CEST	49741	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.250526905 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.250617981 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.768038988 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.768165112 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.773277998 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.887080908 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:13.887222052 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:13.892235994 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.005939960 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.006782055 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.013688087 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.127577066 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.128566980 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.128961086 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.133377075 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.133747101 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.315753937 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.316011906 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.321027040 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.434339046 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.434632063 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.439441919 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.552906036 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.553131104 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.558223009 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.671668053 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.671859026 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.676634073 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.799123049 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:14.804847002 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:14.815395117 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.070517063 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.071005106 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.071006060 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.071063042 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.071178913 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.072699070 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.075949907 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.075958967 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.075963020 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.075965881 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.076095104 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.077548981 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077569962 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077579021 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077716112 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077728033 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077737093 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.077761889 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.077884912 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.078787088 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.080780029 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.080789089 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.080914974 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.081093073 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.081198931 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.081418991 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.082590103 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.082711935 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.086883068 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.087121964 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.087583065 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.088975906 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.092071056 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092144012 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092251062 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092259884 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092272997 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092313051 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092319965 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092340946 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.092372894 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:15.092447996 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.093892097 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.093910933 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.093919039 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.093977928 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.093995094 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.094002008 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097280979 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097296953 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097383976 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097424984 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097450018 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097459078 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.097466946 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.394517899 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:15.444848061 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.041538000 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.046530008 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.160943031 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.161257029 CEST	587	49742	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.161345959 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.161345959 CEST	49742	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.162152052 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.166991949 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.167100906 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.700923920 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.703433037 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.708271027 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.822134018 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.837735891 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.842573881 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.957905054 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:19.958225012 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:19.963042974 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.077212095 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.077924967 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.078432083 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.083267927 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.083277941 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.353674889 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.353913069 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.570664883 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.570710897 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.571238041 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.685388088 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.685648918 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.690485954 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.811969995 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.814992905 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.820652008 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.934665918 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:20.935005903 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:20.939848900 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.054924965 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.055080891 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.060044050 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.174253941 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.174632072 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.174632072 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.174787045 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.174787045 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.175968885 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.179635048 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.179645061 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.179652929 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.179723024 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.179754972 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.180831909 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.180882931 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.180891991 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.180917025 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.180999994 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.181138039 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.183131933 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.184752941 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.184789896 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.184827089 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.185127974 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.186340094 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.186408997 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.186418056 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.186508894 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.186562061 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.186592102 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.186711073 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.188085079 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.188148022 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.188153028 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.188241005 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.189737082 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.189801931 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.189935923 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.190016031 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.191222906 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.191343069 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.191564083 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.191647053 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:21.191668987 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.191731930 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.192985058 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.193022966 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.193152905 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.193228006 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.193281889 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.194581032 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.194725037 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.194734097 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195003986 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195055962 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195065975 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195116043 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195125103 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195133924 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.195142031 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196027040 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196034908 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196125031 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196180105 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196424007 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196497917 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196516991 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196624041 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196631908 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196635962 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196645975 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196722984 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.196731091 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.516108036 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:21.569372892 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.014761925 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.020145893 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.135061026 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.135461092 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.135746956 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.135791063 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.135826111 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.135871887 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.136485100 CEST	49744	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.140284061 CEST	587	49743	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.140321016 CEST	49743	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:26.141323090 CEST	587	49744	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:26.141381979 CEST	49744	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:34.866244078 CEST	49744	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:34.871145964 CEST	587	49744	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:34.871325016 CEST	49744	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:34.916862965 CEST	49745	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:34.921623945 CEST	587	49745	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:34.925121069 CEST	49745	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:44.803436995 CEST	49745	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:44.808815002 CEST	587	49745	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:44.815448046 CEST	587	49745	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:44.820871115 CEST	49745	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:44.860982895 CEST	49746	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:44.865803957 CEST	587	49746	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:44.869134903 CEST	49746	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:45.991039038 CEST	49746	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:45.995910883 CEST	587	49746	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:45.995958090 CEST	49746	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:46.056376934 CEST	49747	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:18:46.061157942 CEST	587	49747	131.226.2.60	192.168.2.4
Jul 3, 2024 03:18:46.061238050 CEST	49747	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:03.319068909 CEST	49747	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:03.326540947 CEST	587	49747	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:03.326616049 CEST	49747	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:03.372992992 CEST	49748	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:03.377849102 CEST	587	49748	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:03.378011942 CEST	49748	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:07.258912086 CEST	49748	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:07.263876915 CEST	587	49748	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:07.263984919 CEST	49748	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:07.310806036 CEST	49749	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:07.315836906 CEST	587	49749	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:07.316003084 CEST	49749	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:24.131589890 CEST	49749	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:24.136845112 CEST	587	49749	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:24.136905909 CEST	49749	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:24.207015991 CEST	49750	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:24.212837934 CEST	587	49750	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:24.212905884 CEST	49750	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:27.852933884 CEST	49750	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:27.857892036 CEST	587	49750	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:27.857965946 CEST	49750	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:27.907181978 CEST	49751	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:27.911977053 CEST	587	49751	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:27.912043095 CEST	49751	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:30.553442001 CEST	49751	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:30.558444977 CEST	587	49751	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:30.558499098 CEST	49751	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:30.613245964 CEST	49752	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:30.618006945 CEST	587	49752	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:30.618182898 CEST	49752	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:41.381830931 CEST	49752	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:41.386779070 CEST	587	49752	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:41.387061119 CEST	49752	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:41.480988026 CEST	49753	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:41.487238884 CEST	587	49753	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:41.487371922 CEST	49753	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:50.975445032 CEST	49753	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:50.980551004 CEST	587	49753	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:50.983041048 CEST	49753	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.026958942 CEST	49754	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.031896114 CEST	587	49754	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:51.035063028 CEST	49754	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.866949081 CEST	49754	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.872438908 CEST	587	49754	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:51.872546911 CEST	49754	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.916271925 CEST	49755	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:51.921063900 CEST	587	49755	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:51.921209097 CEST	49755	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:56.334696054 CEST	49755	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:56.339658022 CEST	587	49755	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:56.339843988 CEST	49755	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:56.384816885 CEST	49756	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:56.389673948 CEST	587	49756	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:56.389800072 CEST	49756	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:58.610620975 CEST	49756	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:58.615505934 CEST	587	49756	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:58.615603924 CEST	49756	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:58.682368040 CEST	49757	587	192.168.2.4	131.226.2.60
Jul 3, 2024 03:19:58.687339067 CEST	587	49757	131.226.2.60	192.168.2.4
Jul 3, 2024 03:19:58.687424898 CEST	49757	587	192.168.2.4	131.226.2.60

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 03:15:53.620507002 CEST	49905	53	192.168.2.4	1.1.1.1
Jul 3, 2024 03:15:53.627037048 CEST	53	49905	1.1.1.1	192.168.2.4
Jul 3, 2024 03:15:54.404597998 CEST	50419	53	192.168.2.4	1.1.1.1
Jul 3, 2024 03:15:54.411454916 CEST	53	50419	1.1.1.1	192.168.2.4
Jul 3, 2024 03:15:55.445602894 CEST	56299	53	192.168.2.4	1.1.1.1
Jul 3, 2024 03:15:55.567943096 CEST	53	56299	1.1.1.1	192.168.2.4
Jul 3, 2024 03:17:41.573115110 CEST	63600	53	192.168.2.4	1.1.1.1
Jul 3, 2024 03:17:41.985117912 CEST	53	63600	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 03:15:53.620507002 CEST	192.168.2.4	1.1.1.1	0xba70	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:54.404597998 CEST	192.168.2.4	1.1.1.1	0x5faa	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:55.445602894 CEST	192.168.2.4	1.1.1.1	0x518f	Standard query (0)	mail.myhydropowered.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:17:41.573115110 CEST	192.168.2.4	1.1.1.1	0xf6b5	Standard query (0)	mail.myhydropowered.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 03:15:53.627037048 CEST	1.1.1.1	192.168.2.4	0xba70	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:53.627037048 CEST	1.1.1.1	192.168.2.4	0xba70	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:53.627037048 CEST	1.1.1.1	192.168.2.4	0xba70	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:54.411454916 CEST	1.1.1.1	192.168.2.4	0x5faa	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:15:55.567943096 CEST	1.1.1.1	192.168.2.4	0x518f	Server failure (2)	mail.myhydropowered.com	none	none	A (IP address)	IN (0x0001)	false
Jul 3, 2024 03:17:41.985117912 CEST	1.1.1.1	192.168.2.4	0xf6b5	No error (0)	mail.myhydropowered.com		131.226.2.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	7108	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 03:15:54.417366982 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 03:15:54.936553001 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 01:15:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.74.152	443	7108	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 01:15:54 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-07-03 01:15:54 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 01:15:54 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 89d306f09dec0f6d-EWR
2024-07-03 01:15:54 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 03:17:42.583142042 CEST	587	49739	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Jul 3, 2024 03:17:42.583350897 CEST	49739	587	192.168.2.4	131.226.2.60	EHLO 210979
Jul 3, 2024 03:17:42.701948881 CEST	587	49739	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 3, 2024 03:17:42.706800938 CEST	49739	587	192.168.2.4	131.226.2.60	STARTTLS
Jul 3, 2024 03:17:42.984982967 CEST	587	49739	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 3, 2024 03:17:49.551963091 CEST	587	49740	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Jul 3, 2024 03:17:49.552153111 CEST	49740	587	192.168.2.4	131.226.2.60	EHLO 210979
Jul 3, 2024 03:17:49.671164036 CEST	587	49740	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 3, 2024 03:17:49.671614885 CEST	49740	587	192.168.2.4	131.226.2.60	STARTTLS
Jul 3, 2024 03:17:49.790863037 CEST	587	49740	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 3, 2024 03:18:04.451486111 CEST	587	49741	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Jul 3, 2024 03:18:04.451678991 CEST	49741	587	192.168.2.4	131.226.2.60	EHLO 210979
Jul 3, 2024 03:18:04.573666096 CEST	587	49741	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 3, 2024 03:18:04.573820114 CEST	49741	587	192.168.2.4	131.226.2.60	STARTTLS
Jul 3, 2024 03:18:04.696913004 CEST	587	49741	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 3, 2024 03:18:13.768038988 CEST	587	49742	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Jul 3, 2024 03:18:13.768165112 CEST	49742	587	192.168.2.4	131.226.2.60	EHLO 210979
Jul 3, 2024 03:18:13.887080908 CEST	587	49742	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 3, 2024 03:18:13.887222052 CEST	49742	587	192.168.2.4	131.226.2.60	STARTTLS
Jul 3, 2024 03:18:14.005939960 CEST	587	49742	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 3, 2024 03:18:19.700923920 CEST	587	49743	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Jul 3, 2024 03:18:19.703433037 CEST	49743	587	192.168.2.4	131.226.2.60	EHLO 210979
Jul 3, 2024 03:18:19.822134018 CEST	587	49743	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Jul 3, 2024 03:18:19.837735891 CEST	49743	587	192.168.2.4	131.226.2.60	STARTTLS
Jul 3, 2024 03:18:19.957905054 CEST	587	49743	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	21:15:50
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\roger.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\roger.exe"
Imagebase:	0x3e0000
File size:	1'056'768 bytes
MD5 hash:	B5214F81BF6B76F46D37A434A9CDEC39
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1639756802.0000000003D30000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:15:51
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\roger.exe"
Imagebase:	0x150000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4086490674.00000000024EC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4085275933.0000000000522000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6%
Total number of Nodes:	2000
Total number of Limit Nodes:	174

Executed Functions

Function 003E3B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003E3B7A
IsDebuggerPresent.KERNEL32 ref: 003E3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,004A62F8,004A62E0,?,?), ref: 003E3BFD

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Part of subcall function 003F0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,003E3C26,004A62F8,?,?,?), ref: 003F0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 003E3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004993F0,00000010), ref: 0041D4BC
SetCurrentDirectoryW.KERNEL32(?,004A62F8,?,?,?), ref: 0041D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00495D40,004A62F8,?,?,?), ref: 0041D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0041D581

Part of subcall function 003E3A58: GetSysColorBrush.USER32(0000000F), ref: 003E3A62
Part of subcall function 003E3A58: LoadCursorW.USER32(00000000,00007F00), ref: 003E3A71
Part of subcall function 003E3A58: LoadIconW.USER32(00000063), ref: 003E3A88
Part of subcall function 003E3A58: LoadIconW.USER32(000000A4), ref: 003E3A9A
Part of subcall function 003E3A58: LoadIconW.USER32(000000A2), ref: 003E3AAC
Part of subcall function 003E3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003E3AD2
Part of subcall function 003E3A58: RegisterClassExW.USER32(?), ref: 003E3B28

Part of subcall function 003E39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003E3A15
Part of subcall function 003E39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 003E3A36
Part of subcall function 003E39E7: ShowWindow.USER32(00000000,?,?), ref: 003E3A4A
Part of subcall function 003E39E7: ShowWindow.USER32(00000000,?,?), ref: 003E3A53

Part of subcall function 003E43DB: _memset.LIBCMT ref: 003E4401
Part of subcall function 003E43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 003E44A6

Strings

This is a third-party compiled AutoIt script., xrefs: 0041D4B4
%G, xrefs: 003E3C56
runas, xrefs: 0041D575

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%G
API String ID: 529118366-1090065606
Opcode ID: 5d630b20b602ce76e9efdce6a123e8a8f8ed41edc49dc8c7e20d1d8a7949224d
Instruction ID: 9f21d4182dac84250756a551f43fb68350ac67d38460c5fca99d1a8605fec286
Opcode Fuzzy Hash: 5d630b20b602ce76e9efdce6a123e8a8f8ed41edc49dc8c7e20d1d8a7949224d
Instruction Fuzzy Hash: 56511972908298AACF13ABB6DC05BFD7F78AB05300B1442BAF451671D2DA789645CB29

Function 003E4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,003E4EEE,?,?,00000000,00000000), ref: 003E4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,003E4EEE,?,?,00000000,00000000), ref: 003E5010
LoadResource.KERNEL32(?,00000000,?,?,003E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,003E4F8F), ref: 0041DD60
SizeofResource.KERNEL32(?,00000000,?,?,003E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,003E4F8F), ref: 0041DD75
LockResource.KERNEL32(N>,?,?,003E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,003E4F8F,00000000), ref: 0041DD88

Strings

SCRIPT, xrefs: 003E5006
N>, xrefs: 0041DD85

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N>
API String ID: 3051347437-591640503
Opcode ID: 550739fdf18de15960694d785578e83adc8099f789e1747e292419dd02f66145
Instruction ID: 7c8a1f4ae5b4aade06ecba11a6e8b76c50e204a5c8752cabd3b801bf05fdd72b
Opcode Fuzzy Hash: 550739fdf18de15960694d785578e83adc8099f789e1747e292419dd02f66145
Instruction Fuzzy Hash: 73115E75200710AFD7218B66EC58F677BB9EBC9B15F204278F445C62A0EBA2EC048A65

Function 003E4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 003E4B2B

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

GetCurrentProcess.KERNEL32(?,0046FAEC,00000000,00000000,?), ref: 003E4BF8
IsWow64Process.KERNEL32(00000000), ref: 003E4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 003E4C45
FreeLibrary.KERNEL32(00000000), ref: 003E4C50
GetSystemInfo.KERNEL32(00000000), ref: 003E4C81
GetSystemInfo.KERNEL32(00000000), ref: 003E4C8D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 5e10156beb9b39f042e8a82e6e4c754e34df9474ba9207d4ad945191ea983f69
Instruction ID: b25a4cc70fbe0dd7f153d1c3c8556433873c87ce3c3b1150b335619bb78da644
Opcode Fuzzy Hash: 5e10156beb9b39f042e8a82e6e4c754e34df9474ba9207d4ad945191ea983f69
Instruction Fuzzy Hash: A991F37194A7D0DEC732CB6994511ABBFE4AF2A300B544E9ED0CB93B81D224F948C75E

Function 003EE800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 0042428C
DtJ, xrefs: 00423F58
DtJ, xrefs: 003EEC1A
DtJ, xrefs: 00423F1F
DtJ, xrefs: 003EEC21

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: DtJ$DtJ$DtJ$DtJ$Variable must be of type 'Object'.
API String ID: 0-3714430436
Opcode ID: ea4fc543d1ad42a842a46f2d757cdc82e24085c601a8ed45c924d566e96ca0f1
Instruction ID: 525d294252dad3ef859f7de5bf740ba427494c21f06cb27d06b73309bb0c64aa
Opcode Fuzzy Hash: ea4fc543d1ad42a842a46f2d757cdc82e24085c601a8ed45c924d566e96ca0f1
Instruction Fuzzy Hash: 34A2F674A04265CFCB25CF56C880AAEB7F5FF48304F65826AE906AB391D774EC42CB45

Function 00444696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0041E7C1), ref: 004446A6
FindFirstFileW.KERNELBASE(?,?), ref: 004446B7
FindClose.KERNEL32(00000000), ref: 004446C7

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 977d0d9dc9a88411f889471dc2cead35382d479db3cb83c21de47fc086021878
Instruction ID: 1e897619c5a59fd45fa29e1187d27c0f2aed32bc99de6f73592b497507ed852d
Opcode Fuzzy Hash: 977d0d9dc9a88411f889471dc2cead35382d479db3cb83c21de47fc086021878
Instruction Fuzzy Hash: E5E092314104005B52106638AC4D4EA765C9A46335B100766F875C11E0E7B85954899E

Function 003F0B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003F0BBB
timeGetTime.WINMM ref: 003F0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 003F0FB3
TranslateMessage.USER32(?), ref: 003F0FC7
DispatchMessageW.USER32(?), ref: 003F0FD5
Sleep.KERNEL32(0000000A), ref: 003F0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 003F105A
DestroyWindow.USER32 ref: 003F1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 003F1080
Sleep.KERNEL32(0000000A,?,?), ref: 004252AD
TranslateMessage.USER32(?), ref: 0042608A
DispatchMessageW.USER32(?), ref: 00426098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004260AC

Strings

@TRAY_ID, xrefs: 00425BB9
@GUI_WINHANDLE, xrefs: 004253B9
prJ, xrefs: 004253D8
prJ, xrefs: 00425383
prJ, xrefs: 0042542D
@GUI_CTRLID, xrefs: 00425364
prJ, xrefs: 00425BDE
@COM_EVENTOBJ, xrefs: 0042591A
@GUI_CTRLHANDLE, xrefs: 0042540E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$prJ$prJ$prJ$prJ
API String ID: 4003667617-4250918032
Opcode ID: 41a2bc2b0467ce70e05b59cfacadc47e06f3fa6cc7b2c9cb3b66f36291a2d321
Instruction ID: 5aae6d4ee14b61c250b31e7fe1b9e833cb0eee44528c169837aa8114b0397d79
Opcode Fuzzy Hash: 41a2bc2b0467ce70e05b59cfacadc47e06f3fa6cc7b2c9cb3b66f36291a2d321
Instruction Fuzzy Hash: C1B21570608751DFD729DF24D884BAABBE4BF84304F54492EF5898B2A1DB74EC44CB86

Function 004493DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004491E9: __time64.LIBCMT ref: 004491F3

Part of subcall function 003E5045: _fseek.LIBCMT ref: 003E505D

__wsplitpath.LIBCMT ref: 004494BE

Part of subcall function 0040432E: __wsplitpath_helper.LIBCMT ref: 0040436E

_wcscpy.LIBCMT ref: 004494D1
_wcscat.LIBCMT ref: 004494E4
__wsplitpath.LIBCMT ref: 00449509
_wcscat.LIBCMT ref: 0044951F
_wcscat.LIBCMT ref: 00449532

Part of subcall function 0044922F: _memmove.LIBCMT ref: 00449268
Part of subcall function 0044922F: _memmove.LIBCMT ref: 00449277

_wcscmp.LIBCMT ref: 00449479

Part of subcall function 004499BE: _wcscmp.LIBCMT ref: 00449AAE
Part of subcall function 004499BE: _wcscmp.LIBCMT ref: 00449AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 004496DC
_wcsncpy.LIBCMT ref: 0044974F
DeleteFileW.KERNEL32(?,?), ref: 00449785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0044979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004497AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004497BE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 5b163b52cb82e8bf099888e3169a1484661b2b7205f6c51c6e0f974554bd3469
Instruction ID: 18df4631afeeff4775f73db58b248f5bf1ca289d9e831873ac2dfbbb0825d540
Opcode Fuzzy Hash: 5b163b52cb82e8bf099888e3169a1484661b2b7205f6c51c6e0f974554bd3469
Instruction Fuzzy Hash: 4CC13AB1900229AADF21DF95CC85ADFB7BDEF44304F0040ABF609E6251EB749E449F69

Function 003E3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003E3074
RegisterClassExW.USER32(00000030), ref: 003E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003E30AF
InitCommonControlsEx.COMCTL32(?), ref: 003E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003E30DC
LoadIconW.USER32(000000A9), ref: 003E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003E3101

Strings

+, xrefs: 003E305D
0, xrefs: 003E3056
TaskbarCreated, xrefs: 003E30A4
AutoIt v3 GUI, xrefs: 003E3090

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 01ecac4c2657f5512f426fe8a1b991cca2ee4b82eace8cd6483e2dab740fc77c
Instruction ID: 421f3cfc191c22d73fadbfe0f4a535cff6389c1f64cdd1b0fe1817bc46355877
Opcode Fuzzy Hash: 01ecac4c2657f5512f426fe8a1b991cca2ee4b82eace8cd6483e2dab740fc77c
Instruction Fuzzy Hash: 9B315CB1941305EFDB00DFA4E849AC9BFF4FB09310F14456EE580E6291E3BA4546CF55

Function 003E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003E3074
RegisterClassExW.USER32(00000030), ref: 003E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003E30AF
InitCommonControlsEx.COMCTL32(?), ref: 003E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003E30DC
LoadIconW.USER32(000000A9), ref: 003E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003E3101

Strings

+, xrefs: 003E305D
0, xrefs: 003E3056
TaskbarCreated, xrefs: 003E30A4
AutoIt v3 GUI, xrefs: 003E3090

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 09ec76621777637d635813f832c9d462ba93eeda806fd7dcc57aaf15740d89a8
Instruction ID: 0d7a015688df1b90bb4f14ab5435234ea3041f85526d837465af813dcc21e0d8
Opcode Fuzzy Hash: 09ec76621777637d635813f832c9d462ba93eeda806fd7dcc57aaf15740d89a8
Instruction Fuzzy Hash: 7521F7B1901218AFDB00EFA4EC49BDDBFF8FB09701F05453AF550A62A0E7B545488F9A

Function 003E71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003E4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,004A62F8,?,003E37C0,?), ref: 003E4882

Part of subcall function 0040074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,003E72C5), ref: 00400771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 003E7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0041ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0041ED32
RegCloseKey.ADVAPI32(?), ref: 0041ED70
_wcscat.LIBCMT ref: 0041EDC9

Strings

\Include\, xrefs: 003E72C5
Software\AutoIt v3\AutoIt, xrefs: 003E72FE
Include, xrefs: 0041ECE8, 0041ED29
\, xrefs: 0041EDEC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 0ad991d0afdcc883b6dfe5b8755705c6866fbdbb080b2f481e38a473c0a47474
Instruction ID: 221f92fa087889645c0c7e169389289b1db05887d5208e0bf152fef0b2bf3b1f
Opcode Fuzzy Hash: 0ad991d0afdcc883b6dfe5b8755705c6866fbdbb080b2f481e38a473c0a47474
Instruction Fuzzy Hash: 3A71A17210C3419EC325DF66EC81A9BBBE8FF99340F40457EF445971A1EB709948CB9A

Function 003E3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 003E36D2
KillTimer.USER32(?,00000001), ref: 003E36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003E371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003E372A
CreatePopupMenu.USER32 ref: 003E373E
PostQuitMessage.USER32(00000000), ref: 003E375F

Strings

%G, xrefs: 0041D2D1, 0041D31F
TaskbarCreated, xrefs: 003E3725

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%G
API String ID: 129472671-2693064965
Opcode ID: 9069ab8c5883584aeda13d6a842e3c90505211691590b96edd0dae3713fd36a2
Instruction ID: e6b812e63a0fac7fe3b9dedad63379e59f59068a73575115b29ff1e3639075b0
Opcode Fuzzy Hash: 9069ab8c5883584aeda13d6a842e3c90505211691590b96edd0dae3713fd36a2
Instruction Fuzzy Hash: 37413AF2200195ABDF126F75EC4DB7A3B58E715300F19033AF912872E1DBB89D44976A

Function 003E3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003E3A62
LoadCursorW.USER32(00000000,00007F00), ref: 003E3A71
LoadIconW.USER32(00000063), ref: 003E3A88
LoadIconW.USER32(000000A4), ref: 003E3A9A
LoadIconW.USER32(000000A2), ref: 003E3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 003E3AD2
RegisterClassExW.USER32(?), ref: 003E3B28

Part of subcall function 003E3041: GetSysColorBrush.USER32(0000000F), ref: 003E3074
Part of subcall function 003E3041: RegisterClassExW.USER32(00000030), ref: 003E309E
Part of subcall function 003E3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 003E30AF
Part of subcall function 003E3041: InitCommonControlsEx.COMCTL32(?), ref: 003E30CC
Part of subcall function 003E3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 003E30DC
Part of subcall function 003E3041: LoadIconW.USER32(000000A9), ref: 003E30F2
Part of subcall function 003E3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 003E3101

Strings

AutoIt v3, xrefs: 003E3B17
0, xrefs: 003E3B06
#, xrefs: 003E3B0D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 7aaff6c633cfb4003b8a5a724e05da24574b7be984634bd6370706d737f439a6
Instruction ID: de4d99eaf5ae55be088ad17f14a0dc1d680e9502c43acd4b09a37056b0e92014
Opcode Fuzzy Hash: 7aaff6c633cfb4003b8a5a724e05da24574b7be984634bd6370706d737f439a6
Instruction Fuzzy Hash: 46217CB6E00308AFEB10AFA4EC09B9D7FB4FB09711F05017AF500A62E0D3B656448F89

Function 003E3778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 003E38A4
CMDLINE, xrefs: 003E3834
bJ, xrefs: 0041D44E
CMDLINERAW, xrefs: 003E380D
/AutoIt3ExecuteLine, xrefs: 003E38B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 003E37C0
/AutoIt3ExecuteScript, xrefs: 003E38CE
/ErrorStdOut, xrefs: 003E388F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$bJ
API String ID: 1825951767-3700662769
Opcode ID: 8bacb2529c75527d4ce9106836d9665d188b8dccb2eff1c8969e07699a58e1da
Instruction ID: 2d5e98e9a4e38df0b5460ff5352f07278b59548c84aa8e1d7961bbc285f2cb13
Opcode Fuzzy Hash: 8bacb2529c75527d4ce9106836d9665d188b8dccb2eff1c8969e07699a58e1da
Instruction Fuzzy Hash: 4CA15272D1027D9ACB06EFA2DC95AEEB778BF14300F14022AF4167B1D1EB745A09CB64

Function 003EF8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004003A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 004003D3
Part of subcall function 004003A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 004003DB
Part of subcall function 004003A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004003E6
Part of subcall function 004003A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004003F1
Part of subcall function 004003A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 004003F9
Part of subcall function 004003A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00400401

Part of subcall function 003F6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,003EFA90), ref: 003F62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 003EFB2D
OleInitialize.OLE32(00000000), ref: 003EFBAA
CloseHandle.KERNEL32(00000000), ref: 004249F2

Strings

%G, xrefs: 003EF8F6, 003EF908, 003EFACE, 003EFBB1
\dJ, xrefs: 003EF957
cJ, xrefs: 003EF94B
<gJ, xrefs: 003EFA90

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <gJ$\dJ$%G$cJ
API String ID: 1986988660-1135129098
Opcode ID: d25fe843e4150e46764496936bfc74aec9ed76364969de8147bfb03e719b3832
Instruction ID: 0eda8e4bc8451f1822b19db9b0b6d9951652cc4e8cec4fb10cfd28059a5dc9e5
Opcode Fuzzy Hash: d25fe843e4150e46764496936bfc74aec9ed76364969de8147bfb03e719b3832
Instruction Fuzzy Hash: F981CBB49152908FCB84DF3AED446657FE4EB6E30871A813ED429CB2A2EB794405CF1D

Function 021225F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 021226C1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 021228E7

Memory Dump Source

Source File: 00000000.00000002.1639724238.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_roger.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: 316ec29dd2a03aedd595eebf0837d75d86e7c031e274481e6fade85117143b7d
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: C0A12974E40218EBDB18CFA4C894BEEB7B5FF48304F208569E911BB280D7799A55CF94

Function 003E39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003E3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 003E3A36
ShowWindow.USER32(00000000,?,?), ref: 003E3A4A
ShowWindow.USER32(00000000,?,?), ref: 003E3A53

Strings

edit, xrefs: 003E3A30
AutoIt v3, xrefs: 003E3A0D, 003E3A12, 003E3A13

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 1e9258dc53fd7b2c1c411d111add1d5f900caa6325702fefe9f812d07a7f7757
Instruction ID: 5306a2f54506480116609c2ea575bf314cbb8d2745888758cbcca2e7905e101b
Opcode Fuzzy Hash: 1e9258dc53fd7b2c1c411d111add1d5f900caa6325702fefe9f812d07a7f7757
Instruction Fuzzy Hash: 08F03A726002907EEE3027237C08F272E7DD7C7F50B06407AB900A2170D6A50804DAB9

Function 021223B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 021222A0: Sleep.KERNELBASE(000001F4), ref: 021222B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 021224DF

Strings

W74LMD7MA5CRP54, xrefs: 02122542, 02122545

Memory Dump Source

Source File: 00000000.00000002.1639724238.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_roger.jbxd

Similarity

API ID: CreateFileSleep
String ID: W74LMD7MA5CRP54
API String ID: 2694422964-2870601654
Opcode ID: c24bcdd89d0e324870642af994fd5a5188edf8a096aa0eb43d87af9e48fa3335
Instruction ID: c9b69f9a13e230f77551424be7d41e82fc94e22fb9201e756e3e4381d8ad2e73
Opcode Fuzzy Hash: c24bcdd89d0e324870642af994fd5a5188edf8a096aa0eb43d87af9e48fa3335
Instruction Fuzzy Hash: 61519070E14258EBEF11DBE4C815BEEBB79AF58300F004199E608BB2C0D7B91B49CB65

Function 003E410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0041D5EC

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

_memset.LIBCMT ref: 003E418D
_wcscpy.LIBCMT ref: 003E41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003E41F1

Strings

Line: , xrefs: 0041D615

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: ea495407567b1b55c19ebf8214b739d182678c75c5b01c354e097c1790aad5f0
Instruction ID: 72e794f2b9c60a3b8b1be6be8bff31b6ad797de7bd2610eed7b3bd5f06380149
Opcode Fuzzy Hash: ea495407567b1b55c19ebf8214b739d182678c75c5b01c354e097c1790aad5f0
Instruction Fuzzy Hash: AB31F3720083A4AAD722EB61DC45BDB77ECAF55300F14462EF184960E1EB74A648C79B

Function 0040564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 004056AB
_memcpy_s.LIBCMT ref: 0040571D
__read_nolock.LIBCMT ref: 0040577B
__filbuf.LIBCMT ref: 0040579E
_memset.LIBCMT ref: 004057E2

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 437db6c28e50dfa5bdb4c909287fc8fb638db0c5639253617863f475e4651f60
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 1451C130A00B05DBDB249E79888066F77A5EF40320F248B3FE829A73D0D7799D51AF58

Function 003E69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 003E4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,004A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 003E4F6F

_free.LIBCMT ref: 0041E68C
_free.LIBCMT ref: 0041E6D3

Part of subcall function 003E6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 003E6D0D

Strings

Bad directive syntax error, xrefs: 0041E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0041E462

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 3c769231807cfde6293b5ee904733f37e27d38349602a6b755e3a7971d4d47fd
Instruction ID: d57c6497ffdc78b58cc26c5e6a7e713bd23b20bec39ddb43ed232fcf5766364e
Opcode Fuzzy Hash: 3c769231807cfde6293b5ee904733f37e27d38349602a6b755e3a7971d4d47fd
Instruction Fuzzy Hash: 3891C371910269EFCF05DFA6CC819EEB7B4FF18314F50452AF811AB291EB38A945CB58

Function 003E35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,003E35A1,SwapMouseButtons,00000004,?), ref: 003E35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,003E35A1,SwapMouseButtons,00000004,?,?,?,?,003E2754), ref: 003E35F5
RegCloseKey.KERNELBASE(00000000,?,?,003E35A1,SwapMouseButtons,00000004,?,?,?,?,003E2754), ref: 003E3617

Strings

Control Panel\Mouse, xrefs: 003E35D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2388d82061dd99fbb53559612d0d0553941eb3701bb2e32d8609a51b3d9e5aa4
Instruction ID: 06e3071cfbd1101a5afc63bba642f2ae18fd7221ad7aa77f33a0abc72bf4fcea
Opcode Fuzzy Hash: 2388d82061dd99fbb53559612d0d0553941eb3701bb2e32d8609a51b3d9e5aa4
Instruction Fuzzy Hash: 5F115A71514268BFDB21CFA5EC88DAEB7BCEF05740F014669F805D7250E2719F449764

Function 021212A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 02121ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 02121AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02121B13

Memory Dump Source

Source File: 00000000.00000002.1639724238.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_roger.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction ID: f4823a324a5d89c8551be7a430316f022049dc37d3f415c4b301479a89e04476
Opcode Fuzzy Hash: 91de96a0508c6d9b88b93d6c14255c09b3dee72855056c89e06ebe7f8a996ab2
Instruction Fuzzy Hash: 1E621C30A54258DBEB24CFA4C840BDEB372EF58300F1091A9E10DEB395E7769E95CB59

Function 004497E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 003E5045: _fseek.LIBCMT ref: 003E505D

Part of subcall function 004499BE: _wcscmp.LIBCMT ref: 00449AAE
Part of subcall function 004499BE: _wcscmp.LIBCMT ref: 00449AC1

_free.LIBCMT ref: 0044992C
_free.LIBCMT ref: 00449933
_free.LIBCMT ref: 0044999E

Part of subcall function 00402F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00409C64), ref: 00402FA9
Part of subcall function 00402F95: GetLastError.KERNEL32(00000000,?,00409C64), ref: 00402FBB

_free.LIBCMT ref: 004499A6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 019ba2db4e178a483b2498eea05ce3d937e0b017790b401142914c27c5c229c1
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 19516DF1904258AFDF259F65CC85A9EBBB9EF48304F0004AEB609A7381DB755E80CF59

Function 0040493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004049D0
__flush.LIBCMT ref: 004049F0
__write.LIBCMT ref: 00404A23
__flsbuf.LIBCMT ref: 00404A51

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 5402aa5ba69a83e31164145637fc3e4516d7592e1e1dcff8605aa78d7e97d373
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 7C41B4F0B006059BDB188EB9C88096F77A5EFC4364B24813FEA55A76D0D6789D418B4C

Function 003E4DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003E4E1A

Strings

AU3!P/G, xrefs: 003E4E14
EA06, xrefs: 0041DCF5

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/G$EA06
API String ID: 4104443479-1209337468
Opcode ID: dba146eaed68eb28391ef1434c9260672caddc6560ea6d272d21c2d98f3b001f
Instruction ID: e1e4adf8e2689c308b143ad6056bd7efcba9217ae54d3bfe8d777d9aafceac60
Opcode Fuzzy Hash: dba146eaed68eb28391ef1434c9260672caddc6560ea6d272d21c2d98f3b001f
Instruction Fuzzy Hash: DE416C71A041F45BDF235B6688517FF7B65AB8D300F284265F882AA6C2D5359D4083E1

Function 003E73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041EE62
GetOpenFileNameW.COMDLG32(?), ref: 0041EEAC

Part of subcall function 003E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003E48A1,?,?,003E37C0,?), ref: 003E48CE

Part of subcall function 004009D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004009F4

Strings

X, xrefs: 0041EE7A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 90f26cac46fba1f0cf9ac52c633e57c11a1f7a87e957dc041f35e9b23dd3b18c
Instruction ID: 3483c1207b2ebb30ff0fbbd2ede1057a7bd8597a8e8bc335f1a327046fde4294
Opcode Fuzzy Hash: 90f26cac46fba1f0cf9ac52c633e57c11a1f7a87e957dc041f35e9b23dd3b18c
Instruction Fuzzy Hash: B921C6719042989BDF11DF95C845BEE7BFC9F49304F00806AE408EB281DBB859898F95

Function 0044901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00449036
__fread_nolock.LIBCMT ref: 0044904B

Strings

EA06, xrefs: 0044907D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 29ba9d2630ac1738c95b027383724dd2eddaf13c515c4a183b63acce945623ef
Instruction ID: dd4af0d79a275fc0ee68a5b691c737665328432654fe1aab7d3c4b5cd8d858d8
Opcode Fuzzy Hash: 29ba9d2630ac1738c95b027383724dd2eddaf13c515c4a183b63acce945623ef
Instruction Fuzzy Hash: EB01FE728042186EDB24D699C816FEF7BFCDB01305F00415FF552D21C1D579A6189B64

Function 00449B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00449B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00449B99

Strings

aut, xrefs: 00449B93

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: fc0882f4d0caec61d6eea5a06a11b1928005a35b8effe1f2b014d5e51f927ecc
Instruction ID: 09082295fe395a3d813ceeb0459d0f831b2524348a6b5833e9b243b60029f22e
Opcode Fuzzy Hash: fc0882f4d0caec61d6eea5a06a11b1928005a35b8effe1f2b014d5e51f927ecc
Instruction Fuzzy Hash: BBD0127554030D6BDA109B90EC0DF96772C9704704F0041B1BA9491091E9B565988A96

Function 0045CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0414e910963165bf1dc3510261f367554d210b9c12ad15a7ad888dfd15a89a9b
Instruction ID: d05b03768a6fa32055d9c33fa5f586749d8760bc7ecd3b9fdab813f0b6752cc2
Opcode Fuzzy Hash: 0414e910963165bf1dc3510261f367554d210b9c12ad15a7ad888dfd15a89a9b
Instruction Fuzzy Hash: 2BF17F709043419FC724DF25C480A6ABBE5FF88318F14896EF8999B392D735E945CF86

Function 003E43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003E4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 003E44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 003E44C3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 9fd8971443252f3d84499a03421db654c9178ab91c83b539352a1901dd422554
Instruction ID: 9625e2b3b92c427a6a4757facb0a3298ed0017e9028323db87aa502c6eb200a9
Opcode Fuzzy Hash: 9fd8971443252f3d84499a03421db654c9178ab91c83b539352a1901dd422554
Instruction Fuzzy Hash: C33181B16043518FD721DF26D884797BBE8FB49308F040A3EF59A832C0E7B5A948CB56

Function 0040594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00405963

Part of subcall function 0040A3AB: __NMSG_WRITE.LIBCMT ref: 0040A3D2
Part of subcall function 0040A3AB: __NMSG_WRITE.LIBCMT ref: 0040A3DC

__NMSG_WRITE.LIBCMT ref: 0040596A

Part of subcall function 0040A408: GetModuleFileNameW.KERNEL32(00000000,004A43BA,00000104,?,00000001,00000000), ref: 0040A49A
Part of subcall function 0040A408: ___crtMessageBoxW.LIBCMT ref: 0040A548

Part of subcall function 004032DF: ___crtCorExitProcess.LIBCMT ref: 004032E5
Part of subcall function 004032DF: ExitProcess.KERNEL32 ref: 004032EE

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

RtlAllocateHeap.NTDLL(01320000,00000000,00000001,00000000,?,?,?,00401013,?), ref: 0040598F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 1801ae727361fe8c5d3077a2867ff43c775d120608eed5167f0954a4f84f5d8c
Instruction ID: 87fc5ee7104d71abc29648184bebfb8970b461244d00a5c89019539e07fbee14
Opcode Fuzzy Hash: 1801ae727361fe8c5d3077a2867ff43c775d120608eed5167f0954a4f84f5d8c
Instruction Fuzzy Hash: 0C01D2B2200B11EEE6112B76EC42B6F7658CF82775F10013FF801BA2D1DABC9D018A6D

Function 00449B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,004497D2,?,?,?,?,?,00000004), ref: 00449B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,004497D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00449B5B
CloseHandle.KERNEL32(00000000,?,004497D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00449B62

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 232e6207d5373672403c93344a819a2e41b4aec15be5451f089507c8e5c50c60
Instruction ID: 486458782ce3b982f7bafa9724d4feb620ac93ce6df4b8d3d28b3fb69fa506ed
Opcode Fuzzy Hash: 232e6207d5373672403c93344a819a2e41b4aec15be5451f089507c8e5c50c60
Instruction Fuzzy Hash: 5BE08632581214B7E7211B54FC09FCA7B58EB067A1F104131FB94691E097F12D15979D

Function 00448F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00448FA5

Part of subcall function 00402F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00409C64), ref: 00402FA9
Part of subcall function 00402F95: GetLastError.KERNEL32(00000000,?,00409C64), ref: 00402FBB

_free.LIBCMT ref: 00448FB6
_free.LIBCMT ref: 00448FC8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 279d5859a2626b9177697d5f88b5337d91637f6cb33b95f6d7558dbde7387eec
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 6AE0C2A16087124ADA20A639AE04A8717EE1F88398708082FB409EB2C2DE7CE840902C

Function 003EAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0042002B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: c0a13f88667bf7a7d16938af5e840135c290c160e2514ccdb1769d704936eb29
Instruction ID: 297d14dfd02fc597c1b60924528d66ccb5f834da838ee27d02e55d1600cc903b
Opcode Fuzzy Hash: c0a13f88667bf7a7d16938af5e840135c290c160e2514ccdb1769d704936eb29
Instruction Fuzzy Hash: F2226E706083A1CFC726DF15C490B2AB7E1BF84304F158A6EE8869B7A2D735ED45CB46

Function 003E492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 003E4992

Part of subcall function 004035AC: __lock.LIBCMT ref: 004035B2
Part of subcall function 004035AC: DecodePointer.KERNEL32(00000001,?,003E49A7,004381BC), ref: 004035BE
Part of subcall function 004035AC: EncodePointer.KERNEL32(?,?,003E49A7,004381BC), ref: 004035C9

Part of subcall function 003E4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 003E4A73
Part of subcall function 003E4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 003E4A88

Part of subcall function 003E3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003E3B7A
Part of subcall function 003E3B4C: IsDebuggerPresent.KERNEL32 ref: 003E3B8C
Part of subcall function 003E3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,004A62F8,004A62E0,?,?), ref: 003E3BFD
Part of subcall function 003E3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 003E3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 003E49D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: a04b229ab9e4a3efcf0328445d32863beed1d31fe442b26d04da5cf87d6c62ff
Instruction ID: 0abe53e9e3a708e29282d8f752e8e290bc69bb85d00bb49e0fa304daa8877b51
Opcode Fuzzy Hash: a04b229ab9e4a3efcf0328445d32863beed1d31fe442b26d04da5cf87d6c62ff
Instruction Fuzzy Hash: 64118EB25083519BC711EF2AEC05A0AFFE8EF99710F04462FF0559B2B1DB709554CB9A

Function 003E5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,003E5981,?,?,?,?), ref: 003E5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,003E5981,?,?,?,?), ref: 0041E19C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1cf55b96f25c1e8d70dbcc15cf5ec6a414f3f3a62ca30b1a884720ebe1a8cb57
Instruction ID: 8b139a8efdcdf2884bb6f14ef9dc7934384c25f137aefe4b21bcb842ee4bbacd
Opcode Fuzzy Hash: 1cf55b96f25c1e8d70dbcc15cf5ec6a414f3f3a62ca30b1a884720ebe1a8cb57
Instruction Fuzzy Hash: 3001B570244758BEF3250E25DC8AFA63BDCEB0176CF108319FAE55A1E0C6B41E498B54

Function 00400FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040594C: __FF_MSGBANNER.LIBCMT ref: 00405963
Part of subcall function 0040594C: __NMSG_WRITE.LIBCMT ref: 0040596A
Part of subcall function 0040594C: RtlAllocateHeap.NTDLL(01320000,00000000,00000001,00000000,?,?,?,00401013,?), ref: 0040598F

std::exception::exception.LIBCMT ref: 0040102C
__CxxThrowException@8.LIBCMT ref: 00401041

Part of subcall function 004087DB: RaiseException.KERNEL32(?,?,?,0049BAF8,00000000,?,?,?,?,00401046,?,0049BAF8,?,00000001), ref: 00408830

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 4ab53e60cd4fa14e2ad9375e0a4a6354333e094f7138dba31b6b12c7137988c6
Instruction ID: c31501622222a32f1cc2e59b1f1168e3eda5d1aefb4f8aaef276fead88a914f0
Opcode Fuzzy Hash: 4ab53e60cd4fa14e2ad9375e0a4a6354333e094f7138dba31b6b12c7137988c6
Instruction Fuzzy Hash: 95F0F934500319A6CB20AA59EE019DF7BACDF00354F10443FF888B26E1DFB98A8096DD

Function 0040582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040585C
__lock_file.LIBCMT ref: 0040587D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 40c50ab841b64baf4b42e3a2cb87e2eaedfd2a9cf6dc7f80d1ab6687ab8a831b
Instruction ID: 7317dfc2f7c09bda83ac88f9cc25e1631715c4f8ccca2bd7c675df7c3b9afa22
Opcode Fuzzy Hash: 40c50ab841b64baf4b42e3a2cb87e2eaedfd2a9cf6dc7f80d1ab6687ab8a831b
Instruction Fuzzy Hash: FC011272801609EBCF11BF668D0599F7A61EF40364B14823FBC147A1E1DB39CA21DF99

Function 004055D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

__lock_file.LIBCMT ref: 0040561B

Part of subcall function 00406E4E: __lock.LIBCMT ref: 00406E71

__fclose_nolock.LIBCMT ref: 00405626

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 6092bcbd9d583466f1b9836748d6195d1eb7108e89dfa7763e173978edbd4a3e
Instruction ID: 9688c08e631682ecdf98ed86054bbc551c10efd1d46f56c8cb6931d318f6500c
Opcode Fuzzy Hash: 6092bcbd9d583466f1b9836748d6195d1eb7108e89dfa7763e173978edbd4a3e
Instruction Fuzzy Hash: 43F09671801A059AD7207F76890275F76A1AF40338F55462FA459BB1C1CF7C49019F5D

Function 0212129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 02121ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 02121AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 02121B13

Memory Dump Source

Source File: 00000000.00000002.1639724238.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_roger.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 878dea7a919b2479e47a8e1b522cf107cd6807076ae43795c6fa2f9bd0a0f552
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: E312EF24E24658C6EB24DF60D8507DEB232EF68300F1090E9910DEB7A5E77A4F95CF5A

Function 003F2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3b5de41aa14217fdb3432a92e44dac40992e61b8548a9596a99fd5b5ff7dac
Instruction ID: c95ae6dd8a5b3cf345ed9d6d57bda3eb19540510c55ffbc72af54539511ed2fb
Opcode Fuzzy Hash: 8d3b5de41aa14217fdb3432a92e44dac40992e61b8548a9596a99fd5b5ff7dac
Instruction Fuzzy Hash: FD518C31700214ABCF16EB69C991BBE77A6AF45314F158169F906AF392CB34ED008B49

Function 003E5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 003E5CF6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a185b60a9cb53dc8fcea900ef9a0a16c8b3fb9ca923d76a7c8499d87903acc08
Instruction ID: 351861efa3bdedc48cf2e16934fa49b90ffed8f6bf7ead34dd04d1ac84058369
Opcode Fuzzy Hash: a185b60a9cb53dc8fcea900ef9a0a16c8b3fb9ca923d76a7c8499d87903acc08
Instruction Fuzzy Hash: CD317C71A00B69EBCB09CF2EC8946ADB7B5FF48314F258629D81997740D770AD50CB90

Function 004200D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004200E1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e8e2581cf852e382f8065ef760c06c03919850b8de771be28327a0ec1153302c
Instruction ID: fea2300ec3d9d8258498569517852dd216445c082d628ee1f553a49ebe7bf327
Opcode Fuzzy Hash: e8e2581cf852e382f8065ef760c06c03919850b8de771be28327a0ec1153302c
Instruction Fuzzy Hash: BE4125746043A1CFDB25DF15C484B1ABBE0BF44308F0989ADE8895B7A2C336E845CB56

Function 003E80D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003E8109

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction ID: a9259fec6c877de5c2dea922311fb95bf91292181810fb5042bd8f43831138f9
Opcode Fuzzy Hash: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction Fuzzy Hash: 05115B76604605DFC724CF29D481A16B7E9FF49314B20C92EE88EDB7A1DB32E842CB54

Function 003E4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E4D13: FreeLibrary.KERNEL32(00000000,?), ref: 003E4D4D

Part of subcall function 0040548B: __wfsopen.LIBCMT ref: 00405496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,004A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 003E4F6F

Part of subcall function 003E4CC8: FreeLibrary.KERNEL32(00000000), ref: 003E4D02

Part of subcall function 003E4DD0: _memmove.LIBCMT ref: 003E4E1A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f4df308495e4a5c3b495fa5b1fc2f6e1ad0a836a00e51e8e0e3abaa303ca7175
Instruction ID: 65c4967bb2383b6215d0622c1a88a7ba702413fe8b94d877f853f224d8c43f3d
Opcode Fuzzy Hash: f4df308495e4a5c3b495fa5b1fc2f6e1ad0a836a00e51e8e0e3abaa303ca7175
Instruction Fuzzy Hash: 29110D31A00719ABCB12FF71DC12FAE77A89F48F00F20852DF541AB6C1DA759E059B50

Function 004201AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 004201BB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7bc1426ebc06b7270aa7c02d6a3891dc2775f8c99de9a37e3f5e067c42fbf94f
Instruction ID: 5b6212c2879a9e9591fe4ef1751baed56f6527c669175769d93071c89e4c8f30
Opcode Fuzzy Hash: 7bc1426ebc06b7270aa7c02d6a3891dc2775f8c99de9a37e3f5e067c42fbf94f
Instruction Fuzzy Hash: 072124B45083A1CFDB15DF25C444B1ABBE0BF84304F058A6DE889577A1D735F845CB56

Function 003E5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,003E5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 003E5D76

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 40982936025e696eeecdb3132a7d0734b6e8443fa88bf162efd900810b23a26e
Instruction ID: b085334073b15c71b4e44721bc0f707991705cbdb785b9252b6e43cfa4a24cb4
Opcode Fuzzy Hash: 40982936025e696eeecdb3132a7d0734b6e8443fa88bf162efd900810b23a26e
Instruction Fuzzy Hash: 10113A31200B559FD7328F16C884B63B7E9EF45764F10CA2EE4AA86A90D7B0F945CB60

Function 00404A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00404AD6

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 2f2fca7ce8c9e5478c13251225fc02b0073d10939da4c99b975e40e22ded3579
Instruction ID: 5e2532a22fe2e63ded7e0b40062d8a0b4e98604ed545263f0c7585a1ca8a7707
Opcode Fuzzy Hash: 2f2fca7ce8c9e5478c13251225fc02b0073d10939da4c99b975e40e22ded3579
Instruction Fuzzy Hash: 33F0D1B1940209ABDF61AF76880239F3661AF80329F04413EB914BA1D1CB7C8910DF49

Function 003E4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,004A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 003E4FDE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: cf2e496eb6ea59d5c7d81c06939007853b106722277708a4c23cead6ac1492c0
Instruction ID: 60163cce50bf37e19f92f6caecdb80564b2d4c39d260c8ff651da7357feeaa1c
Opcode Fuzzy Hash: cf2e496eb6ea59d5c7d81c06939007853b106722277708a4c23cead6ac1492c0
Instruction Fuzzy Hash: B0F03971105762CFCB359F66E894812BBE5BF087293218B3EE1D682A50C771A845DF54

Function 004009D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004009F4

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: d14a7832f7839bb9e52e606d4f8d24f012583f922884ea2a8faef238a08059a9
Instruction ID: 6c024a05d06df5a14fad7624839c45f39ef2bd8824bcb1eded7412b8978537f7
Opcode Fuzzy Hash: d14a7832f7839bb9e52e606d4f8d24f012583f922884ea2a8faef238a08059a9
Instruction Fuzzy Hash: 50E07D3290422C57C720D2589C05FFA73ECDF88790F0001F6FC0CC7204E9A0AC818690

Function 00449129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0044914B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 1dd2fad9f4edd62f0188e77bd1afef654a0c9997a3adfd381091397c0ebe5d30
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: BCE092B1104B005FE7349A24D8107E373E0EB06315F00081EF6DA93341EB667C419B5D

Function 003E5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0041E16B,?,?,00000000), ref: 003E5DBF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0c139206ae4544478556dffa2fa8518f0ccfedeb211ad4fbec5d0ccd094c5304
Instruction ID: 91f66357a9498983e8bc4eddf393efcd38f5234108e8ee28142189321123bd08
Opcode Fuzzy Hash: 0c139206ae4544478556dffa2fa8518f0ccfedeb211ad4fbec5d0ccd094c5304
Instruction Fuzzy Hash: D2D0C77464420CBFE710DB80DC46FA9777CD705710F100195FD0456290E6F27D548795

Function 0040548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00405496

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: b5953561580688991c94b4e9298afa7e701a15b6924e72a5333c99045c52a9cf
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: B9B09B7544010C77DE011D42EC02B553B199740678F404021FB0C18161957795605589

Function 0044D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0044D46A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 595de976e82c0289c57d7013b6fc917eb51d89090b69903780bb5261c8656bd2
Instruction ID: 5a9895f4954d5925576e270bcff671467a52d6c8ba833404bd4872510c440d12
Opcode Fuzzy Hash: 595de976e82c0289c57d7013b6fc917eb51d89090b69903780bb5261c8656bd2
Instruction Fuzzy Hash: 367171306043428FD715EF25C491A6EB7E0AF88314F044A6EF8969B3E2DB74ED09CB56

Function 00400E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00400EF7

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ef3ce3cef5db0cd9cf4a65a641de746ffbe2b1dd4018547803b73fdf1ed02491
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6831D570A00106DBC718DF58C480A6AF7A6FF59300F648AA6E409EB792D735EDC1DBC9

Function 021222A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 021222B1

Memory Dump Source

Source File: 00000000.00000002.1639724238.0000000002120000.00000040.00001000.00020000.00000000.sdmp, Offset: 02120000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2120000_roger.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: b2da98b193aaf7438c437d35fd4079cd111a9a423f669e9b7730c2248e1d4fc7
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 35E0BF7498010E9FDB00EFA4D54969E7BB4EF04301F100161FD0192280D73199608A62

Non-executed Functions

Function 0046CDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0046CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0046CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0046CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0046CF00
SendMessageW.USER32 ref: 0046CF29
_wcsncpy.LIBCMT ref: 0046CFA1
GetKeyState.USER32(00000011), ref: 0046CFC2
GetKeyState.USER32(00000009), ref: 0046CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0046CFE5
GetKeyState.USER32(00000010), ref: 0046CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0046D018
SendMessageW.USER32 ref: 0046D03F
SendMessageW.USER32(?,00001030,?,0046B602), ref: 0046D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0046D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0046D16E
SetCapture.USER32(?), ref: 0046D177
ClientToScreen.USER32(?,?), ref: 0046D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0046D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0046D203
ReleaseCapture.USER32 ref: 0046D20E
GetCursorPos.USER32(?), ref: 0046D248
ScreenToClient.USER32(?,?), ref: 0046D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0046D2B1
SendMessageW.USER32 ref: 0046D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0046D31C
SendMessageW.USER32 ref: 0046D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0046D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0046D37B
GetCursorPos.USER32(?), ref: 0046D39B
ScreenToClient.USER32(?,?), ref: 0046D3A8
GetParent.USER32(?), ref: 0046D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0046D431
SendMessageW.USER32 ref: 0046D462
ClientToScreen.USER32(?,?), ref: 0046D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0046D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0046D51A
SendMessageW.USER32 ref: 0046D53D
ClientToScreen.USER32(?,?), ref: 0046D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0046D5C3

Part of subcall function 003E25DB: GetWindowLongW.USER32(?,000000EB), ref: 003E25EC

GetWindowLongW.USER32(?,000000F0), ref: 0046D65F

Strings

prJ, xrefs: 0046D1BD
@GUI_DRAGID, xrefs: 0046D1AA
F, xrefs: 0046D543

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$prJ
API String ID: 3977979337-3735044374
Opcode ID: 598dba41e5a72c84b8d198c846e11b26497d0fb1fe3236cb5b4ec62cbcd6014e
Instruction ID: 8ba3b0a6ddfbbd7223f7014500a6069acce73b1c0f637fc4f8cbac0d79af6aaa
Opcode Fuzzy Hash: 598dba41e5a72c84b8d198c846e11b26497d0fb1fe3236cb5b4ec62cbcd6014e
Instruction Fuzzy Hash: 5742AD30604340AFC725CF28C884AABBBE5FF49314F14452EF6A5872A1E7769855CB9B

Function 0046804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0046873F

Strings

%d/%02d/%02d, xrefs: 00468478

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: c4d5c4a5fb8f65091265188e2cbf1445a0b912ddd326b042c887a8bbf461c536
Instruction ID: c34f65441dabf8c294896463ef6b03c5fb435cdfc421b578e2762774a27e6691
Opcode Fuzzy Hash: c4d5c4a5fb8f65091265188e2cbf1445a0b912ddd326b042c887a8bbf461c536
Instruction Fuzzy Hash: A712D571500304ABEB258F24DC49FAB7BB4EF45710F14426EF915EA2E1EFB88945CB1A

Function 003F710E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003F75C2
_memset.LIBCMT ref: 003F76B1
_memmove.LIBCMT ref: 003F7C4B
_memmove.LIBCMT ref: 003F7E4F

Strings

Oa?, xrefs: 0043287E
DEFINE, xrefs: 004325AF
\b(?=\w), xrefs: 00433C34
[:>:]], xrefs: 003F760A
Q\E, xrefs: 003F81C1
0wI, xrefs: 00431F5B
\b(?<=\w), xrefs: 00433C41
[:<:]], xrefs: 003F75F1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0wI$DEFINE$Oa?$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1465217885
Opcode ID: 567aab9cc0bf3ad315ddb45af38da8613693b64e834e312d104eb70561722de0
Instruction ID: 2d03ba37296c51caf86656f1a9e750628f0502deb6b4b9a80090a6546106b41b
Opcode Fuzzy Hash: 567aab9cc0bf3ad315ddb45af38da8613693b64e834e312d104eb70561722de0
Instruction Fuzzy Hash: 1F93A171A00219DBDB24CF58C981BBDB7B1FF48710F25916BE945AB390E7789E81CB44

Function 003E4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 003E4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0041DA8E
IsIconic.USER32(?), ref: 0041DA97
ShowWindow.USER32(?,00000009), ref: 0041DAA4
SetForegroundWindow.USER32(?), ref: 0041DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0041DAC4
GetCurrentThreadId.KERNEL32 ref: 0041DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0041DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0041DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0041DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0041DAF8
SetForegroundWindow.USER32(?), ref: 0041DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0041DB10
keybd_event.USER32(00000012,00000000), ref: 0041DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0041DB25
keybd_event.USER32(00000012,00000000), ref: 0041DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0041DB33
keybd_event.USER32(00000012,00000000), ref: 0041DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0041DB42
keybd_event.USER32(00000012,00000000), ref: 0041DB47
SetForegroundWindow.USER32(?), ref: 0041DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0041DB71

Strings

Shell_TrayWnd, xrefs: 0041DA89

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c5029518d16d548528fe7080f1af42d101cd8963f3cb151e65e3fe9c65ae2af0
Instruction ID: 0cb4820996727608628f50cdbaf7162c206bfb5c1e73e1f0283a0581cd690513
Opcode Fuzzy Hash: c5029518d16d548528fe7080f1af42d101cd8963f3cb151e65e3fe9c65ae2af0
Instruction Fuzzy Hash: FE31A771E803187BEB205F61AC49FBF3E6CEB44B50F114036FA05E61D1D6B45D41AAAA

Function 00438858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00438CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00438D0D
Part of subcall function 00438CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00438D3A
Part of subcall function 00438CC3: GetLastError.KERNEL32 ref: 00438D47

_memset.LIBCMT ref: 0043889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 004388ED
CloseHandle.KERNEL32(?), ref: 004388FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00438915
GetProcessWindowStation.USER32 ref: 0043892E
SetProcessWindowStation.USER32(00000000), ref: 00438938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00438952

Part of subcall function 00438713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00438851), ref: 00438728
Part of subcall function 00438713: CloseHandle.KERNEL32(?,?,00438851), ref: 0043873A

Strings

, xrefs: 004388AA
winsta0, xrefs: 00438910
default, xrefs: 0043894D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 32caba309efa3e8ae50527ba3c31cec0b55fe81c2b5e5ab31123d2bbc58a1fcf
Instruction ID: eeffbdd0f74f5154061557b6bbba3dafd5d913656fc9b4557db0e0740e81dbe1
Opcode Fuzzy Hash: 32caba309efa3e8ae50527ba3c31cec0b55fe81c2b5e5ab31123d2bbc58a1fcf
Instruction Fuzzy Hash: 1D814B71900309AFDF11EFA4DC45AAEBB78AF08304F18512FF910A6261DB798E159B69

Function 0045425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0046F910), ref: 00454284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00454292
GetClipboardData.USER32(0000000D), ref: 0045429A
CloseClipboard.USER32 ref: 004542A6
GlobalLock.KERNEL32(00000000), ref: 004542C2
CloseClipboard.USER32 ref: 004542CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 004542E1
IsClipboardFormatAvailable.USER32(00000001), ref: 004542EE
GetClipboardData.USER32(00000001), ref: 004542F6
GlobalLock.KERNEL32(00000000), ref: 00454303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00454337
CloseClipboard.USER32 ref: 00454447

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 75d7025f78be5a54d319480e719fd71042bb7d44e29680edd8c0354c61194937
Instruction ID: 072294ad711b939a2c53d3e2bef242e296604dc66f8fe9c0eafa3abd729d80e3
Opcode Fuzzy Hash: 75d7025f78be5a54d319480e719fd71042bb7d44e29680edd8c0354c61194937
Instruction Fuzzy Hash: 7251C6712042016BD301EF61EC85F6F77A8AF84705F00453AF995DA1E2EFB4D9498B6B

Function 0044C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0044C9F8
FindClose.KERNEL32(00000000), ref: 0044CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0044CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0044CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0044CAAF
__swprintf.LIBCMT ref: 0044CAFB
__swprintf.LIBCMT ref: 0044CB3E

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

__swprintf.LIBCMT ref: 0044CB92

Part of subcall function 004038D8: __woutput_l.LIBCMT ref: 00403931

__swprintf.LIBCMT ref: 0044CBE0

Part of subcall function 004038D8: __flsbuf.LIBCMT ref: 00403953
Part of subcall function 004038D8: __flsbuf.LIBCMT ref: 0040396B

__swprintf.LIBCMT ref: 0044CC2F
__swprintf.LIBCMT ref: 0044CC7E
__swprintf.LIBCMT ref: 0044CCCD

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0044CAF5
%4d, xrefs: 0044CB38
%02d, xrefs: 0044CB86, 0044CB90, 0044CBDE, 0044CC2D, 0044CC7C, 0044CCCB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 43d337bf95bd8221d2316839380567017c76b1e79a94a7e17d1eefccc7d8b869
Instruction ID: 89da03dcaca3d6b225b913a0aa27a7a2bd6ac77d172742d184b11cea1ea26e10
Opcode Fuzzy Hash: 43d337bf95bd8221d2316839380567017c76b1e79a94a7e17d1eefccc7d8b869
Instruction Fuzzy Hash: F5A160B2408354ABC701FF65C885EAFB7ECEF94704F40492EF585DA191EA34DA08CB62

Function 0044F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0044F221
_wcscmp.LIBCMT ref: 0044F236
_wcscmp.LIBCMT ref: 0044F24D
GetFileAttributesW.KERNEL32(?), ref: 0044F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0044F279
FindNextFileW.KERNEL32(00000000,?), ref: 0044F291
FindClose.KERNEL32(00000000), ref: 0044F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0044F2B8
_wcscmp.LIBCMT ref: 0044F2DF
_wcscmp.LIBCMT ref: 0044F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0044F308
SetCurrentDirectoryW.KERNEL32(0049A5A0), ref: 0044F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0044F330
FindClose.KERNEL32(00000000), ref: 0044F33D
FindClose.KERNEL32(00000000), ref: 0044F34F

Strings

*.*, xrefs: 0044F2B3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: eba8c899e42284a01b8312945b62e971d698f3859b024b195df234841263f9e3
Instruction ID: b187454edb662bcaed54efb015b8f50b744b2fd7a89745be240a0c67ce4629f1
Opcode Fuzzy Hash: eba8c899e42284a01b8312945b62e971d698f3859b024b195df234841263f9e3
Instruction Fuzzy Hash: 6F31F6366012196AEB10DFB0EC59ADF77ACAF08320F1041B7EC44E3190EB79DA498A5D

Function 00460AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00460BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0046F910,00000000,?,00000000,?,?), ref: 00460C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00460C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00460D1D
RegCloseKey.ADVAPI32(?), ref: 0046103D
RegCloseKey.ADVAPI32(00000000), ref: 0046104A

Strings

REG_QWORD, xrefs: 00460F8B
REG_BINARY, xrefs: 00460FD8
REG_MULTI_SZ, xrefs: 00460E05
REG_EXPAND_SZ, xrefs: 00460CBA
REG_DWORD, xrefs: 00460F0E
REG_SZ, xrefs: 00460D5B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: e2889c5ba598aea3b979fbcfbd2334ec8175efa8fde9e8102f3cebe6a7c88b63
Instruction ID: 3639eaf981f27e3713a28fa47d289452ddaf1928a1f0854217e50c124ee672d1
Opcode Fuzzy Hash: e2889c5ba598aea3b979fbcfbd2334ec8175efa8fde9e8102f3cebe6a7c88b63
Instruction Fuzzy Hash: 95026E752006519FCB15DF15C881E2AB7E5FF88714F04896EF88A9B3A2DB34ED41CB86

Function 0044F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0044F37E
_wcscmp.LIBCMT ref: 0044F393
_wcscmp.LIBCMT ref: 0044F3AA

Part of subcall function 004445C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 004445DC

FindNextFileW.KERNEL32(00000000,?), ref: 0044F3D9
FindClose.KERNEL32(00000000), ref: 0044F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0044F400
_wcscmp.LIBCMT ref: 0044F427
_wcscmp.LIBCMT ref: 0044F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0044F450
SetCurrentDirectoryW.KERNEL32(0049A5A0), ref: 0044F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0044F478
FindClose.KERNEL32(00000000), ref: 0044F485
FindClose.KERNEL32(00000000), ref: 0044F497

Strings

*.*, xrefs: 0044F3FB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 3143ff7a8b8701f8fcda42d0ddf30fa5aee7b8ffddf657da358e2b0cb860642d
Instruction ID: 1da879d7c852a21511205b05121ebddeff3afc27aa84778344ea29e5342faaba
Opcode Fuzzy Hash: 3143ff7a8b8701f8fcda42d0ddf30fa5aee7b8ffddf657da358e2b0cb860642d
Instruction Fuzzy Hash: B331E4316016196BEF109FA4EC88ADF77AC9F49324F104177EC54A31A0EB78DA48CA6D

Function 004381F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0043874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00438766
Part of subcall function 0043874A: GetLastError.KERNEL32(?,0043822A,?,?,?), ref: 00438770
Part of subcall function 0043874A: GetProcessHeap.KERNEL32(00000008,?,?,0043822A,?,?,?), ref: 0043877F
Part of subcall function 0043874A: HeapAlloc.KERNEL32(00000000,?,0043822A,?,?,?), ref: 00438786
Part of subcall function 0043874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0043879D

Part of subcall function 004387E7: GetProcessHeap.KERNEL32(00000008,00438240,00000000,00000000,?,00438240,?), ref: 004387F3
Part of subcall function 004387E7: HeapAlloc.KERNEL32(00000000,?,00438240,?), ref: 004387FA
Part of subcall function 004387E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00438240,?), ref: 0043880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0043825B
_memset.LIBCMT ref: 00438270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0043828F
GetLengthSid.ADVAPI32(?), ref: 004382A0
GetAce.ADVAPI32(?,00000000,?), ref: 004382DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 004382F9
GetLengthSid.ADVAPI32(?), ref: 00438316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00438325
HeapAlloc.KERNEL32(00000000), ref: 0043832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0043834D
CopySid.ADVAPI32(00000000), ref: 00438354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00438385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004383AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 004383BF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: a3906536334a4b6b09671cfe02140cb3badd26cfe35a4747da583856d45e3e6d
Instruction ID: 31f3fa433d16c8bd57a158a6a56c77b6f7dc6018b9a731e543566dab482a9928
Opcode Fuzzy Hash: a3906536334a4b6b09671cfe02140cb3badd26cfe35a4747da583856d45e3e6d
Instruction Fuzzy Hash: B6617A70900209EBCF009FA1DC85AEEBBB9FF48704F14912EF815A6391EB759A15CB64

Function 003F6843 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

Oa?, xrefs: 00431888, 0043192F, 004319DD
LIMIT_RECURSION=, xrefs: 00431635
UTF16), xrefs: 00431508
BSR_ANYCRLF), xrefs: 00431757
ANYCRLF), xrefs: 00431734
PJH, xrefs: 003F68B3
UTF), xrefs: 00431533
CR), xrefs: 004316C0
LIMIT_MATCH=, xrefs: 004315A9
CRLF), xrefs: 004316FA
UCP), xrefs: 00431546
ANY), xrefs: 00431717
BSR_UNICODE), xrefs: 00431771
NO_START_OPT), xrefs: 00431588
LF), xrefs: 004316DD
NO_AUTO_POSSESS), xrefs: 00431567

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa?$PJH$UCP)$UTF)$UTF16)
API String ID: 0-296203089
Opcode ID: ca1fdb7c2d5986e51d4bca67c79c62f11750f8e305002a8dc957af8f3a59dac6
Instruction ID: dabbb891bcfa8e6891b6d5a54d543ad2eb7d37f0385b87af653a13c4aa1897a5
Opcode Fuzzy Hash: ca1fdb7c2d5986e51d4bca67c79c62f11750f8e305002a8dc957af8f3a59dac6
Instruction Fuzzy Hash: 69729C75E002199BDB25CF59C8817BEB7B5EF48310F14816BE949EB390EB349E81CB94

Function 00460665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00460038,?,?), ref: 004610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00460737

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 004607D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0046086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00460AAD
RegCloseKey.ADVAPI32(00000000), ref: 00460ABA

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 455de7c914184e32efa3f37f8db794b251f2de9eb59254012972119812f7fb4e
Instruction ID: 7223c2f4db3282788f4dc09142081ec764a9e3f153a41fea61a4c479ef943e5b
Opcode Fuzzy Hash: 455de7c914184e32efa3f37f8db794b251f2de9eb59254012972119812f7fb4e
Instruction Fuzzy Hash: 67E15F71204310AFCB15DF65C891E2BBBE4EF89714B04856EF489DB2A2DB34ED05CB56

Function 00440219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00440241
GetAsyncKeyState.USER32(000000A0), ref: 004402C2
GetKeyState.USER32(000000A0), ref: 004402DD
GetAsyncKeyState.USER32(000000A1), ref: 004402F7
GetKeyState.USER32(000000A1), ref: 0044030C
GetAsyncKeyState.USER32(00000011), ref: 00440324
GetKeyState.USER32(00000011), ref: 00440336
GetAsyncKeyState.USER32(00000012), ref: 0044034E
GetKeyState.USER32(00000012), ref: 00440360
GetAsyncKeyState.USER32(0000005B), ref: 00440378
GetKeyState.USER32(0000005B), ref: 0044038A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7cb0883885446eba7a1222a783fc2496f44cdcf206586a75d35a427a77bd0a9a
Instruction ID: faf602ef7bfb418698e48b7a72c7e2ca30ca8cdd7a06171c6adc8b5aa9b2dcc6
Opcode Fuzzy Hash: 7cb0883885446eba7a1222a783fc2496f44cdcf206586a75d35a427a77bd0a9a
Instruction Fuzzy Hash: 604187345047C96AFF319E6494083A7BEA07B11340F08409FDBC6463C2E7F85DE88B9A

Function 00454458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0045447F
EmptyClipboard.USER32 ref: 00454485
GlobalAlloc.KERNEL32(00000002,?), ref: 0045449A
CloseClipboard.USER32 ref: 00454539

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: c8a6710cd2610d5823c5acd2489e1749b16ed9f304d4041cabece1f406132cd0
Instruction ID: 16ca4b5f84f7da31320e7ab243a67ceb7c49cd0d3e1ee52fefea663924c9889e
Opcode Fuzzy Hash: c8a6710cd2610d5823c5acd2489e1749b16ed9f304d4041cabece1f406132cd0
Instruction Fuzzy Hash: 2721A275200210AFDB11AF11EC09B6A77A8EF44715F10806BF946DB2A2EBB4AC05CB4A

Function 00443A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003E48A1,?,?,003E37C0,?), ref: 003E48CE

Part of subcall function 00444CD3: GetFileAttributesW.KERNEL32(?,00443947), ref: 00444CD4

FindFirstFileW.KERNEL32(?,?), ref: 00443ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00443B87
MoveFileW.KERNEL32(?,?), ref: 00443B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00443BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00443BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00443BF5

Strings

\*.*, xrefs: 00443A8A, 00443A93, 00443AA8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: bb894ad431e1897e3879fa269303b7cef4d4f566c3f9d0674eff77f2d4d557e5
Instruction ID: 4ea7c5eaf87ce0f69247923c3f443edcf64988f4b8ce7b537deb974cdd8eb3e3
Opcode Fuzzy Hash: bb894ad431e1897e3879fa269303b7cef4d4f566c3f9d0674eff77f2d4d557e5
Instruction Fuzzy Hash: 6B51B13180119C9ADF06EFA1CD929EEB778AF14305F2442AAE4417B192EF756F0DCB94

Function 003F4140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 003F44ED
Oa?, xrefs: 003F4984, 00428173
ERCP, xrefs: 003F421F
VUUU, xrefs: 003F4520
VUUU, xrefs: 003F44DB
VUUU, xrefs: 00427B0C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: ERCP$Oa?$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2882198115
Opcode ID: 1b6449012b5c5e636d0ac5078808a6ac40179c78bc7d5d4e263db8018f3cc385
Instruction ID: 7a606372cf1949aa7ec0fb191a2cbbb004c33cf4ffb11694c6846719af5b0137
Opcode Fuzzy Hash: 1b6449012b5c5e636d0ac5078808a6ac40179c78bc7d5d4e263db8018f3cc385
Instruction Fuzzy Hash: 2BA2AC70E0422E8BDF25CF58D9807BFB7B1BB50314F5581AADA1AA7780E7349E85CB44

Function 0044F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0044F6AB
Sleep.KERNEL32(0000000A), ref: 0044F6DB
_wcscmp.LIBCMT ref: 0044F6EF
_wcscmp.LIBCMT ref: 0044F70A
FindNextFileW.KERNEL32(?,?), ref: 0044F7A8
FindClose.KERNEL32(00000000), ref: 0044F7BE

Strings

*.*, xrefs: 0044F690

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 911461d31d0fbdb61ab0deb902bb1cb2da4836c8ad6014e4b0149ecd57a15e62
Instruction ID: 673d32dcee50bfd260192381064e0cfac424cfc4a644a1893170ebf30da217f5
Opcode Fuzzy Hash: 911461d31d0fbdb61ab0deb902bb1cb2da4836c8ad6014e4b0149ecd57a15e62
Instruction Fuzzy Hash: B941907190021AAFEF11DF64CC45AEFBBB4FF05310F14456AE814A7290EB389E48CB95

Function 003F58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003F5A05
_memmove.LIBCMT ref: 003F5A55
_memmove.LIBCMT ref: 003F5ABB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2a5743190874da04709109cfa6023adc3214ef6618848785bedf793ffb847ed6
Instruction ID: 91e018ca27e8fe519bffb846541d147c5cc2c1465bd6a415fc34f62910fea556
Opcode Fuzzy Hash: 2a5743190874da04709109cfa6023adc3214ef6618848785bedf793ffb847ed6
Instruction Fuzzy Hash: 0112A970A00609DFDF05DFA5D981AEEB7B5FF48300F10422AE946E7291EB39AD11CB54

Function 003F5680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00400FF6: std::exception::exception.LIBCMT ref: 0040102C
Part of subcall function 00400FF6: __CxxThrowException@8.LIBCMT ref: 00401041

_memmove.LIBCMT ref: 0043062F
_memmove.LIBCMT ref: 00430744
_memmove.LIBCMT ref: 004307EB

Strings

yZ?, xrefs: 00430881, 004307FF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ?
API String ID: 1300846289-1381175854
Opcode ID: ae54ecd88d2087b7cf85c41b84f7cc458ad5d6ad949b019c52892981e7319394
Instruction ID: fe327a0828d015db4799b7a44b1ed70e81a723e6d990f41aef9e7d298d143c6b
Opcode Fuzzy Hash: ae54ecd88d2087b7cf85c41b84f7cc458ad5d6ad949b019c52892981e7319394
Instruction Fuzzy Hash: B502E070E00209EBCF05DF65D991ABEBBB5EF48300F14807AE906EB295EB35D910CB95

Function 0044545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00438CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00438D0D
Part of subcall function 00438CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00438D3A
Part of subcall function 00438CC3: GetLastError.KERNEL32 ref: 00438D47

ExitWindowsEx.USER32(?,00000000), ref: 0044549B

Strings

SeShutdownPrivilege, xrefs: 0044546B
@, xrefs: 0044548E
, xrefs: 00445489

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 6b3ab82f3a3269b396522840e984997e91b9be4e9c7a52e551b196b738cf4fa5
Instruction ID: c10878f936970bd8894ee26b247304a950062c24dd9b741f60fd6d3d0152756e
Opcode Fuzzy Hash: 6b3ab82f3a3269b396522840e984997e91b9be4e9c7a52e551b196b738cf4fa5
Instruction Fuzzy Hash: A2012431655B012BFF285674AC4ABBB7268AB04752F200137FC46DA1C3EA9C0C85819D

Function 003F3190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa?, xrefs: 003F3482

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa?
API String ID: 674341424-1309107252
Opcode ID: 7ccaa8d64f7199307eda3463dfb9a3cfb40815620a9e9d5fda85ef96161a8eca
Instruction ID: f7a3cac02b98116be809915b41739433f98976926352523b2d17d2541615daf9
Opcode Fuzzy Hash: 7ccaa8d64f7199307eda3463dfb9a3cfb40815620a9e9d5fda85ef96161a8eca
Instruction Fuzzy Hash: 9722BD716083559FC726DF24C881B6FB7E4AF84304F50492EF99A9B391DB34EA04CB92

Function 00456596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 004565EF
WSAGetLastError.WSOCK32(00000000), ref: 004565FE
bind.WSOCK32(00000000,?,00000010), ref: 0045661A
listen.WSOCK32(00000000,00000005), ref: 00456629
WSAGetLastError.WSOCK32(00000000), ref: 00456643
closesocket.WSOCK32(00000000), ref: 00456657

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 94c73d9d5ff1167f88658f66e2d39b8c92fa968e38dce14a8cc6ffd9c3c33af3
Instruction ID: 478616835be3ac34a125b40ebcaffd886d383d13d456c1084ce18ab55674bafe
Opcode Fuzzy Hash: 94c73d9d5ff1167f88658f66e2d39b8c92fa968e38dce14a8cc6ffd9c3c33af3
Instruction Fuzzy Hash: 4621D5302002109FCB00EF24D845B2EB7A9EF44321F11816AFD56AB3D2DB74AD05CB59

Function 003E1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 003E19FA
GetSysColor.USER32(0000000F), ref: 003E1A4E
SetBkColor.GDI32(?,00000000), ref: 003E1A61

Part of subcall function 003E1290: DefDlgProcW.USER32(?,00000020,?), ref: 003E12D8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 802631f91efb8b9753cc8a0b29dcb54502e626dbef8eac2ecabdf71ca425b4ca
Instruction ID: a962d462abf221297a8fd5a917b218a5fcd45a06e0aae63f87650a7cba5b14aa
Opcode Fuzzy Hash: 802631f91efb8b9753cc8a0b29dcb54502e626dbef8eac2ecabdf71ca425b4ca
Instruction Fuzzy Hash: 00A18B701060E4BAD736AB2B8C84EBF255DDB46385B15032FF442D6AD2DB389C4182FE

Function 00456A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004580A0: inet_addr.WSOCK32(00000000), ref: 004580CB

socket.WSOCK32(00000002,00000002,00000011), ref: 00456AB1
WSAGetLastError.WSOCK32(00000000), ref: 00456ADA
bind.WSOCK32(00000000,?,00000010), ref: 00456B13
WSAGetLastError.WSOCK32(00000000), ref: 00456B20
closesocket.WSOCK32(00000000), ref: 00456B34

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 9206684731bbb6ffa57fff245a48a8546e2f3abda5cd2d92ae1c8889dd94c1b2
Instruction ID: 8d59d6b10a0c4b339b5440d0278ee282b8cf3a5d5c17ad5109b42833b0d94a3a
Opcode Fuzzy Hash: 9206684731bbb6ffa57fff245a48a8546e2f3abda5cd2d92ae1c8889dd94c1b2
Instruction Fuzzy Hash: 1141C375A00220AFEB11BF25DC86F6E77A89F44720F40816EF95AAF3C3DA749D008791

Function 004655FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0046564C
IsWindowEnabled.USER32 ref: 0046565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00465667
IsIconic.USER32 ref: 00465675
IsZoomed.USER32 ref: 00465683

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: d7e7734e8baa4b79e0d4d7f18e615d7f380c4f6c25e1b8e9506b851e6eba3b89
Instruction ID: 066a86664198bd163cf0fb6e2d7a9eb12571973c8382b5e705006f7ef12dfea5
Opcode Fuzzy Hash: d7e7734e8baa4b79e0d4d7f18e615d7f380c4f6c25e1b8e9506b851e6eba3b89
Instruction Fuzzy Hash: 4411B6713006216FD7111F26EC44B2BB798EF54721F41403AF84AD7241EB749D02C6AE

Function 0044C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0044C69D
CoCreateInstance.OLE32(00472D6C,00000000,00000001,00472BDC,?), ref: 0044C6B5

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

CoUninitialize.OLE32 ref: 0044C922

Strings

.lnk, xrefs: 0044C631, 0044C659, 0044C663

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: e2fce41ccf741298152aed84139a8c9ce86abe897ca418743e6dffe4700fc7cb
Instruction ID: a4f21a13014b869570e40892f5292c260cbaa7b3a86b85d5993d42605586e21b
Opcode Fuzzy Hash: e2fce41ccf741298152aed84139a8c9ce86abe897ca418743e6dffe4700fc7cb
Instruction Fuzzy Hash: 4AA13CB1108255AFD301EF55C881EABB7E8EF94304F044A6DF1969B1D2EB70EE09CB52

Function 0045C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00421D88,?), ref: 0045C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0045C324

Strings

kernel32.dll, xrefs: 0045C30D
GetSystemWow64DirectoryW, xrefs: 0045C31E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: fcf1cb5b958f929b0c48bc40e0816e1f064ce6bbab88ca966b00e0d68b385e5a
Instruction ID: 690640b0faf43212b7b2e8a1c530ff2aa000227381038e81e46b16d150ba1de2
Opcode Fuzzy Hash: fcf1cb5b958f929b0c48bc40e0816e1f064ce6bbab88ca966b00e0d68b385e5a
Instruction Fuzzy Hash: 88E08C70200303CFCB204F25E844B8B76D4EB09756B90C43BEC95C2350E7BCD888CAA8

Function 0045F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0045F151
Process32FirstW.KERNEL32(00000000,?), ref: 0045F15F

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Process32NextW.KERNEL32(00000000,?), ref: 0045F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0045F22E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: bcfdde185cf84fd67998a75c704b794241a1ffc373c086763fbdedcdd16a96ff
Instruction ID: a215884104e7b3fc160f4f9ffcf802550751b67bf1844ba74a0bbe81874973f1
Opcode Fuzzy Hash: bcfdde185cf84fd67998a75c704b794241a1ffc373c086763fbdedcdd16a96ff
Instruction Fuzzy Hash: DD5192715043509FD311EF21DC85E6BB7E8FF94710F10492EF9959B292EB70A908CB92

Function 0043EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0043EB19

Strings

|, xrefs: 0043EB49
(, xrefs: 0043EB5F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 98551225f098d5b625193a989a545af6679f26e52601db74b538ad2dab2c2487
Instruction ID: ad82cabcd5d28dbb151a4f02fe9092fa0d83461236a5d34dff4355c81f0e9745
Opcode Fuzzy Hash: 98551225f098d5b625193a989a545af6679f26e52601db74b538ad2dab2c2487
Instruction Fuzzy Hash: 82322575A006059FDB28CF1AC481A6AB7F0FF48320F15D56EE89ADB3A1E774E941CB44

Function 004525E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 004526D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0045270C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a72f63dd4247593609e2e0aecf36444e37e0052b170c6ebd67a4cdc063bc21ab
Instruction ID: f5d414d7e043cb8589040d1f16fe2c9df834fe2a6c9f892a29d7a618b8c7bd21
Opcode Fuzzy Hash: a72f63dd4247593609e2e0aecf36444e37e0052b170c6ebd67a4cdc063bc21ab
Instruction Fuzzy Hash: 70412B71500209BFEB20DB55CD85EBF77BCEB45316F10406FFE00A6242EAF89D499659

Function 0044B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0044B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0044B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0044B655

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 764a86fce233d207406caf2d8ca0df8acccf82bdfb5d9f51f94a89101b32407c
Instruction ID: bc91549a467a0dd531d9c8fe0b430b55878b78d00b80ae4fa91f12f282eddefb
Opcode Fuzzy Hash: 764a86fce233d207406caf2d8ca0df8acccf82bdfb5d9f51f94a89101b32407c
Instruction Fuzzy Hash: B821A135A00118EFCB00EF65D880EEDBBB8FF49314F0481AAE845AB351DB319915CF55

Function 00438CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00400FF6: std::exception::exception.LIBCMT ref: 0040102C
Part of subcall function 00400FF6: __CxxThrowException@8.LIBCMT ref: 00401041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00438D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00438D3A
GetLastError.KERNEL32 ref: 00438D47

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 185f834c15a8b2a1fe168c0d0e025b09f56eedbaa0152433d58c453206fcc8e0
Instruction ID: 0adacf7153a19fd9406be5fad3b2d279e572a5a1bc43284e544a667ad42c321b
Opcode Fuzzy Hash: 185f834c15a8b2a1fe168c0d0e025b09f56eedbaa0152433d58c453206fcc8e0
Instruction Fuzzy Hash: 5A11C4B1414305AFE728DF54EC85D6BB7BCFF04710B10852EF48693241EB74AC408B24

Function 00444021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0044404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00444088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00444091

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 99f8e5e5d5fc93d25b582a93ea4a168b20536c25b9668bfd913874565644933f
Instruction ID: 76706c9823490846fd11a74bdd9c9cc9c687f87b5b91bae95c0425ea57413c82
Opcode Fuzzy Hash: 99f8e5e5d5fc93d25b582a93ea4a168b20536c25b9668bfd913874565644933f
Instruction Fuzzy Hash: 001182B1D00228BEE7109BE8DC44FAFBBBCEB49750F000666FA04E7290D2B85D5587E5

Function 00444C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00444C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00444C43
FreeSid.ADVAPI32(?), ref: 00444C53

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 2827946e2758949ed172c019635cd7625a48e416c5a59a335d0b7a864582b165
Instruction ID: b16cc19ed3c68f14c667053a764614261e797ee9d42efa3abaf2c27091e6fbab
Opcode Fuzzy Hash: 2827946e2758949ed172c019635cd7625a48e416c5a59a335d0b7a864582b165
Instruction Fuzzy Hash: 00F04F75A1130CBFDF04DFF0DD89AAEB7BCEF08201F004479E501E2181E6746A048B55

Function 00448B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00448B25

Part of subcall function 0040543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004491F8,00000000,?,?,?,?,004493A9,00000000,?), ref: 00405443
Part of subcall function 0040543A: __aulldiv.LIBCMT ref: 00405463

Strings

0uJ, xrefs: 00448B1C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0uJ
API String ID: 2893107130-527112639
Opcode ID: 8b09a79868d1314817dcf6f302a395d0aa9c0920935ad7dfda73aae55ecfe3b2
Instruction ID: cd89d4eaa78391f341ab4aa63b63d4b878b9250a17feaa75f78241a7d2de4edf
Opcode Fuzzy Hash: 8b09a79868d1314817dcf6f302a395d0aa9c0920935ad7dfda73aae55ecfe3b2
Instruction Fuzzy Hash: 7F21E4726355108FD329CF25D841A52B7E1EBA5311F288E6DE0E5CB2D0CA74BD05CB98

Function 003EE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51adf94ac80d2ea7ecccf49343a54db76f57dab57aa69fc4f9ee97bd9cf743a6
Instruction ID: b1573d2c759daf9bae530fbd0d88ca2c99c605f2113884137bdba73d50500199
Opcode Fuzzy Hash: 51adf94ac80d2ea7ecccf49343a54db76f57dab57aa69fc4f9ee97bd9cf743a6
Instruction Fuzzy Hash: 9622C174A00266CFDB25DF56C480BAEB7B4FF04300F14866AE856AB3D1D778AD85CB91

Function 0044C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0044C966
FindClose.KERNEL32(00000000), ref: 0044C996

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: dc3491f869a95164c400c94f5ebadb797e872dd77224e3c7b1461c2922b19c79
Instruction ID: 6e1f8d5843f114bca59d3eae7f60d01ad233988f4e09fc1300aa9d7bee211373
Opcode Fuzzy Hash: dc3491f869a95164c400c94f5ebadb797e872dd77224e3c7b1461c2922b19c79
Instruction Fuzzy Hash: DB11A1726002109FD710EF29D845A2AF7E9FF84324F04862EF8A9DB391DB74AC04CB85

Function 0044A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0045977D,?,0046FB84,?), ref: 0044A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0045977D,?,0046FB84,?), ref: 0044A314

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 56aa8bb0a872ce36aa632a6db3d40f0afdfe6d6d89a9b8f41ae6ab8c858e03e1
Instruction ID: 367694db8328ed8c205414f7fdded7dff8c89b65fd2c84c88f4b35377cc591c2
Opcode Fuzzy Hash: 56aa8bb0a872ce36aa632a6db3d40f0afdfe6d6d89a9b8f41ae6ab8c858e03e1
Instruction Fuzzy Hash: 24F0E23114822DABEB109FA4CC48FEA736CBF08761F0042A6FD08D6281E6709944CBA6

Function 00438713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00438851), ref: 00438728
CloseHandle.KERNEL32(?,?,00438851), ref: 0043873A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 38cbfea2b752a370a6392f5b04a7f12707c4a006eee9ccf209ec4d25a1ded64b
Instruction ID: 8c5e190513445ed3b21ef531c77bc0aa276f4f978f14fbdda068827079527802
Opcode Fuzzy Hash: 38cbfea2b752a370a6392f5b04a7f12707c4a006eee9ccf209ec4d25a1ded64b
Instruction Fuzzy Hash: 38E0B676014611EEE7252B61FC09D77BBA9EB04354B24883EF8D690870DBB6AC90DB54

Function 0040A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00408F97,?,?,?,00000001), ref: 0040A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0040A3A3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b622a3df41f8a94f907b7d33d2849a3184b935e67241c561310d77cf32ab1c79
Instruction ID: 246f8a8197968ac254506115b5e3a4c1b5c43bbea20d895d4fddf0fa4c866c33
Opcode Fuzzy Hash: b622a3df41f8a94f907b7d33d2849a3184b935e67241c561310d77cf32ab1c79
Instruction Fuzzy Hash: 23B09231058208ABCA002B91FC09B883F68EB44AA2F404030FA4D84E60FBA254948A9A

Function 0040F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f345cd08a4db17218614adc10e6fa8a017871277b1274e17657e50906187479
Instruction ID: d75df76bf64b636e7948e3e02e6f45f44facfc7045851ea5ea73d8916530f75f
Opcode Fuzzy Hash: 2f345cd08a4db17218614adc10e6fa8a017871277b1274e17657e50906187479
Instruction Fuzzy Hash: 8232F122D69F014DD7239634D832336A249AFB73C8F55D737E81AB5EA6EB3894C34108

Function 0041267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30424454b63d6a900128b0dbfbb23dd57a0b457b930ed8f941784c035843fb6c
Instruction ID: 960dad7afe36d0b3484cb4902c629eb3d50d8b0d1ac9fd39a292a65a13c95fb2
Opcode Fuzzy Hash: 30424454b63d6a900128b0dbfbb23dd57a0b457b930ed8f941784c035843fb6c
Instruction Fuzzy Hash: 87B1E030D2AF414DD2239A39893533AB65CAFFB2C5B51D72BFC2A74D22EB2285D34145

Function 004541FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00454218

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 27d9f9f5a24369dddb0043e1bbb702eb59efbecc4ac211cbc1ce420640c474e4
Instruction ID: 58cb240c1ebe8b6727651aba52a809bb4de06ba80b83430b6d551980b86ce303
Opcode Fuzzy Hash: 27d9f9f5a24369dddb0043e1bbb702eb59efbecc4ac211cbc1ce420640c474e4
Instruction Fuzzy Hash: 85E048712401245FC710EF5AD444A5AF7DCAF947A1F008067FC49CF352DA74E8458B95

Function 00444EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00444EEC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 1a1670e2fe5f5fff49789819ae6e073ba2a2d33538f8cc96d4e9737b685ec08d
Instruction ID: e094c004849a7beafd985facefc935c1c2f7248f000e5a43aab10d4a84d81ba1
Opcode Fuzzy Hash: 1a1670e2fe5f5fff49789819ae6e073ba2a2d33538f8cc96d4e9737b685ec08d
Instruction Fuzzy Hash: 8BD05E9816060539FC184B209C5FF770108F3C0786FF0414BB102891C2E8D86D55603A

Function 00438C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,004388D1), ref: 00438CB3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: f4ab0668a5cdb40de05788ccebab24a03e5fa43e7b220a84ccb3929aaade9ab6
Instruction ID: 5b8ddd1440f080336230a3009f1b510e75870a430d192ac41c08e8c06670249d
Opcode Fuzzy Hash: f4ab0668a5cdb40de05788ccebab24a03e5fa43e7b220a84ccb3929aaade9ab6
Instruction Fuzzy Hash: 8DD05E3226050EBBEF018EA4ED01EAE3B69EB04B01F408121FE15C50A1C7B5E835AB60

Function 00422230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00422242

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1eb8d0c742fcfa5c76fa67995fd87dcea7bba558cf4b8b8d9bb632c5a83be9d1
Instruction ID: 97c2d0479aa172b36e820346004eaa83e33516ef200f205509b13d1a9136d7aa
Opcode Fuzzy Hash: 1eb8d0c742fcfa5c76fa67995fd87dcea7bba558cf4b8b8d9bb632c5a83be9d1
Instruction Fuzzy Hash: B8C04CF1800119DBDB05DB90E988DEE77BCAB04304F104066E141F2110E7749B448A76

Function 0040A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0040A36A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 632cc7977e84c4f0b836a8dcb71b9b5c0a3c24a2b4450a7fc754353fab9e382f
Instruction ID: 904c2c0e146163eecd774551b64cb228fae97a39b42aeefccd3fd692c07b7950
Opcode Fuzzy Hash: 632cc7977e84c4f0b836a8dcb71b9b5c0a3c24a2b4450a7fc754353fab9e382f
Instruction Fuzzy Hash: D1A0123000010CA78A001B41FC044447F5CD6001907004030F80C40921A77254504585

Function 003F8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60cb3cb59148bd72f936326f4040ae6b58e765262e97bf6f39a4056a8a3ac36b
Instruction ID: 0bbfa37045f07492351ee48ef9e8d464ee5db6922e83394c4da549296ef7bd58
Opcode Fuzzy Hash: 60cb3cb59148bd72f936326f4040ae6b58e765262e97bf6f39a4056a8a3ac36b
Instruction Fuzzy Hash: 9422493060565ACBDF2ECF28C4D467EB7A1EF06300F25846BDA468B691DB38DD81CB65

Function 00402405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: ac74072593a192bfb1c9d4158ab543cf2a8dc83d45fb68f1f4af1d5f384bf0a2
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 14C1953220509309DF1D4639963803FBAE15AA27B131A077FE8B3EB6D4EF78D524D624

Function 0040283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: e864a320ff62df16d62bfd38d6095e3f1655b1f0cac8456e574babd565483795
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 95C1963220519309DF6D4639863803FBBE15A927B131A077FE4B2EB6D4EF78D524E624

Function 00457B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00457B70
DeleteObject.GDI32(00000000), ref: 00457B82
DestroyWindow.USER32 ref: 00457B90
GetDesktopWindow.USER32 ref: 00457BAA
GetWindowRect.USER32(00000000), ref: 00457BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00457CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00457D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457D4A
GetClientRect.USER32(00000000,?), ref: 00457D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00457D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457DF8
GlobalFree.KERNEL32(00000000), ref: 00457E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00472CAC,00000000), ref: 00457E2B
GlobalFree.KERNEL32(00000000), ref: 00457E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00457E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00457E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00457EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0045808F

Strings

AutoIt v3, xrefs: 00457D42
, xrefs: 00458015
static, xrefs: 00457D8A, 00457EE1
DISPLAY, xrefs: 00457EF2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: adcdc7caa27cf96dd421a1d1607c497e04a7d4ed1c9d49e1849f778cd62c0b86
Instruction ID: 96cffcb4789d71940c4e64f92e41640a34c90341f60f9a214f2ad3d216dc6548
Opcode Fuzzy Hash: adcdc7caa27cf96dd421a1d1607c497e04a7d4ed1c9d49e1849f778cd62c0b86
Instruction Fuzzy Hash: B402CF71900114EFCB10DFA4EC88EAE7BB8FF49311F14816AF905AB2A1DB74AD05CB64

Function 004637F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0046F910), ref: 004638AF
IsWindowVisible.USER32(?), ref: 004638D3

Strings

HIDEDROPDOWN, xrefs: 00463988
FINDSTRING, xrefs: 004639FE
GETSELECTED, xrefs: 00463B2B
CURRENTTAB, xrefs: 00463945
SETCURRENTSELECTION, xrefs: 00463A3E
UNCHECK, xrefs: 00463B0B
GETLINECOUNT, xrefs: 00463B4E
ISCHECKED, xrefs: 00463AC1
GETCURRENTCOL, xrefs: 00463BB0
SENDCOMMANDID, xrefs: 00463C62
TABRIGHT, xrefs: 00463925
ISENABLED, xrefs: 004638F3
DELSTRING, xrefs: 004639D1
GETLINE, xrefs: 00463C23
ISVISIBLE, xrefs: 004638BF
GETCURRENTSELECTION, xrefs: 00463A6B
CHECK, xrefs: 00463AF5
SELECTSTRING, xrefs: 00463A8E
GETCURRENTLINE, xrefs: 00463B75
ADDSTRING, xrefs: 0046399E
EDITPASTE, xrefs: 00463BE7
TABLEFT, xrefs: 0046390F
SHOWDROPDOWN, xrefs: 00463968

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 62cd51e333db3bb88d856444396ff88e053ec752ad59f2db0459128895765e33
Instruction ID: 778222effa04ed314c2a5a90b8e602093dd625341e986c4fe35c013701af77c5
Opcode Fuzzy Hash: 62cd51e333db3bb88d856444396ff88e053ec752ad59f2db0459128895765e33
Instruction Fuzzy Hash: D1D1A7302043459BCB14EF11C551A6A7BA5EF54748F10446EB8866B3E3DB38EE0BCB9B

Function 0046A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0046A89F
GetSysColorBrush.USER32(0000000F), ref: 0046A8D0
GetSysColor.USER32(0000000F), ref: 0046A8DC
SetBkColor.GDI32(?,000000FF), ref: 0046A8F6
SelectObject.GDI32(?,?), ref: 0046A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0046A930
GetSysColor.USER32(00000010), ref: 0046A938
CreateSolidBrush.GDI32(00000000), ref: 0046A93F
FrameRect.USER32(?,?,00000000), ref: 0046A94E
DeleteObject.GDI32(00000000), ref: 0046A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0046A9A0
FillRect.USER32(?,?,?), ref: 0046A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0046A9FD

Part of subcall function 0046AB60: GetSysColor.USER32(00000012), ref: 0046AB99
Part of subcall function 0046AB60: SetTextColor.GDI32(?,?), ref: 0046AB9D
Part of subcall function 0046AB60: GetSysColorBrush.USER32(0000000F), ref: 0046ABB3
Part of subcall function 0046AB60: GetSysColor.USER32(0000000F), ref: 0046ABBE
Part of subcall function 0046AB60: GetSysColor.USER32(00000011), ref: 0046ABDB
Part of subcall function 0046AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0046ABE9
Part of subcall function 0046AB60: SelectObject.GDI32(?,00000000), ref: 0046ABFA
Part of subcall function 0046AB60: SetBkColor.GDI32(?,00000000), ref: 0046AC03
Part of subcall function 0046AB60: SelectObject.GDI32(?,?), ref: 0046AC10
Part of subcall function 0046AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0046AC2F
Part of subcall function 0046AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0046AC46
Part of subcall function 0046AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0046AC5B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 8ddc26a6ce9bbf517e357f9d5f84c67fccda558b0d44c7f1efde0fd265e89993
Instruction ID: bef8586991b5842976d061be5b97f7c0d6f83180ccc9859decd322fa603852cc
Opcode Fuzzy Hash: 8ddc26a6ce9bbf517e357f9d5f84c67fccda558b0d44c7f1efde0fd265e89993
Instruction Fuzzy Hash: 45A18272008701BFD7109F64EC08A5B7BA9FF89321F104A3AF5A2A61A1E775D849CF57

Function 003E2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 003E2CA2
DeleteObject.GDI32(00000000), ref: 003E2CE8
DeleteObject.GDI32(00000000), ref: 003E2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 003E2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 003E2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0041C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0041C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0041CAED

Part of subcall function 003E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003E2036,?,00000000,?,?,?,?,003E16CB,00000000,?), ref: 003E1B9A

SendMessageW.USER32(?,00001053), ref: 0041CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0041CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0041CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0041CB62

Strings

0, xrefs: 0041C981

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a079dd46bc9d61776cd8701282a7f83a54d83c6bc666b6033d8c55823a1aa901
Instruction ID: e6d9008bb014fcad2413a813ef667228d913d1aae5cee7e8989ead681bdda8fe
Opcode Fuzzy Hash: a079dd46bc9d61776cd8701282a7f83a54d83c6bc666b6033d8c55823a1aa901
Instruction Fuzzy Hash: BA12CE70244251EFCB11DF25C8C4BAAB7E9BF04310F54467AE896DB2A2C775EC82CB95

Function 004577BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 004577F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004578B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004578EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00457900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00457946
GetClientRect.USER32(00000000,?), ref: 00457952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00457996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004579A5
GetStockObject.GDI32(00000011), ref: 004579B5
SelectObject.GDI32(00000000,00000000), ref: 004579B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 004579C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004579D2
DeleteDC.GDI32(00000000), ref: 004579DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00457A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00457A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00457A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00457A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00457A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00457AAE
GetStockObject.GDI32(00000011), ref: 00457AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00457AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00457ACE

Strings

AutoIt v3, xrefs: 0045793E
static, xrefs: 00457990, 00457AA8
msctls_progress32, xrefs: 00457A4F
DISPLAY, xrefs: 0045799B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 4b59d4414ff86e22e5fab46e6d4851549e856440b7b9f6f5b7537a5fcd47131e
Instruction ID: c86119b1f33a1b09479d34364110c4413b4097a4f4f83bc6bace41920f6db089
Opcode Fuzzy Hash: 4b59d4414ff86e22e5fab46e6d4851549e856440b7b9f6f5b7537a5fcd47131e
Instruction Fuzzy Hash: 9CA1A571A00215BFEB10DF64EC49FAE7BB9EB45710F144125FA14A72E1D7B4AD04CB68

Function 0044AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0044AF89
GetDriveTypeW.KERNEL32(?,0046FAC0,?,\\.\,0046F910), ref: 0044B066
SetErrorMode.KERNEL32(00000000,0046FAC0,?,\\.\,0046F910), ref: 0044B1C4

Strings

FileBackedVirtual, xrefs: 0044B193
Fixed, xrefs: 0044B0AE
ATA, xrefs: 0044B13F
Virtual, xrefs: 0044B18C
Unknown, xrefs: 0044B086, 0044B12A
\\.\, xrefs: 0044AFDB
RAID, xrefs: 0044B162
SSD, xrefs: 0044B0F1
ATAPI, xrefs: 0044B138
PhysicalDrive, xrefs: 0044B012
CDROM, xrefs: 0044B09A
SATA, xrefs: 0044B177
Removable, xrefs: 0044B0B8
Fibre, xrefs: 0044B154
Network, xrefs: 0044B0A4
iSCSI, xrefs: 0044B169
SAS, xrefs: 0044B170
SCSI, xrefs: 0044B131
1394, xrefs: 0044B146
USB, xrefs: 0044B15B
RAMDisk, xrefs: 0044B090
SSA, xrefs: 0044B14D
MMC, xrefs: 0044B185

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 96a3be7456723b052d47fbc2232308fd9d5750ccfe5ecf916bef95ac91c5b978
Instruction ID: fc62c6b157053aceda8f444eb6b85b5170a144c143cbb97160ba266527648401
Opcode Fuzzy Hash: 96a3be7456723b052d47fbc2232308fd9d5750ccfe5ecf916bef95ac91c5b978
Instruction Fuzzy Hash: 5F51A230684345ABEF00DB51C992ABD77B0EB543817304167E40AAB290D76DDD56DBCB

Function 003E6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 003E6A91
__wcsnicmp.LIBCMT ref: 003E6AA9
__wcsnicmp.LIBCMT ref: 003E6AC1
__wcsnicmp.LIBCMT ref: 003E6AD9
__wcsnicmp.LIBCMT ref: 003E6AF1
__wcsnicmp.LIBCMT ref: 003E6B09
__wcsnicmp.LIBCMT ref: 003E6B21
__wcsnicmp.LIBCMT ref: 003E6B35
__wcsnicmp.LIBCMT ref: 003E6B76
__wcsnicmp.LIBCMT ref: 003E6B8A
__wcsnicmp.LIBCMT ref: 003E6B9E
__wcsnicmp.LIBCMT ref: 003E6BB2

Strings

#OnAutoItStartRegister, xrefs: 003E6AD3
Bad directive syntax error, xrefs: 0041E743
Cannot parse #include, xrefs: 0041E819
#notrayicon, xrefs: 003E6AA3
#ce, xrefs: 003E6BAC
#include-once, xrefs: 003E6AEB
#cs, xrefs: 003E6B2F, 003E6B84
#comments-end, xrefs: 003E6B98
#include, xrefs: 003E6B03
#comments-start, xrefs: 003E6B1B, 003E6B70
Unterminated group of comments, xrefs: 0041E82C
#pragma compile, xrefs: 003E6A8B
#requireadmin, xrefs: 003E6ABB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 92a8a8e404f4e830f14e60149924aa4354767606fb5cd684c9be41e996f1ffbb
Instruction ID: f7b22af2b59607e97ab1145481f84dc8ef10075a0a26091ddd820025f7652709
Opcode Fuzzy Hash: 92a8a8e404f4e830f14e60149924aa4354767606fb5cd684c9be41e996f1ffbb
Instruction Fuzzy Hash: 7D811A70600265AADB22AF23CD43FAF7B58AF20744F144136FD45AA1C2EB78DA45C669

Function 0046AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0046AB99
SetTextColor.GDI32(?,?), ref: 0046AB9D
GetSysColorBrush.USER32(0000000F), ref: 0046ABB3
GetSysColor.USER32(0000000F), ref: 0046ABBE
CreateSolidBrush.GDI32(?), ref: 0046ABC3
GetSysColor.USER32(00000011), ref: 0046ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0046ABE9
SelectObject.GDI32(?,00000000), ref: 0046ABFA
SetBkColor.GDI32(?,00000000), ref: 0046AC03
SelectObject.GDI32(?,?), ref: 0046AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0046AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0046AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0046AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0046ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0046ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0046ACEC
DrawFocusRect.USER32(?,?), ref: 0046ACF7
GetSysColor.USER32(00000011), ref: 0046AD05
SetTextColor.GDI32(?,00000000), ref: 0046AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0046AD21
SelectObject.GDI32(?,0046A869), ref: 0046AD38
DeleteObject.GDI32(?), ref: 0046AD43
SelectObject.GDI32(?,?), ref: 0046AD49
DeleteObject.GDI32(?), ref: 0046AD4E
SetTextColor.GDI32(?,?), ref: 0046AD54
SetBkColor.GDI32(?,?), ref: 0046AD5E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 60658999958d138086c0128bac1bfcbe5efdf2828578108373449cd5a08e8e17
Instruction ID: 4d468fcc9249da6347a09d79324bfa78515c2b4a6b6ec535b92f2e9cdfe38fed
Opcode Fuzzy Hash: 60658999958d138086c0128bac1bfcbe5efdf2828578108373449cd5a08e8e17
Instruction Fuzzy Hash: 3C615C71900218BFDB119FA4EC48AAE7B79EF08320F104126F915BB2A1E6B59D50DF96

Function 00468C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00468D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00468D45
CharNextW.USER32(0000014E), ref: 00468D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00468DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00468DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00468DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00468DF9
SetWindowTextW.USER32(?,0000014E), ref: 00468E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00468E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00468E8C
_memset.LIBCMT ref: 00468EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00468EFA
_memset.LIBCMT ref: 00468F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00468F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00468FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00469088
InvalidateRect.USER32(?,00000000,00000001), ref: 004690AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004690F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00469121
DrawMenuBar.USER32(?), ref: 00469130
SetWindowTextW.USER32(?,0000014E), ref: 00469158

Strings

0, xrefs: 004690C2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 69965695e36d72bb6e96029b41c77ba3f10fff10662c6d815c7e116e23f59445
Instruction ID: a9d28afb73c61bfed9898bb9565fe6e2fa1844b04f87ea5507e5527c1a5cdb3c
Opcode Fuzzy Hash: 69965695e36d72bb6e96029b41c77ba3f10fff10662c6d815c7e116e23f59445
Instruction Fuzzy Hash: D6E1A570900219ABDF10DF51CC88EEF7B79EF05714F10426BF915AA290EB788946DF6A

Function 00464B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00464C51
GetDesktopWindow.USER32 ref: 00464C66
GetWindowRect.USER32(00000000), ref: 00464C6D
GetWindowLongW.USER32(?,000000F0), ref: 00464CCF
DestroyWindow.USER32(?), ref: 00464CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00464D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00464D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00464D68
SendMessageW.USER32(?,00000421,?,?), ref: 00464D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00464D90
IsWindowVisible.USER32(?), ref: 00464DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00464DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00464DDF
GetWindowRect.USER32(?,?), ref: 00464DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00464E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00464E37
CopyRect.USER32(?,?), ref: 00464E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00464EB9

Strings

tooltips_class32, xrefs: 00464D1D
(, xrefs: 00464E2A
0, xrefs: 00464BFC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 25194247a09e3c634a9c1aa6c3ec201be1d90f5d8ba0728d48a320f345e0cfd8
Instruction ID: 3be5dbf475a92ab054b1918b02bd8e1cce05cb5e6bcd535d2a7f608b6ee67240
Opcode Fuzzy Hash: 25194247a09e3c634a9c1aa6c3ec201be1d90f5d8ba0728d48a320f345e0cfd8
Instruction Fuzzy Hash: 04B18A71604350AFDB04DF25D844B6BBBE4BF84710F008A2EF5999B2A1E775EC05CB9A

Function 003E27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003E28BC
GetSystemMetrics.USER32(00000007), ref: 003E28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 003E28EF
GetSystemMetrics.USER32(00000008), ref: 003E28F7
GetSystemMetrics.USER32(00000004), ref: 003E291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 003E2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 003E2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 003E297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 003E2990
GetClientRect.USER32(00000000,000000FF), ref: 003E29AE
GetStockObject.GDI32(00000011), ref: 003E29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 003E29D5

Part of subcall function 003E2344: GetCursorPos.USER32(?), ref: 003E2357
Part of subcall function 003E2344: ScreenToClient.USER32(004A67B0,?), ref: 003E2374
Part of subcall function 003E2344: GetAsyncKeyState.USER32(00000001), ref: 003E2399
Part of subcall function 003E2344: GetAsyncKeyState.USER32(00000002), ref: 003E23A7

SetTimer.USER32(00000000,00000000,00000028,003E1256), ref: 003E29FC

Strings

AutoIt v3 GUI, xrefs: 003E2974

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: e5f749b5a712a8d4def29ae1c6ed31a786d4894c806bf2527a943470b06aeb08
Instruction ID: b63bd45b13208bf035fe96b33a25a2f5b1a56706907833c4274366420bf117d4
Opcode Fuzzy Hash: e5f749b5a712a8d4def29ae1c6ed31a786d4894c806bf2527a943470b06aeb08
Instruction Fuzzy Hash: F4B1BF7160025AEFDB15DFA9DC45BAE7BB8FB08310F118229FA16E72D0DB74A840CB55

Function 00464069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004640F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 004641B6

Strings

VIEWCHANGE, xrefs: 00464375
GETSELECTED, xrefs: 004642E4
FINDITEM, xrefs: 00464329
ISSELECTED, xrefs: 004641C1
DESELECT, xrefs: 004642A4
SELECTALL, xrefs: 0046421D
SELECTINVERT, xrefs: 00464286
GETTEXT, xrefs: 0046415F
GETITEMCOUNT, xrefs: 00464128
SELECTCLEAR, xrefs: 00464235
SELECT, xrefs: 00464250
GETSUBITEMCOUNT, xrefs: 00464141
GETSELECTEDCOUNT, xrefs: 00464199

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: e33be31acabaa9137f983b7862eecb1d26f073fd805a1849f67bcb0779b48b70
Instruction ID: fc973a4641e72f6a672effeafe5a293de1cfad7b1071b52d957b2cbd74944075
Opcode Fuzzy Hash: e33be31acabaa9137f983b7862eecb1d26f073fd805a1849f67bcb0779b48b70
Instruction Fuzzy Hash: CAA191702143519BCF14EF11C951B6AB7A5AF84318F10896FB8965B3D2EB38EC06CB5A

Function 004552F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00455309
LoadCursorW.USER32(00000000,00007F8A), ref: 00455314
LoadCursorW.USER32(00000000,00007F00), ref: 0045531F
LoadCursorW.USER32(00000000,00007F03), ref: 0045532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00455335
LoadCursorW.USER32(00000000,00007F01), ref: 00455340
LoadCursorW.USER32(00000000,00007F81), ref: 0045534B
LoadCursorW.USER32(00000000,00007F88), ref: 00455356
LoadCursorW.USER32(00000000,00007F80), ref: 00455361
LoadCursorW.USER32(00000000,00007F86), ref: 0045536C
LoadCursorW.USER32(00000000,00007F83), ref: 00455377
LoadCursorW.USER32(00000000,00007F85), ref: 00455382
LoadCursorW.USER32(00000000,00007F82), ref: 0045538D
LoadCursorW.USER32(00000000,00007F84), ref: 00455398
LoadCursorW.USER32(00000000,00007F04), ref: 004553A3
LoadCursorW.USER32(00000000,00007F02), ref: 004553AE
GetCursorInfo.USER32(?), ref: 004553BE
GetLastError.KERNEL32(00000001,00000000), ref: 004553E9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 3289422cbcf56d8fb5e696a654d26e0bef51f132c7ac28d3e6ff2b56b8a42e63
Instruction ID: 642615879e37289f9cd508b18f670cc9ea15660c74a00e0317976349ae9fdb35
Opcode Fuzzy Hash: 3289422cbcf56d8fb5e696a654d26e0bef51f132c7ac28d3e6ff2b56b8a42e63
Instruction Fuzzy Hash: 06417370E043196ADB109FBA9C4996FFFF8EF51B10F10453FE509EB291DAB8A4018E55

Function 0043AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0043AAA5
__swprintf.LIBCMT ref: 0043AB46
_wcscmp.LIBCMT ref: 0043AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0043ABAE
_wcscmp.LIBCMT ref: 0043ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0043AC21
GetDlgCtrlID.USER32(?), ref: 0043AC73
GetWindowRect.USER32(?,?), ref: 0043ACA9
GetParent.USER32(?), ref: 0043ACC7
ScreenToClient.USER32(00000000), ref: 0043ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0043AD48
_wcscmp.LIBCMT ref: 0043AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0043AD82
_wcscmp.LIBCMT ref: 0043AD96

Part of subcall function 0040386C: _iswctype.LIBCMT ref: 00403874

Strings

%s%u, xrefs: 0043AB40

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 999a89b7d811aa288c90cfe65de48b5272aab71b2131da8a42362205a19d0cf6
Instruction ID: eeacda07d4bff39dc68dc988f4889e6375e8c0b73acd023b8095c91d27f27a0d
Opcode Fuzzy Hash: 999a89b7d811aa288c90cfe65de48b5272aab71b2131da8a42362205a19d0cf6
Instruction Fuzzy Hash: 8DA1D171244306AFD714DF20C884BABB7E9FF08315F00962AF9D9D2690D738E965CB96

Function 0043B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0043B3DB
_wcscmp.LIBCMT ref: 0043B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0043B414
CharUpperBuffW.USER32(?,00000000), ref: 0043B431
_wcscmp.LIBCMT ref: 0043B44F
_wcsstr.LIBCMT ref: 0043B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0043B498
_wcscmp.LIBCMT ref: 0043B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0043B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0043B518
_wcscmp.LIBCMT ref: 0043B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0043B550
GetWindowRect.USER32(00000004,?), ref: 0043B5B9

Strings

@, xrefs: 0043B3BC
ThumbnailClass, xrefs: 0043B4A3, 0043B523

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: a5a2b7194f94141d3e84725e80666c3ec823c64bf0379716e65857156c2a103c
Instruction ID: e1c0eab7d4fd6e5a2633b7d144a41219608c4dbe627550454bdcbca52c14172e
Opcode Fuzzy Hash: a5a2b7194f94141d3e84725e80666c3ec823c64bf0379716e65857156c2a103c
Instruction Fuzzy Hash: 8E81D3710083059BDB01DF10C885F6B7BE8EF48318F04956EFE859A192DB38DD49CBAA

Function 0046C8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

DragQueryPoint.SHELL32(?,?), ref: 0046C917

Part of subcall function 0046ADF1: ClientToScreen.USER32(?,?), ref: 0046AE1A
Part of subcall function 0046ADF1: GetWindowRect.USER32(?,?), ref: 0046AE90
Part of subcall function 0046ADF1: PtInRect.USER32(?,?,0046C304), ref: 0046AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0046C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0046C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0046C9AE
_wcscat.LIBCMT ref: 0046C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0046C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0046CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0046CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0046CA47
DragFinish.SHELL32(?), ref: 0046CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0046CB41

Strings

@GUI_DROPID, xrefs: 0046CA6E
@GUI_DRAGFILE, xrefs: 0046CAF0
prJ, xrefs: 0046CA8B
@GUI_DRAGID, xrefs: 0046CAB9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$prJ
API String ID: 169749273-1172367558
Opcode ID: 90b8c801571639d5f256e75a8c003232c2437cf78e05679f13b2be565e6473c7
Instruction ID: 8575bedcb9bdf8c045fc001a083678e611ae694db41af33bbe0994373f0e5412
Opcode Fuzzy Hash: 90b8c801571639d5f256e75a8c003232c2437cf78e05679f13b2be565e6473c7
Instruction Fuzzy Hash: 4A619E71108340AFC701EF61DC85DAFBBE8FF99710F000A2EF5A5961A1EB749A09CB56

Function 0043B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0043B23F

Strings

REGEXP=, xrefs: 0043B254
[ACTIVE, xrefs: 0043B22C
[CLASS:, xrefs: 0043B28F
[REGEXPTITLE:, xrefs: 0043B267
[HANDLE:, xrefs: 0043B24B
[LAST, xrefs: 0043B2EC
ACTIVE, xrefs: 0043B21A
[ALL, xrefs: 0043B2E5
CLASSNAME=, xrefs: 0043B27C
ALL, xrefs: 0043B2D3
LAST, xrefs: 0043B204
HANDLE=, xrefs: 0043B238

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 7f703ddef491c032bf9cb4c2833100024576cec4a25e290ed3ccfb31763edde8
Instruction ID: 46ff8ed269d1b059b067233763a084a0609367f9cf180689ab2a16294a418b71
Opcode Fuzzy Hash: 7f703ddef491c032bf9cb4c2833100024576cec4a25e290ed3ccfb31763edde8
Instruction Fuzzy Hash: DE31FC30A04259A6DF01FAA2CC43FEF7BA89F28750F20027FB500750D2EF696E04C699

Function 0043C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0043C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0043C4E6
SetWindowTextW.USER32(?,?), ref: 0043C4FD
GetDlgItem.USER32(?,000003EA), ref: 0043C512
SetWindowTextW.USER32(00000000,?), ref: 0043C518
GetDlgItem.USER32(?,000003E9), ref: 0043C528
SetWindowTextW.USER32(00000000,?), ref: 0043C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0043C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0043C569
GetWindowRect.USER32(?,?), ref: 0043C572
SetWindowTextW.USER32(?,?), ref: 0043C5DD
GetDesktopWindow.USER32 ref: 0043C5E3
GetWindowRect.USER32(00000000), ref: 0043C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0043C636
GetClientRect.USER32(?,?), ref: 0043C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0043C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0043C693

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 977454702107c56bd2aed30bd0361b0367337dd8c676a898109b73d30cde8610
Instruction ID: b1e9235f0c87cdbae6aa0691b8432dc4e402a4224e2c9802092afa2745c193b2
Opcode Fuzzy Hash: 977454702107c56bd2aed30bd0361b0367337dd8c676a898109b73d30cde8610
Instruction Fuzzy Hash: CF517E71900709AFDB20DFA8DD85B6FBBF5FF08705F004929E692A26A0D7B4A905CB54

Function 0046A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0046A4C8
DestroyWindow.USER32(?,?), ref: 0046A542

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0046A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0046A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0046A5F1
DestroyWindow.USER32(00000000), ref: 0046A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,003E0000,00000000), ref: 0046A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0046A663
GetDesktopWindow.USER32 ref: 0046A67C
GetWindowRect.USER32(00000000), ref: 0046A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0046A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0046A6B3

Part of subcall function 003E25DB: GetWindowLongW.USER32(?,000000EB), ref: 003E25EC

Strings

0, xrefs: 0046A4DE
tooltips_class32, xrefs: 0046A5B5, 0046A643

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: a33f9e3d7179dac0e62b1ec3fe2f959fbb56307a700510d42022be543ef2cf83
Instruction ID: 8d6d9eeea67c5792548a7dccafd03c2d4f111ea68207c9220ae815b1b50489e5
Opcode Fuzzy Hash: a33f9e3d7179dac0e62b1ec3fe2f959fbb56307a700510d42022be543ef2cf83
Instruction Fuzzy Hash: DC71AD70140605AFD710DF28CC44F677BE9EB88700F08452EF995972A0E7B8E926CF1A

Function 00464619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004646AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004646F6

Strings

GETTEXT, xrefs: 00464849
CHECK, xrefs: 00464716
GETITEMCOUNT, xrefs: 004647D8
EXISTS, xrefs: 0046475F
GETSELECTED, xrefs: 00464806
EXPAND, xrefs: 004647A8
UNCHECK, xrefs: 004648D2
ISCHECKED, xrefs: 00464879
COLLAPSE, xrefs: 0046473C
SELECT, xrefs: 004648A7
GETTOTALCOUNT, xrefs: 004646DD

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 8dedd29530164006145d72eeec09869fd3b53b3bfdf66ae888a0b2012d0342a5
Instruction ID: a9439c109a264f1cdc62586426557ff03e0121c94635f1d23e0fef81a037b9c9
Opcode Fuzzy Hash: 8dedd29530164006145d72eeec09869fd3b53b3bfdf66ae888a0b2012d0342a5
Instruction Fuzzy Hash: 9891A2742043519FCF14EF21C451B6AB7A1AF94314F00856EF8965B3E2DB38ED0ACB9A

Function 0046BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0046BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00466D80,?), ref: 0046BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0046BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0046BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0046BC7D
FreeLibrary.KERNEL32(?), ref: 0046BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0046BC99
DestroyIcon.USER32(?), ref: 0046BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0046BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0046BCD1

Part of subcall function 0040313D: __wcsicmp_l.LIBCMT ref: 004031C6

Strings

.exe, xrefs: 0046BB04
.icl, xrefs: 0046BAE4
.dll, xrefs: 0046BB27

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 6dbb1136c592bfc664fa24dc4cc08f0ddb1b3c0cf08e518c8a555c5d3e2b2c3d
Instruction ID: 0da86e85f3a425dacc524014995c013fee240f7e38a49414cd1c8c9147f7d158
Opcode Fuzzy Hash: 6dbb1136c592bfc664fa24dc4cc08f0ddb1b3c0cf08e518c8a555c5d3e2b2c3d
Instruction Fuzzy Hash: 0161E471500215BEEB14DF64DC45FBA77ACFB08711F10422BF815DA1C0EBB8AA94CBA5

Function 0044A0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0046FB78), ref: 0044A0FC

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0044A11E
__swprintf.LIBCMT ref: 0044A177
__swprintf.LIBCMT ref: 0044A190
_wprintf.LIBCMT ref: 0044A246
_wprintf.LIBCMT ref: 0044A264

Strings

%G, xrefs: 0044A0C9
Line %d (File "%s"):, xrefs: 0044A171, 0044A18A
^ ERROR, xrefs: 0044A1E8
Error: , xrefs: 0044A20E
"%s" (%d) : ==> %s:, xrefs: 0044A25F
"%s" (%d) : ==> %s:%s%s, xrefs: 0044A241

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%G
API String ID: 311963372-2373659278
Opcode ID: a0392eab8b28b20ac2e176cdd10f9e63dbdf7a7976f0a065f33bc0a12a4bfc91
Instruction ID: 019016f9f806a87a74984e7206b8be63ce5ec01ad9caed6ddaf29f064cb63efb
Opcode Fuzzy Hash: a0392eab8b28b20ac2e176cdd10f9e63dbdf7a7976f0a065f33bc0a12a4bfc91
Instruction Fuzzy Hash: 2751C132900119AADF16EBE1CD82EEEB778AF04300F2002BAF405761E1EB752F59DB55

Function 0044A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

CharLowerBuffW.USER32(?,?), ref: 0044A636
GetDriveTypeW.KERNEL32 ref: 0044A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0044A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0044A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0044A730

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Strings

close, xrefs: 0044A63C
closed, xrefs: 0044A64A, 0044A653
type cdaudio alias cd wait, xrefs: 0044A6AE
set cd door , xrefs: 0044A6D1
wait, xrefs: 0044A6ED
close cd wait, xrefs: 0044A71B
open, xrefs: 0044A65D
open , xrefs: 0044A692

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: bfa3be74f8b55c5079d550e920e6d1a8d2b2c126944c50eb7e3023c09120fc27
Instruction ID: ee8edd88595598c7788b1e324c3501d71006e209b522290411b5ac9f3ab69a02
Opcode Fuzzy Hash: bfa3be74f8b55c5079d550e920e6d1a8d2b2c126944c50eb7e3023c09120fc27
Instruction Fuzzy Hash: 525190711083549FD701EF11C88196AB7F4FF94718F14496EF8855B291DB35EE0ACB92

Function 0044A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0044A47A
__swprintf.LIBCMT ref: 0044A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0044A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0044A4FE
_memset.LIBCMT ref: 0044A51D
_wcsncpy.LIBCMT ref: 0044A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0044A58E
CloseHandle.KERNEL32(00000000), ref: 0044A599
RemoveDirectoryW.KERNEL32(?), ref: 0044A5A2
CloseHandle.KERNEL32(00000000), ref: 0044A5AC

Strings

\, xrefs: 0044A4B2
:, xrefs: 0044A4BD
\??\%s, xrefs: 0044A496

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: ee5d5f1781f35d08c806362a0fd2e7c1f8d5788a239887cdbebadc19ab7c02b7
Instruction ID: 92d9a04fe89114926325c48ff14d69353d0592a8a09e97a9d6d2c6fda16ed9ab
Opcode Fuzzy Hash: ee5d5f1781f35d08c806362a0fd2e7c1f8d5788a239887cdbebadc19ab7c02b7
Instruction Fuzzy Hash: 3131B2B1540109ABEB20DFA1DC48FEB37BCEF88701F1040BAF908D6160E7B497588B29

Function 0041AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0041AB7B
___wtomb_environ.LIBCMT ref: 0041AB9D

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

__malloc_crt.LIBCMT ref: 0041ABC5
__malloc_crt.LIBCMT ref: 0041ABE2
_free.LIBCMT ref: 0041AC19
__recalloc_crt.LIBCMT ref: 0041AC52
__recalloc_crt.LIBCMT ref: 0041AC97
_strlen.LIBCMT ref: 0041ACC3
__calloc_crt.LIBCMT ref: 0041ACCD
_strlen.LIBCMT ref: 0041ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0041AD0A
_free.LIBCMT ref: 0041AD24
_free.LIBCMT ref: 0041AD31
_free.LIBCMT ref: 0041AD43
__invoke_watson.LIBCMT ref: 0041AD5D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 0f867c274f4176eb3606cbbc38549f53c1466aa658653ce302440124b2093d30
Instruction ID: e3fa9b538b801752b4e87bb68389f346ce9accc4188c540a023b4c2dedd86256
Opcode Fuzzy Hash: 0f867c274f4176eb3606cbbc38549f53c1466aa658653ce302440124b2093d30
Instruction Fuzzy Hash: 49610672506201AFDB205F24E805BAE7BA5EF51325F14412BE901AB2C1EB7CD9E1879E

Function 0044DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0044DC7B
_wcscat.LIBCMT ref: 0044DC93
_wcscat.LIBCMT ref: 0044DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0044DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0044DCCE
GetFileAttributesW.KERNEL32(?), ref: 0044DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0044DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0044DD12

Strings

*.*, xrefs: 0044DD51

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 1bd80342ea06ef5684baed6dd3280bf39de98fd1c664d0939a319c8f2c0a9c16
Instruction ID: 3a33776f9946c68ebf52cf48a9c4cef77945cdd482a09684afd0a968f16db848
Opcode Fuzzy Hash: 1bd80342ea06ef5684baed6dd3280bf39de98fd1c664d0939a319c8f2c0a9c16
Instruction Fuzzy Hash: 238193B19042419FEB24DF24C88596BB7E8FF88314F15882FF885CB351E678E945CB56

Function 0046C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0046C4EC
GetFocus.USER32 ref: 0046C4FC
GetDlgCtrlID.USER32(00000000), ref: 0046C507
_memset.LIBCMT ref: 0046C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0046C65D
GetMenuItemCount.USER32(?), ref: 0046C67D
GetMenuItemID.USER32(?,00000000), ref: 0046C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0046C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0046C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0046C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0046C779

Strings

0, xrefs: 0046C62A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 4829c730de12301747898697d1c053fda9d253179c0eb6ab14bdd274b960ecd6
Instruction ID: 8cdb7bca6c9ec291ebe1ed82ae85d25e944e7ad24cd1f6b897950d9845689f36
Opcode Fuzzy Hash: 4829c730de12301747898697d1c053fda9d253179c0eb6ab14bdd274b960ecd6
Instruction Fuzzy Hash: FA815C70208311AFD710DF15D984A7BBBE8FB88314F04492EF99697291E774D905CBAB

Function 004383F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0043874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00438766
Part of subcall function 0043874A: GetLastError.KERNEL32(?,0043822A,?,?,?), ref: 00438770
Part of subcall function 0043874A: GetProcessHeap.KERNEL32(00000008,?,?,0043822A,?,?,?), ref: 0043877F
Part of subcall function 0043874A: HeapAlloc.KERNEL32(00000000,?,0043822A,?,?,?), ref: 00438786
Part of subcall function 0043874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0043879D

Part of subcall function 004387E7: GetProcessHeap.KERNEL32(00000008,00438240,00000000,00000000,?,00438240,?), ref: 004387F3
Part of subcall function 004387E7: HeapAlloc.KERNEL32(00000000,?,00438240,?), ref: 004387FA
Part of subcall function 004387E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00438240,?), ref: 0043880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00438458
_memset.LIBCMT ref: 0043846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0043848C
GetLengthSid.ADVAPI32(?), ref: 0043849D
GetAce.ADVAPI32(?,00000000,?), ref: 004384DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 004384F6
GetLengthSid.ADVAPI32(?), ref: 00438513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00438522
HeapAlloc.KERNEL32(00000000), ref: 00438529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0043854A
CopySid.ADVAPI32(00000000), ref: 00438551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00438582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 004385A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 004385BC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: c7ffbdf9ec9354333c833f57856f1bd8b00bfacc25b6892aa064bf4b2dd5d836
Instruction ID: 356207a1ba444198d634325c518580a6935a6ddf4c25d90fe05c8a6ca3110f26
Opcode Fuzzy Hash: c7ffbdf9ec9354333c833f57856f1bd8b00bfacc25b6892aa064bf4b2dd5d836
Instruction Fuzzy Hash: 13614971900209BBDF00DFA5EC45AEEBBB9FF48304F14816EF815A6291EB759A05CF64

Function 0045762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004576A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 004576AE
CreateCompatibleDC.GDI32(?), ref: 004576BA
SelectObject.GDI32(00000000,?), ref: 004576C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0045771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00457757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0045777B
SelectObject.GDI32(00000006,?), ref: 00457783
DeleteObject.GDI32(?), ref: 0045778C
DeleteDC.GDI32(00000006), ref: 00457793
ReleaseDC.USER32(00000000,?), ref: 0045779E

Strings

(, xrefs: 00457723

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a92ca823fcf0e9a8002f075be56f3e39b0bd6f003bab976ca1d1541ad3b07e7b
Instruction ID: 4c3c0414d3a7241de2c7fe01226735206370d0d81e9ca1d2ea4d8a17bc8ed7fb
Opcode Fuzzy Hash: a92ca823fcf0e9a8002f075be56f3e39b0bd6f003bab976ca1d1541ad3b07e7b
Instruction Fuzzy Hash: D6514B75904209EFCB15CFA8EC84EAFBBB9EF48310F14842EF98997211D775A845CB54

Function 003E6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00400B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,003E6C6C,?,00008000), ref: 00400BB7

Part of subcall function 003E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003E48A1,?,?,003E37C0,?), ref: 003E48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 003E6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 003E6E5A

Part of subcall function 003E59CD: _wcscpy.LIBCMT ref: 003E5A05

Part of subcall function 0040387D: _iswctype.LIBCMT ref: 00403885

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 0041E84A
Bad directive syntax error, xrefs: 0041EBC6
EA06, xrefs: 0041E87B
Error opening the file, xrefs: 0041E866, 0041E8E1
AU3!, xrefs: 003E6CC1
>>>AUTOIT SCRIPT<<<, xrefs: 0041E8BF
Unterminated string, xrefs: 0041EC0D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 0ef8925ee70d3650efe94a013f0cd47aa5beb03a0f708600ae7ce4aa1f609d34
Instruction ID: 01dbf4c111aad9fd035e5db8ecc08f021e8fb66aa6fae88e05af70b8561f6f5b
Opcode Fuzzy Hash: 0ef8925ee70d3650efe94a013f0cd47aa5beb03a0f708600ae7ce4aa1f609d34
Instruction Fuzzy Hash: D202B3341083919FC715EF26C881AAFBBE5BF98354F140A2EF486972E1DB34D949CB46

Function 003E45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003E45F9
GetMenuItemCount.USER32(004A6890), ref: 0041D7CD
GetMenuItemCount.USER32(004A6890), ref: 0041D87D
GetCursorPos.USER32(?), ref: 0041D8C1
SetForegroundWindow.USER32(00000000), ref: 0041D8CA
TrackPopupMenuEx.USER32(004A6890,00000000,?,00000000,00000000,00000000), ref: 0041D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0041D8E9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 25df35f69fdf6f532853356b5a82e8be0b2d66519ff7218ec125c695712e8edb
Instruction ID: 446eec3f8c8d069e1fbfd7ab59e1dfe51dc143fb25b9fc4bbaf09ed7b6a74c07
Opcode Fuzzy Hash: 25df35f69fdf6f532853356b5a82e8be0b2d66519ff7218ec125c695712e8edb
Instruction Fuzzy Hash: 6A7147B0A00215BAFB219F15DC45FEABF64FF05328F200227F524662D1D7B95C50DB99

Function 00458BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00458BEC
CoInitialize.OLE32(00000000), ref: 00458C19
CoUninitialize.OLE32 ref: 00458C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00458D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00458E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00472C0C), ref: 00458E84
CoGetObject.OLE32(?,00000000,00472C0C,?), ref: 00458EA7
SetErrorMode.KERNEL32(00000000), ref: 00458EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00458F3A
VariantClear.OLEAUT32(?), ref: 00458F4A

Strings

,,G, xrefs: 00458BD6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,G
API String ID: 2395222682-530569483
Opcode ID: bb732dcc28e60346a2536c17fcbb423d3dcce5c8c3a503a290254ec954b5fdd9
Instruction ID: 39c936a4358757c54e3552e49710e491e91d9ad248582b1d95824fa285fc5890
Opcode Fuzzy Hash: bb732dcc28e60346a2536c17fcbb423d3dcce5c8c3a503a290254ec954b5fdd9
Instruction Fuzzy Hash: 92C12671204305AFC700DF65C88492BB7E9BF88349F10496EF98ADB251DB75ED09CB56

Function 004610A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00460038,?,?), ref: 004610BC

Strings

HKEY_CURRENT_USER, xrefs: 0046119B
HKEY_CURRENT_CONFIG, xrefs: 00461179
HKEY_CLASSES_ROOT, xrefs: 0046114F
HKEY_USERS, xrefs: 004611BD
HKU, xrefs: 004611CE
HKLM, xrefs: 0046113A
HKCU, xrefs: 004611AC
HKCR, xrefs: 00461164
HKCC, xrefs: 0046118A
HKEY_LOCAL_MACHINE, xrefs: 00461125

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: afcbb3a9d2cd453ce1759383fb1357073a9eb843fdaa74bc0baf3075048d8d50
Instruction ID: 54768bccd869f8ab4e8a123477a7dcbd2b90d455b184ed088e4c242a6d55d999
Opcode Fuzzy Hash: afcbb3a9d2cd453ce1759383fb1357073a9eb843fdaa74bc0baf3075048d8d50
Instruction Fuzzy Hash: CF41753010424E8BDF10EF91ED916EB3724EF25344F14456BFD916B2A1EB38991AC7A9

Function 00445569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Part of subcall function 003E7A84: _memmove.LIBCMT ref: 003E7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 004455D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 004455E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004455F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0044560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0044561C

Strings

play PlayMe wait, xrefs: 00445606
alias PlayMe, xrefs: 004455AB
open , xrefs: 00445581
status PlayMe mode, xrefs: 004455CD
play PlayMe, xrefs: 00445617
close PlayMe, xrefs: 004455E3, 00445610

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 79ebe1bee00f024275373210a9d7aadb6cb5e54b5d2010e389ca40d67b617caa
Instruction ID: 8fb35a43d3dc46eda64350d34eebef4e5b6721874c68919f75d16f0027dd963d
Opcode Fuzzy Hash: 79ebe1bee00f024275373210a9d7aadb6cb5e54b5d2010e389ca40d67b617caa
Instruction Fuzzy Hash: 2811B2205501A97AEB21B662CC4AEFF7F7CEF91B00F50053AB805A60D2EEA40D05C5E6

Function 004448F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0044490E
gethostname.WSOCK32(?,00000100), ref: 00444928
gethostbyname.WSOCK32(?), ref: 00444935
_wcscpy.LIBCMT ref: 0044495D
_memmove.LIBCMT ref: 00444970
inet_ntoa.WSOCK32(?), ref: 0044497B
_strcat.LIBCMT ref: 00444989
_wcscpy.LIBCMT ref: 004449A0
WSACleanup.WSOCK32 ref: 004449AE
_wcscpy.LIBCMT ref: 004449BC

Strings

0.0.0.0, xrefs: 00444957

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: d0776948713da2262be5ea8dba550d10c31d5df9cc3acd85e2ef08cc949bf488
Instruction ID: d446ef3ce8bfbcda06f3b4b00573e9d656852d34f8fdf4dfbee7235d5ced133e
Opcode Fuzzy Hash: d0776948713da2262be5ea8dba550d10c31d5df9cc3acd85e2ef08cc949bf488
Instruction Fuzzy Hash: 5D110871904115ABDB20EB30AC0AFDB77ACAF40714F0001BBF484A21D1FFB89985A65A

Function 00445217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0044521C

Part of subcall function 00400719: timeGetTime.WINMM(?,75C0B400,003F0FF9), ref: 0040071D

Sleep.KERNEL32(0000000A), ref: 00445248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0044526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0044528E
SetActiveWindow.USER32 ref: 004452AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 004452BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 004452DA
Sleep.KERNEL32(000000FA), ref: 004452E5
IsWindow.USER32 ref: 004452F1
EndDialog.USER32(00000000), ref: 00445302

Strings

BUTTON, xrefs: 00445280

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 4c4ea1e6cb0c4e56e4727ea7533ea50ff61f98642402389e8dec9c5439e040d1
Instruction ID: 63131f0752e766f8a52ff6b82a90779095ce5f4ec69c5fcfe282a4969de7e65a
Opcode Fuzzy Hash: 4c4ea1e6cb0c4e56e4727ea7533ea50ff61f98642402389e8dec9c5439e040d1
Instruction Fuzzy Hash: 82219270105704BFFB116F60FD89B263F69FB5678AF14147AF401812B2EBA99C058A6E

Function 0044D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

CoInitialize.OLE32(00000000), ref: 0044D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0044D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0044D8FC
CoCreateInstance.OLE32(00472D7C,00000000,00000001,0049A89C,?), ref: 0044D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0044D9B7
CoTaskMemFree.OLE32(?,?), ref: 0044DA0F
_memset.LIBCMT ref: 0044DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0044DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0044DAAB
CoTaskMemFree.OLE32(00000000), ref: 0044DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0044DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0044DAEB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: fc9563b874dca7ad7dd17cb2804b41aaf12b399968595a5c0b7b6959367a6cb0
Instruction ID: 9a9a3dc2c1a7d940f9cce6d317bd27ff97f24a48b17857ec1d9242cae88b9138
Opcode Fuzzy Hash: fc9563b874dca7ad7dd17cb2804b41aaf12b399968595a5c0b7b6959367a6cb0
Instruction Fuzzy Hash: 79B11C75A00119AFDB04DFA5C888EAEBBB9FF48304B1484AAF805EB351DB34ED45CB55

Function 0044052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 004405A7
SetKeyboardState.USER32(?), ref: 00440612
GetAsyncKeyState.USER32(000000A0), ref: 00440632
GetKeyState.USER32(000000A0), ref: 00440649
GetAsyncKeyState.USER32(000000A1), ref: 00440678
GetKeyState.USER32(000000A1), ref: 00440689
GetAsyncKeyState.USER32(00000011), ref: 004406B5
GetKeyState.USER32(00000011), ref: 004406C3
GetAsyncKeyState.USER32(00000012), ref: 004406EC
GetKeyState.USER32(00000012), ref: 004406FA
GetAsyncKeyState.USER32(0000005B), ref: 00440723
GetKeyState.USER32(0000005B), ref: 00440731

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: a4f195d47d061a9a0db9d1350778ad7f4230e182d22ed9bfa9412b8a2562fbc3
Instruction ID: 023668ac7d7d2d3dcf4601822ce84541b2d40036a8599ecffc90e0a54321a288
Opcode Fuzzy Hash: a4f195d47d061a9a0db9d1350778ad7f4230e182d22ed9bfa9412b8a2562fbc3
Instruction Fuzzy Hash: 7951DA20A0478429FB35EBA084557EBBFB49F01380F08459FD6C2572C2DA7C9A9CCF5A

Function 0043C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0043C746
GetWindowRect.USER32(00000000,?), ref: 0043C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0043C7B6
GetDlgItem.USER32(?,00000002), ref: 0043C7C1
GetWindowRect.USER32(00000000,?), ref: 0043C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0043C827
GetDlgItem.USER32(?,000003E9), ref: 0043C835
GetWindowRect.USER32(00000000,?), ref: 0043C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0043C889
GetDlgItem.USER32(?,000003EA), ref: 0043C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0043C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0043C8C1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: bfb8bda7eb1ab3297fb463da6523d61bfe8fbe74476f672191fa985d9d914ef9
Instruction ID: c9a8387495dfbb692d4dab4b58f1430784756a3a3d49bbdde294a41d8158f548
Opcode Fuzzy Hash: bfb8bda7eb1ab3297fb463da6523d61bfe8fbe74476f672191fa985d9d914ef9
Instruction Fuzzy Hash: C6513271B00205AFDB18CFA9DD85AAEBBB6FB88311F14813DF515E7290E7B09D048B54

Function 003E201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 003E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,003E2036,?,00000000,?,?,?,?,003E16CB,00000000,?), ref: 003E1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 003E20D3
KillTimer.USER32(-00000001,?,?,?,?,003E16CB,00000000,?,?,003E1AE2,?,?), ref: 003E216E
DestroyAcceleratorTable.USER32(00000000), ref: 0041BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003E16CB,00000000,?,?,003E1AE2,?,?), ref: 0041BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003E16CB,00000000,?,?,003E1AE2,?,?), ref: 0041BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,003E16CB,00000000,?,?,003E1AE2,?,?), ref: 0041BF5A
DeleteObject.GDI32(00000000), ref: 0041BF6C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: d15da3eb49983df0c853d51197908de9493c82fedcaad2f15faa2bf2c6d9601b
Instruction ID: 807d756b048dfc0b0c365ddd47f1d29c8df6a29a7639036efd2045837983d2fe
Opcode Fuzzy Hash: d15da3eb49983df0c853d51197908de9493c82fedcaad2f15faa2bf2c6d9601b
Instruction Fuzzy Hash: C061BE31101660DFCB26AF16DD48B267BF9FB41312F15863DE08286AE0C779AC85DF89

Function 003E21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 003E25DB: GetWindowLongW.USER32(?,000000EB), ref: 003E25EC

GetSysColor.USER32(0000000F), ref: 003E21D3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: eba0dfaf685b68d2cbee65610cf4b202aaebaa6130658e7781804a404e865af0
Instruction ID: 54908896908599dc5248aa767a907367aa9fa70c7b505b1e2fe17762c7c98322
Opcode Fuzzy Hash: eba0dfaf685b68d2cbee65610cf4b202aaebaa6130658e7781804a404e865af0
Instruction Fuzzy Hash: BE41F831000194AFDB125F29EC88BBA3769EB06331F154775FEA58A1E2D7718C42CB25

Function 0044AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0046F910), ref: 0044AB76
GetDriveTypeW.KERNEL32(00000061,0049A620,00000061), ref: 0044AC40
_wcscpy.LIBCMT ref: 0044AC6A

Strings

removable, xrefs: 0044ABA8
all, xrefs: 0044AB7C
ramdisk, xrefs: 0044ABEA
cdrom, xrefs: 0044AB92
fixed, xrefs: 0044ABBE
network, xrefs: 0044ABD4
unknown, xrefs: 0044AC01

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 747ede8d8054438676007409e52de1cf04476f2ec71b97ab8256c2c5067ed236
Instruction ID: 3fa4a1bd4dcf6c7f76d43da51c7ba148fce1483bc6c86eee6602fd364e72bdd9
Opcode Fuzzy Hash: 747ede8d8054438676007409e52de1cf04476f2ec71b97ab8256c2c5067ed236
Instruction Fuzzy Hash: 3951DE701483419BD710EF15C881AABB7A5EF84304F10892FF5869B2E2DB39ED1ACB57

Function 0046C27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

Part of subcall function 003E2344: GetCursorPos.USER32(?), ref: 003E2357
Part of subcall function 003E2344: ScreenToClient.USER32(004A67B0,?), ref: 003E2374
Part of subcall function 003E2344: GetAsyncKeyState.USER32(00000001), ref: 003E2399
Part of subcall function 003E2344: GetAsyncKeyState.USER32(00000002), ref: 003E23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0046C2E4
ImageList_EndDrag.COMCTL32 ref: 0046C2EA
ReleaseCapture.USER32 ref: 0046C2F0
SetWindowTextW.USER32(?,00000000), ref: 0046C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0046C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0046C48F

Strings

prJ, xrefs: 0046C3FD
@GUI_DROPID, xrefs: 0046C3E1
@GUI_DRAGFILE, xrefs: 0046C424
prJ, xrefs: 0046C438

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$prJ$prJ
API String ID: 1924731296-1242193049
Opcode ID: e499657bba86d127a37dfcd02a58f5d0537181edecfb56ae73275579f3c226c1
Instruction ID: e721a585a36453b4915f182f2ef9e5ef1a86812e3ba3219e575260c439250927
Opcode Fuzzy Hash: e499657bba86d127a37dfcd02a58f5d0537181edecfb56ae73275579f3c226c1
Instruction Fuzzy Hash: A351A074204304AFD700EF24CC95F6A7BE5FB88314F048A2EF5959B2E1EB749958CB56

Function 003E9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 003E99C2
__swprintf.LIBCMT ref: 003E9A0C
__i64tow.LIBCMT ref: 0041FA0F

Strings

True, xrefs: 0041F9D0
0x%p, xrefs: 0041F9F1
False, xrefs: 0041F9D7
%.15g, xrefs: 003E9A06

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 6892b3c6f5f5d7aa0155b4113cabdcff50008745bc210e3bfc0fbce914196afa
Instruction ID: 9621822d186a31d0a296afbdddc8316c6c1388fa41f920ff83fc1572758e32e5
Opcode Fuzzy Hash: 6892b3c6f5f5d7aa0155b4113cabdcff50008745bc210e3bfc0fbce914196afa
Instruction Fuzzy Hash: 94412271604215AADB24AF3AC842F7A77E8EF04304F20457FF549D62C2EA7998429B15

Function 004673C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004673D9
CreateMenu.USER32 ref: 004673F4
SetMenu.USER32(?,00000000), ref: 00467403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00467490
IsMenu.USER32(?), ref: 004674A6
CreatePopupMenu.USER32 ref: 004674B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004674DD
DrawMenuBar.USER32 ref: 004674E5

Strings

F, xrefs: 004674D1
0, xrefs: 004673CF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 46f906974edf1b71a519f403f021105e4a69bfa0b56402dd11d43b2e445c3671
Instruction ID: 20fff8711b5c81c5326626065cbc33c203b5bcc796c7ccb225a93cd9628baad0
Opcode Fuzzy Hash: 46f906974edf1b71a519f403f021105e4a69bfa0b56402dd11d43b2e445c3671
Instruction Fuzzy Hash: 03418A74A01205EFDB10DF64E848E9ABBB9FF49304F14402AF95697360EB38AD14CF59

Function 0046772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 004677CD
CreateCompatibleDC.GDI32(00000000), ref: 004677D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004677E7
SelectObject.GDI32(00000000,00000000), ref: 004677EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 004677FA
DeleteDC.GDI32(00000000), ref: 00467803
GetWindowLongW.USER32(?,000000EC), ref: 0046780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00467821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0046782D

Strings

static, xrefs: 00467765

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 97d234c03934b9197de649d2beac0641c6b84592d83a2ceee13db794df3e424c
Instruction ID: 1e2aeeb338d23dccd983c60b2d5d41ee0f1f307eb06120dd1f68304d5b83c322
Opcode Fuzzy Hash: 97d234c03934b9197de649d2beac0641c6b84592d83a2ceee13db794df3e424c
Instruction Fuzzy Hash: E931AC32104214ABDF119FA4EC08FDB3B69FF09325F100225FA55A61A0E775E815DBAA

Function 00407040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040707B

Part of subcall function 00408D68: __getptd_noexit.LIBCMT ref: 00408D68

__gmtime64_s.LIBCMT ref: 00407114
__gmtime64_s.LIBCMT ref: 0040714A
__gmtime64_s.LIBCMT ref: 00407167
__allrem.LIBCMT ref: 004071BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004071D9
__allrem.LIBCMT ref: 004071F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040720E
__allrem.LIBCMT ref: 00407225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407243
__invoke_watson.LIBCMT ref: 004072B4

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: f36057ec696cce1bfdbf2cfa14024521b0d5fd49c04020ea92d021e27389d63d
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: B171A271E04716ABE7149E79CC81B9AB3A8AF50324F14423FF514FA3C1E778E950879A

Function 00442A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00442A31
GetMenuItemInfoW.USER32(004A6890,000000FF,00000000,00000030), ref: 00442A92
SetMenuItemInfoW.USER32(004A6890,00000004,00000000,00000030), ref: 00442AC8
Sleep.KERNEL32(000001F4), ref: 00442ADA
GetMenuItemCount.USER32(?), ref: 00442B1E
GetMenuItemID.USER32(?,00000000), ref: 00442B3A
GetMenuItemID.USER32(?,-00000001), ref: 00442B64
GetMenuItemID.USER32(?,?), ref: 00442BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00442BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00442C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00442C24

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: c1eca009b490d64247c9b037c91913f996cf07f25f7b59475466ab33675964b9
Instruction ID: 1b0595d03cdbca16385c60ff0d2e9c809e565df6ecd52e2ea960405aaa028dce
Opcode Fuzzy Hash: c1eca009b490d64247c9b037c91913f996cf07f25f7b59475466ab33675964b9
Instruction Fuzzy Hash: 3F61C6B0900249AFEB21CF54DE84EBF7BB8FB41304F54056AF841A7251E7B9AD05DB29

Function 00467192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00467214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00467217
GetWindowLongW.USER32(?,000000F0), ref: 0046723B
_memset.LIBCMT ref: 0046724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0046725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004672D6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 4758ce076b4d08beffd87a9a607304ac241cac189e3a0d1e0ad7e4b155299fcf
Instruction ID: dd6bc9aec331d35ba0fdfb4f7b83dd4ceadbf1311f3ce166e7114fdf5e86914e
Opcode Fuzzy Hash: 4758ce076b4d08beffd87a9a607304ac241cac189e3a0d1e0ad7e4b155299fcf
Instruction Fuzzy Hash: 08617B75900208AFDB10DFA4CC81EEE77F8EB09704F14016AFA15A73A1E778AD45DB69

Function 0043710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00437135
SafeArrayAllocData.OLEAUT32(?), ref: 0043718E
VariantInit.OLEAUT32(?), ref: 004371A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 004371C0
VariantCopy.OLEAUT32(?,?), ref: 00437213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00437227
VariantClear.OLEAUT32(?), ref: 0043723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00437249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00437252
VariantClear.OLEAUT32(?), ref: 00437264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0043726F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 0efc8a7707eb5a79bbef78baba63820908df99a3713cf36c3507b988a0cebe02
Instruction ID: eae0cceb250a4365b94b7afe2cb0b53e329aeec501f488284f1482241ff02f4f
Opcode Fuzzy Hash: 0efc8a7707eb5a79bbef78baba63820908df99a3713cf36c3507b988a0cebe02
Instruction Fuzzy Hash: FB418F71A00219AFCF10DFA5D8449AEBBB8FF18344F00807AF995A7361DB74A949CF95

Function 004586D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

CoInitialize.OLE32 ref: 00458718
CoUninitialize.OLE32 ref: 00458723
CoCreateInstance.OLE32(?,00000000,00000017,00472BEC,?), ref: 00458783
IIDFromString.OLE32(?,?), ref: 004587F6
VariantInit.OLEAUT32(?), ref: 00458890
VariantClear.OLEAUT32(?), ref: 004588F1

Strings

Failed to create object, xrefs: 0045878E, 00458844
Invalid parameter, xrefs: 0045880F
NULL Pointer assignment, xrefs: 004587C8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: bc39da275862ec84721e6628ae1fcb786376cdf3ae2df5c1e99a4df1268117ff
Instruction ID: 3ab1a1636d943b0b57e10c7256a7a4a39a729f7addce5e043520794afbd408e2
Opcode Fuzzy Hash: bc39da275862ec84721e6628ae1fcb786376cdf3ae2df5c1e99a4df1268117ff
Instruction Fuzzy Hash: 33618D70604311ABD710EF25C844B5ABBE4AF48715F10081EF885AB292DF78ED49CB9A

Function 00455A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00455AA6
inet_addr.WSOCK32(?), ref: 00455AEB
gethostbyname.WSOCK32(?), ref: 00455AF7
IcmpCreateFile.IPHLPAPI ref: 00455B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00455B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00455B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00455C00
WSACleanup.WSOCK32 ref: 00455C06

Strings

Ping, xrefs: 00455B29

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 6f7a8b1e2eb6464e7f009360e7dc3637e31bbfff27bf9ffd2f681ea871bac981
Instruction ID: 0d01fc31e8613ba04194b556ce8b29af59c589ae6bcc9c92f518f9ef81df6a73
Opcode Fuzzy Hash: 6f7a8b1e2eb6464e7f009360e7dc3637e31bbfff27bf9ffd2f681ea871bac981
Instruction Fuzzy Hash: 5851AF712047019FDB11AF25DC59B2AB7E4EF48311F14892AF995DB2E2DB74EC08CB4A

Function 0044B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0044B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0044B7B1
GetLastError.KERNEL32 ref: 0044B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0044B828

Strings

READONLY, xrefs: 0044B7F3
INVALID, xrefs: 0044B7FA
UNKNOWN, xrefs: 0044B7E0
READY, xrefs: 0044B801
NOTREADY, xrefs: 0044B7E7

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3a4b24d7fb60eb02514bc8bf34075cc58e257609ca378f37b86b61855811c8ce
Instruction ID: 806d6e8d913a806987522d3cfc92f37683c38a1652fc6329b41431c4762e9686
Opcode Fuzzy Hash: 3a4b24d7fb60eb02514bc8bf34075cc58e257609ca378f37b86b61855811c8ce
Instruction Fuzzy Hash: 6E318335A002059FEB01EF64DC85AAEBBB4EF44740F10412BE4019B291DB79D946C795

Function 00439471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 004394F6
GetDlgCtrlID.USER32 ref: 00439501
GetParent.USER32 ref: 0043951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00439520
GetDlgCtrlID.USER32(?), ref: 00439529
GetParent.USER32(?), ref: 00439545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00439548

Strings

ComboBox, xrefs: 0043947E
ListBox, xrefs: 004394B3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: f1ef1e69d84739045e13d8106bdf3545c47984df17550bf9eacc0dd69a3f1091
Instruction ID: 41eb9cdcb960b5575cf3adc4ae00504aa8144423f343c6a4add6bd0e1bd4e936
Opcode Fuzzy Hash: f1ef1e69d84739045e13d8106bdf3545c47984df17550bf9eacc0dd69a3f1091
Instruction Fuzzy Hash: AE21D671904104BBCF05AB65CC85EFEBB78EF49310F10012AF562972E1EBB9591ADB25

Function 0043955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004395DF
GetDlgCtrlID.USER32 ref: 004395EA
GetParent.USER32 ref: 00439606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00439609
GetDlgCtrlID.USER32(?), ref: 00439612
GetParent.USER32(?), ref: 0043962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00439631

Strings

ComboBox, xrefs: 00439569
ListBox, xrefs: 0043959E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 2ea27092b765540f8713172f68ff102a907a6c377c692b53bb1e4fb85fbe5deb
Instruction ID: fcf1fbe818ca7c314fbf1ded3fb576bffba548814fbd4779d4e4ac8cfc3b6f48
Opcode Fuzzy Hash: 2ea27092b765540f8713172f68ff102a907a6c377c692b53bb1e4fb85fbe5deb
Instruction Fuzzy Hash: 40210A71901104BBDF05AB61CCC5EFEBB78EF48300F10012AF561972E1EBB9591ADB25

Function 00439645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00439651
GetClassNameW.USER32(00000000,?,00000100), ref: 00439666
_wcscmp.LIBCMT ref: 00439678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 004396F3

Strings

SHELLDLL_DefView, xrefs: 00439672
smallicons, xrefs: 004396BB
largeicons, xrefs: 00439687
list, xrefs: 004396D5
details, xrefs: 004396A1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 4eb04cbbc19b9c1b8336ce05ec7142749dfd985bf339b4e66b52ab9b55d93023
Instruction ID: a92fc1959b503063abcdb9fc1321e1729fc35b55b1562781f55ce4a1ebe0ad47
Opcode Fuzzy Hash: 4eb04cbbc19b9c1b8336ce05ec7142749dfd985bf339b4e66b52ab9b55d93023
Instruction Fuzzy Hash: 9D110677249307BAFA012A25EC07EA77B9C8B08375F20003BF900A50E2FEEA6D11495D

Function 00444189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0044419D
__swprintf.LIBCMT ref: 004441AA

Part of subcall function 004038D8: __woutput_l.LIBCMT ref: 00403931

FindResourceW.KERNEL32(?,?,0000000E), ref: 004441D4
LoadResource.KERNEL32(?,00000000), ref: 004441E0
LockResource.KERNEL32(00000000), ref: 004441ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0044420D
LoadResource.KERNEL32(?,00000000), ref: 0044421F
SizeofResource.KERNEL32(?,00000000), ref: 0044422E
LockResource.KERNEL32(?), ref: 0044423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0044429B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: db01a7252151fe272d43755717e5ccae4f0f1b4b209745aab271f80443762e6e
Instruction ID: 1c9ebc1b3703d157ffc8474a15ce70324e359b82fdfc657ca5432e89e91caebf
Opcode Fuzzy Hash: db01a7252151fe272d43755717e5ccae4f0f1b4b209745aab271f80443762e6e
Instruction Fuzzy Hash: BA31C072A0521ABFEB109F60EC58EBB7BACFF45341F004576F801E2150E7B8D9118BA9

Function 004416DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00441700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00440778,?,00000001), ref: 00441714
GetWindowThreadProcessId.USER32(00000000), ref: 0044171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00440778,?,00000001), ref: 0044172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0044173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00440778,?,00000001), ref: 00441755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00440778,?,00000001), ref: 00441767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00440778,?,00000001), ref: 004417AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00440778,?,00000001), ref: 004417C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00440778,?,00000001), ref: 004417CC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 812dfc410c2b65997914bcc0e58fd48e0f5af2658151c6a0939a3f4d759a68eb
Instruction ID: aa65fa2aa2c20cc2e23ed4998cb88528ac9d17a8b205b3caa872dcf53ce06455
Opcode Fuzzy Hash: 812dfc410c2b65997914bcc0e58fd48e0f5af2658151c6a0939a3f4d759a68eb
Instruction Fuzzy Hash: 64318175704204BFFB219F14ED84B6A7BA9AB56711F104036F904C63B0F7B89E858B5A

Function 00459428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045947C
VariantInit.OLEAUT32(?), ref: 0045954D
VariantInit.OLEAUT32(?), ref: 0045964E
VariantClear.OLEAUT32(?), ref: 00459658
VariantClear.OLEAUT32(?), ref: 004596B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00459631
,,G, xrefs: 004594FA
Null Object assignment in FOR..IN loop, xrefs: 004594DD, 0045960B, 004596C3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,G$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-2626013772
Opcode ID: 7e9d68d75e43bd37ab428cf23d846b60a1f590ecc4ab6c4af95d2f399eb30b33
Instruction ID: 27384522af5229d490da1c1824d018b09cd89f46915c25032063051b37562100
Opcode Fuzzy Hash: 7e9d68d75e43bd37ab428cf23d846b60a1f590ecc4ab6c4af95d2f399eb30b33
Instruction Fuzzy Hash: 1591B271900219EBDF20DF61C844FAFB7B8EF45315F10815AF905AB281D7789D09CBA9

Function 0043A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0043AA64), ref: 0043A9A2

Strings

NAME, xrefs: 0043A7D4
CLASS, xrefs: 0043A721
CLASSNN, xrefs: 0043A744
REGEXPCLASS, xrefs: 0043A767
INSTANCE, xrefs: 0043A8B0
TEXT, xrefs: 0043A8D9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: f13f0cf4382cbae241b073d7d50d62409adf94661102f55f87b4753106c84cb7
Instruction ID: 6b72c786a4ca5e2396138babf22fc833ec61c57149a3c8f5d7b954085cd5baf0
Opcode Fuzzy Hash: f13f0cf4382cbae241b073d7d50d62409adf94661102f55f87b4753106c84cb7
Instruction Fuzzy Hash: 549195709402069ADB08DF61C481BEAFB74BF18304F10952BD8D9B7291DB38696ACBA5

Function 003E2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 003E2EAE

Part of subcall function 003E1DB3: GetClientRect.USER32(?,?), ref: 003E1DDC
Part of subcall function 003E1DB3: GetWindowRect.USER32(?,?), ref: 003E1E1D
Part of subcall function 003E1DB3: ScreenToClient.USER32(?,?), ref: 003E1E45

GetDC.USER32 ref: 0041CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0041CF95
SelectObject.GDI32(00000000,00000000), ref: 0041CFA3
SelectObject.GDI32(00000000,00000000), ref: 0041CFB8
ReleaseDC.USER32(?,00000000), ref: 0041CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0041D04B

Strings

U, xrefs: 0041CF20

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 2b3b26047a47785bfbc2369e79f706fb68cfd1a7306e80aaa99fe36f82661f52
Instruction ID: e6d29964a7afe510304e5cac1896826c869171ea800357eb7b43b38fe62f874f
Opcode Fuzzy Hash: 2b3b26047a47785bfbc2369e79f706fb68cfd1a7306e80aaa99fe36f82661f52
Instruction Fuzzy Hash: B771EF70800245EFCF21CF64CC84AEB3BBAFF49354F14426AED559A2A6D7358C82DB65

Function 00458F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0046F910), ref: 0045903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0046F910), ref: 00459071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 004591EB
SysFreeString.OLEAUT32(?), ref: 00459215

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 6f3566f3dc829c66898d05a8465a6f3e3a684899d2dcfde1a7187626d1067d69
Instruction ID: 751be4755c081a9434bf51eee8e8c56612e14db2b60bec5599f73bb6036ee7f4
Opcode Fuzzy Hash: 6f3566f3dc829c66898d05a8465a6f3e3a684899d2dcfde1a7187626d1067d69
Instruction Fuzzy Hash: 1CF17F31A00119EFDF04DF94C888EAEB7B9FF49315F10845AF906AB291DB35AD4ACB54

Function 0045F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0045FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0045FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0045FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0045FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0045FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0045FD90
CloseHandle.KERNEL32(?), ref: 0045FDBF
CloseHandle.KERNEL32(?), ref: 0045FE36

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 97f0e99662935154f4ea7a9b5dd0e860cd8a40f0cd56588c13e25e9aee2253b2
Instruction ID: c60cc7a7ccc8880ad4df32765bd92ad03edc17b180cfe2aebd9029caee7cbf85
Opcode Fuzzy Hash: 97f0e99662935154f4ea7a9b5dd0e860cd8a40f0cd56588c13e25e9aee2253b2
Instruction Fuzzy Hash: 5AE1AF312042419FC715EF25C881B6BBBE4AF84314F14856EF89A9B3A2DB35EC49CB57

Function 00444F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004448AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004438D3,?), ref: 004448C7

Part of subcall function 004448AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004438D3,?), ref: 004448E0

Part of subcall function 00444CD3: GetFileAttributesW.KERNEL32(?,00443947), ref: 00444CD4

lstrcmpiW.KERNEL32(?,?), ref: 00444FE2
_wcscmp.LIBCMT ref: 00444FFC
MoveFileW.KERNEL32(?,?), ref: 00445017

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 2e60c144910a5806352818e10f0552f7abf8135742c367ab4c65f5be72d31804
Instruction ID: bc68641b8cefae79cfc77964ebc9c0687354083f2b0b2dde15f1853d9c2ccd4f
Opcode Fuzzy Hash: 2e60c144910a5806352818e10f0552f7abf8135742c367ab4c65f5be72d31804
Instruction Fuzzy Hash: 825186B24087855BD721DB50D8819DFB3ECAF84344F10492FF589D7192EF78A58C876A

Function 004688B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0046896E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 1f4f6f20a1eacd01711e0dcfa96dff3c413a59240b0791216659639167eac975
Instruction ID: bc2fb705588d839239c5cebd204893b562f4eea879ddb061fd7280728ffd318b
Opcode Fuzzy Hash: 1f4f6f20a1eacd01711e0dcfa96dff3c413a59240b0791216659639167eac975
Instruction Fuzzy Hash: 1351B630500204BBDF209F65CC85B6A3B65BB05314F50472BFA11E62E1EFB9A9848B4B

Function 003E2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0041C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0041C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0041C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0041C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0041C5C0
DestroyIcon.USER32(00000000), ref: 0041C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0041C5EC
DestroyIcon.USER32(?), ref: 0041C5FB

Part of subcall function 0046A71E: DeleteObject.GDI32(00000000), ref: 0046A757

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 87bf3a48546fe1252087a5646aa65b5dcdeaf85e8e177f860ab17a1f303a6678
Instruction ID: a4e604943dfc14cfe6ea32137fd83d331638be2ee66430e8250668ace0243a27
Opcode Fuzzy Hash: 87bf3a48546fe1252087a5646aa65b5dcdeaf85e8e177f860ab17a1f303a6678
Instruction Fuzzy Hash: F451BC30640259AFDB21DF25DC85FAB3BB9EB54310F100629F842976E0DBB4ED80DB54

Function 00439B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0043AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043AE77
Part of subcall function 0043AE57: GetCurrentThreadId.KERNEL32 ref: 0043AE7E
Part of subcall function 0043AE57: AttachThreadInput.USER32(00000000,?,00439B65,?,00000001), ref: 0043AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00439B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00439B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00439B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00439B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00439BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00439BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00439BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00439BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00439BDD

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 3c1b0a38edd741418c5504873cbc9c9bdaac2ff5b855da66c9e878f803abcedc
Instruction ID: cee9b6acada43ddc862720a355e20938952d8c45d14a08b629fce5d6c11c4760
Opcode Fuzzy Hash: 3c1b0a38edd741418c5504873cbc9c9bdaac2ff5b855da66c9e878f803abcedc
Instruction Fuzzy Hash: B9112571540608BEF6102F20EC4AFAA7B1CEB0D795F101429F284AB0A0C9F26C10DAA9

Function 00438E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00438A84,00000B00,?,?), ref: 00438E0C
HeapAlloc.KERNEL32(00000000,?,00438A84,00000B00,?,?), ref: 00438E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00438A84,00000B00,?,?), ref: 00438E28
GetCurrentProcess.KERNEL32(?,00000000,?,00438A84,00000B00,?,?), ref: 00438E30
DuplicateHandle.KERNEL32(00000000,?,00438A84,00000B00,?,?), ref: 00438E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00438A84,00000B00,?,?), ref: 00438E43
GetCurrentProcess.KERNEL32(00438A84,00000000,?,00438A84,00000B00,?,?), ref: 00438E4B
DuplicateHandle.KERNEL32(00000000,?,00438A84,00000B00,?,?), ref: 00438E4E
CreateThread.KERNEL32(00000000,00000000,00438E74,00000000,00000000,00000000), ref: 00438E68

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 58a3c6a21a888f3f411bcc2d2eb3a2944e3990b071d5138f0e8822dff5aaf1ae
Instruction ID: ec318c05617ca0bd120bd0a04f55f8e705944a881b1ea23ee768b4ee9eb8e56a
Opcode Fuzzy Hash: 58a3c6a21a888f3f411bcc2d2eb3a2944e3990b071d5138f0e8822dff5aaf1ae
Instruction Fuzzy Hash: E201BBB5240308FFE710ABA5EC4DFAB7BACEB89751F004421FA45DB1A1DAB59C04CB25

Function 00459A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00437652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?,?,0043799D), ref: 0043766F
Part of subcall function 00437652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?), ref: 0043768A
Part of subcall function 00437652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?), ref: 00437698
Part of subcall function 00437652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?), ref: 004376A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00459B1B
_memset.LIBCMT ref: 00459B28
_memset.LIBCMT ref: 00459C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00459C97
CoTaskMemFree.OLE32(?), ref: 00459CA2

Strings

NULL Pointer assignment, xrefs: 00459CF0

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: f0861930b2928c070f845018546bb96b38383e6377df316a31d1ed0c999ab78a
Instruction ID: 9459b53394100bb76599d9e36c75838033429e6e8495e91995d64e439486d078
Opcode Fuzzy Hash: f0861930b2928c070f845018546bb96b38383e6377df316a31d1ed0c999ab78a
Instruction Fuzzy Hash: 85913C71D00229EBDF11DFA5DC84ADEBBB8EF08310F10416AF519A7281DB755A49CFA4

Function 00466FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00467093
SendMessageW.USER32(?,00001036,00000000,?), ref: 004670A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004670C1
_wcscat.LIBCMT ref: 0046711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00467133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00467161

Strings

SysListView32, xrefs: 00467065

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: f2542c5f4d21821d580915f20228be43d0c89a78a6f5cb96155ce77bd7575d9d
Instruction ID: a8d9d1548b97e38550e36bba20f279e833e2a7f5e20973e3c72e6d2545049130
Opcode Fuzzy Hash: f2542c5f4d21821d580915f20228be43d0c89a78a6f5cb96155ce77bd7575d9d
Instruction Fuzzy Hash: 2341B470904308AFDB21DF64CC85BEF77A8EF08354F10052BF594E7292E6799D858B69

Function 0045EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00443E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00443EB6
Part of subcall function 00443E91: Process32FirstW.KERNEL32(00000000,?), ref: 00443EC4
Part of subcall function 00443E91: CloseHandle.KERNEL32(00000000), ref: 00443F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0045ECB8
GetLastError.KERNEL32 ref: 0045ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0045ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0045ED77
GetLastError.KERNEL32(00000000), ref: 0045ED82
CloseHandle.KERNEL32(00000000), ref: 0045EDB7

Strings

SeDebugPrivilege, xrefs: 0045ECD6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 6cea15e565eb60c9cde2822dc7ed08b2c7f9531a40711ac510f5267782012814
Instruction ID: bb302f5036470b6070de50c80cebee37a29cb2ac175e57b6b56935dd00a67b15
Opcode Fuzzy Hash: 6cea15e565eb60c9cde2822dc7ed08b2c7f9531a40711ac510f5267782012814
Instruction Fuzzy Hash: 6641AD712002119FDB15EF15C895F6EB7A5AF44714F08802EFD429F3C2DBB9A908CB9A

Function 00443226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 004432C5

Strings

info, xrefs: 00443266
question, xrefs: 0044327E
blank, xrefs: 00443247
warning, xrefs: 004432AE
stop, xrefs: 00443296

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 5b45304ec20d2cc65acdb4183cbb914bb62a382bfc3d62bde29025b3f6506fe0
Instruction ID: 4270936f35e9761a01b9c3e7f7a95ffda830723173dbb5a1bbe5d206ed77a854
Opcode Fuzzy Hash: 5b45304ec20d2cc65acdb4183cbb914bb62a382bfc3d62bde29025b3f6506fe0
Instruction Fuzzy Hash: DD11C2352083467AFB015E55AC43D6BBB9CAF19B76B2000BBF50066281E6FD5B4145AE

Function 00444534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0044454E
LoadStringW.USER32(00000000), ref: 00444555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0044456B
LoadStringW.USER32(00000000), ref: 00444572
_wprintf.LIBCMT ref: 00444598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004445B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00444593

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 9714de0c0274e909f42383b153d93eb85a18fd11fff13e0c9967bcea56a21768
Instruction ID: 4c372f1b05771f1f9328b804cc50ed8df9e4bce4c5b124ff858d04b8bdd0be21
Opcode Fuzzy Hash: 9714de0c0274e909f42383b153d93eb85a18fd11fff13e0c9967bcea56a21768
Instruction Fuzzy Hash: 230144F2504208BFE7109794ED89EE7776CE708301F0005B6FB45E2051E6B45E894B79

Function 0046D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

GetSystemMetrics.USER32(0000000F), ref: 0046D78A
GetSystemMetrics.USER32(0000000F), ref: 0046D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0046D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0046DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0046DA24
ShowWindow.USER32(00000003,00000000), ref: 0046DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0046DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0046DA8B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 51db80c6c4d74e1a02c94f20c414c803f84a7bf05d4a704541b2140284d686f9
Instruction ID: 5a437f401a03509369d28aeb91555b2eb876f496cd6dbcd56319240ff3de09ab
Opcode Fuzzy Hash: 51db80c6c4d74e1a02c94f20c414c803f84a7bf05d4a704541b2140284d686f9
Instruction Fuzzy Hash: B1B19A71E04215ABDF14CF68C9857BE7BB1FF08701F08806AEC489B295E738A954CB5A

Function 003E2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0041C417,00000004,00000000,00000000,00000000), ref: 003E2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0041C417,00000004,00000000,00000000,00000000,000000FF), ref: 003E2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0041C417,00000004,00000000,00000000,00000000), ref: 0041C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0041C417,00000004,00000000,00000000,00000000), ref: 0041C4D6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ccbd2ffb87793f573fc3dd803eea380e47788f563eb65a1464ca796b07674bbf
Instruction ID: 00d6505b1a5633a7bade06e68d8977d060ee6d0d4d82c39a1b749ee434c82f2a
Opcode Fuzzy Hash: ccbd2ffb87793f573fc3dd803eea380e47788f563eb65a1464ca796b07674bbf
Instruction Fuzzy Hash: 3D413C316086D09AC7378B2ADCD877B3B9DAB45300F19863EE087466E0CA79A8C6C715

Function 00447368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0044737F

Part of subcall function 00400FF6: std::exception::exception.LIBCMT ref: 0040102C
Part of subcall function 00400FF6: __CxxThrowException@8.LIBCMT ref: 00401041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 004473B6
EnterCriticalSection.KERNEL32(?), ref: 004473D2
_memmove.LIBCMT ref: 00447420
_memmove.LIBCMT ref: 0044743D
LeaveCriticalSection.KERNEL32(?), ref: 0044744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00447461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00447480

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 23278ca153c3727b18c230c34d1131812b9645b47a91a607fa7311c355cb3e96
Instruction ID: e20e24ecc01a50625a64ca653a9a0b003dc0c66b8633b0fa4137c803af35fc74
Opcode Fuzzy Hash: 23278ca153c3727b18c230c34d1131812b9645b47a91a607fa7311c355cb3e96
Instruction Fuzzy Hash: 9531CD31A04205EBDB10DF65DC85AAB7B78EF44300B1440BAF940AB286DB749A14DBA9

Function 00466442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0046645A
GetDC.USER32(00000000), ref: 00466462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0046646D
ReleaseDC.USER32(00000000,00000000), ref: 00466479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 004664B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004664C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00469299,?,?,000000FF,00000000,?,000000FF,?), ref: 00466500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00466520

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: e26f7436d1643b020290f9f7f953bd50a768d97e77f99b23cd0e7ea04b9d57a5
Instruction ID: c99f2b6877cb9ea707a93eb9ca9cca91a1fd9f7ba9a65c15957aed96c5d5793c
Opcode Fuzzy Hash: e26f7436d1643b020290f9f7f953bd50a768d97e77f99b23cd0e7ea04b9d57a5
Instruction Fuzzy Hash: BD318F72201210BFEB108F50DC4AFEB3FA9EF09765F040065FE489A2A5E6B59C41CB79

Function 0043C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0043C087
_memcmp.LIBCMT ref: 0043C0A9
_memcmp.LIBCMT ref: 0043C0C1
_memcmp.LIBCMT ref: 0043C0D4
_memcmp.LIBCMT ref: 0043C0EE
_memcmp.LIBCMT ref: 0043C101
_memcmp.LIBCMT ref: 0043C119
_memcmp.LIBCMT ref: 0043C134

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 13105debc35900cdcec5ee45d82cd1256bf1d516642da3a1bf88f71ee86d9953
Instruction ID: f9594e04c96d8af5e06bff4fae012f40a1b13c4d4e95d061d8a4e2612b1e4e49
Opcode Fuzzy Hash: 13105debc35900cdcec5ee45d82cd1256bf1d516642da3a1bf88f71ee86d9953
Instruction Fuzzy Hash: F0213D61600245BBD614A5214DD2FBF236C9F28398F145027FD09B63D2EB6DDD1187AD

Function 0044ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

Part of subcall function 003FFEC6: _wcscpy.LIBCMT ref: 003FFEE9

_wcstok.LIBCMT ref: 0044EEFF
_wcscpy.LIBCMT ref: 0044EF8E
_memset.LIBCMT ref: 0044EFC1

Strings

X, xrefs: 0044EFFE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6ff932b2e2fc7f72978030a1a34b6ed0f19af7585fdb7616d1fc1024a7679a8f
Instruction ID: 5ad949d164aa499b7731dcd70f41089df08f73e786c08816080633c5da71bc83
Opcode Fuzzy Hash: 6ff932b2e2fc7f72978030a1a34b6ed0f19af7585fdb7616d1fc1024a7679a8f
Instruction Fuzzy Hash: C7C19C315083509FD725EF25C881A5BB7E4BF84314F104A2EF8999B3A2DB34EC09CB86

Function 003E1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4246d649c3b2f245f25435e562fbcf154e2f51df55cf8211145e4c39ae043846
Instruction ID: 25ffadacc3e6b42c64734aa5617fe07ee00f4ac7c82b23ebb53bba086b84675c
Opcode Fuzzy Hash: 4246d649c3b2f245f25435e562fbcf154e2f51df55cf8211145e4c39ae043846
Instruction Fuzzy Hash: 1D719B70900159EFCB06CF9ACC49EBEBB78FF85310F108259F915AA291D734AA51CFA4

Function 00456E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b2f2824b2685fa2b4818ee542ef231280617372019ac1da9b1c8dcdf1f50b4
Instruction ID: 329c724f1cc79bb2721240dcd252cffb8ec93aa9c2305dc839a49845f5e6df8c
Opcode Fuzzy Hash: 64b2f2824b2685fa2b4818ee542ef231280617372019ac1da9b1c8dcdf1f50b4
Instruction Fuzzy Hash: 05610F71508310ABC311EB21DC82F6FB7E9AF84B14F104A2EF9459B2E2DB749D09C796

Function 0046B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013355B8), ref: 0046B6A5
IsWindowEnabled.USER32(013355B8), ref: 0046B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0046B795
SendMessageW.USER32(013355B8,000000B0,?,?), ref: 0046B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0046B809
GetWindowLongW.USER32(013355B8,000000EC), ref: 0046B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0046B843

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 8f3cbc127dc524c6f98a601eee994fbb517ab08ca7053ce62330d0eac3d6dddc
Instruction ID: 4bdc6be6d5b1b762a7eff969387e2857be1fd149a038dcae0318e3f66b9d9793
Opcode Fuzzy Hash: 8f3cbc127dc524c6f98a601eee994fbb517ab08ca7053ce62330d0eac3d6dddc
Instruction Fuzzy Hash: 8871B334600204AFDB209F64C894FBB7BB9EF59301F15406BE956D7361E739A881CB9B

Function 0045F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045F75C
_memset.LIBCMT ref: 0045F825
ShellExecuteExW.SHELL32(?), ref: 0045F86A

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

Part of subcall function 003FFEC6: _wcscpy.LIBCMT ref: 003FFEE9

GetProcessId.KERNEL32(00000000), ref: 0045F8E1
CloseHandle.KERNEL32(00000000), ref: 0045F910

Strings

@, xrefs: 0045F839

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: c98bd1ea39f0e536751401f57fd8fe6417a14d169e4d9dad0738dcda35a6658f
Instruction ID: 8590c095a9d07f98b98ca5a6c8e75d8e3f7449e59b7bd2ec4531a8dab1f2402a
Opcode Fuzzy Hash: c98bd1ea39f0e536751401f57fd8fe6417a14d169e4d9dad0738dcda35a6658f
Instruction Fuzzy Hash: 3861C074A00629DFCF05EF55C580AAEBBF4FF48310F14856AE845AB392CB34AD48CB95

Function 0044145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0044149C
GetKeyboardState.USER32(?), ref: 004414B1
SetKeyboardState.USER32(?), ref: 00441512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00441540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0044155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 004415A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 004415C8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0cd109db1b03a043c1e2b1aecdd95789feda53c1aeafef1f1f63bf9dba2827a9
Instruction ID: 76fd029ce666e1b54e428c4c5254cfc739e01ddfd589deb0c1e84d518eba528a
Opcode Fuzzy Hash: 0cd109db1b03a043c1e2b1aecdd95789feda53c1aeafef1f1f63bf9dba2827a9
Instruction Fuzzy Hash: E151E2A0A047D53EFB3246248C45BBBBFA95B46304F08448AE1D6469E2D2ECECC4D759

Function 00441276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004412B5
GetKeyboardState.USER32(?), ref: 004412CA
SetKeyboardState.USER32(?), ref: 0044132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00441357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00441374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 004413B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 004413D9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: bf0f5ecc76da556af442276ad1b3cf26a52c829c9f63316f25083f1b135d8224
Instruction ID: 6073bbced48979c29f03f8868ef86db5da20f4a59881420eef9b3df53ee4baa7
Opcode Fuzzy Hash: bf0f5ecc76da556af442276ad1b3cf26a52c829c9f63316f25083f1b135d8224
Instruction Fuzzy Hash: 865123A05043D53DFB3287248C41B7BBFA96B06304F08848BE5D896DE3D398ACC8D769

Function 0044589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 004458AC
_wcsncpy.LIBCMT ref: 004458E1
_wcsncpy.LIBCMT ref: 00445913
_wcsncpy.LIBCMT ref: 00445946
_wcsncpy.LIBCMT ref: 00445988
_wcsncpy.LIBCMT ref: 004459C2
_wcsncpy.LIBCMT ref: 004459F1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 8ddd884f9a8935c26ba1e0b16d3da88c1fb55510280dcd67615b9e69bee87922
Instruction ID: 50bf0b8254d00712e2465660774e52e6c59472c25519faea2de3deebf49006e8
Opcode Fuzzy Hash: 8ddd884f9a8935c26ba1e0b16d3da88c1fb55510280dcd67615b9e69bee87922
Instruction Fuzzy Hash: AB4191A5C2011876CB10EBB6C88A9CF77A89F05711F50846BE518F31A2E638E714C7ED

Function 0043DA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0043DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0043DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0043DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0043DB8E

Strings

DllGetClassObject, xrefs: 0043DB01
,,G, xrefs: 0043DA69

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,G$DllGetClassObject
API String ID: 753597075-4028804068
Opcode ID: 8a76be05ed2d66b71cc76b9540bbbcaad01b31863147884dd9c08380e5eeaca1
Instruction ID: bc035d0a2b69ce4f57b4c508ac78f32961fbb6528926ec4c72f999ab9674b469
Opcode Fuzzy Hash: 8a76be05ed2d66b71cc76b9540bbbcaad01b31863147884dd9c08380e5eeaca1
Instruction Fuzzy Hash: 1D41C471A00208DFDB05CF15D884A9ABBB9EF48350F1190AFED059F206D7B8ED44CBA4

Function 004438AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004448AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004438D3,?), ref: 004448C7

Part of subcall function 004448AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004438D3,?), ref: 004448E0

lstrcmpiW.KERNEL32(?,?), ref: 004438F3
_wcscmp.LIBCMT ref: 0044390F
MoveFileW.KERNEL32(?,?), ref: 00443927
_wcscat.LIBCMT ref: 0044396F
SHFileOperationW.SHELL32(?), ref: 004439DB

Strings

\*.*, xrefs: 00443969

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 5b083fa1ae58746fe70f227379612e9f6070d5f75971accb8b23a0aa167f076d
Instruction ID: 5e8ec75e4462cc313ba41705145c0dfd8e0de458a33d1ed476eab0fd4eb3b6d3
Opcode Fuzzy Hash: 5b083fa1ae58746fe70f227379612e9f6070d5f75971accb8b23a0aa167f076d
Instruction Fuzzy Hash: 8441C3B100C3449AD751EF60C485ADFB7E8AF88745F14093FF489D32A1EA78D248C75A

Function 00467500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00467519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004675C0
IsMenu.USER32(?), ref: 004675D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00467620
DrawMenuBar.USER32 ref: 00467633

Strings

0, xrefs: 0046750D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: f252b806291cd065f866080f235c4a8cb4ec72d77d1bc0710c5ecd37e0351897
Instruction ID: 98c529422d8678e058c460b9b220b56a8dd32484cc6a70d6c9788ab621ce323a
Opcode Fuzzy Hash: f252b806291cd065f866080f235c4a8cb4ec72d77d1bc0710c5ecd37e0351897
Instruction Fuzzy Hash: 0C416A74A05608EFDB10DF54D884E9ABBF8FF04328F14802AE9569B390E734AD41CF96

Function 0046122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0046125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00461286
FreeLibrary.KERNEL32(00000000), ref: 0046133D

Part of subcall function 0046122D: RegCloseKey.ADVAPI32(?), ref: 004612A3
Part of subcall function 0046122D: FreeLibrary.KERNEL32(?), ref: 004612F5
Part of subcall function 0046122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00461318

RegDeleteKeyW.ADVAPI32(?,?), ref: 004612E0

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 05aeb8f4348aea229b9ed9198a2939f5a0b22568810d775d279822f9176737bb
Instruction ID: 1a7d9f657fc031be152e85c79c75e337b21de23ae59b00e881a83198146b313b
Opcode Fuzzy Hash: 05aeb8f4348aea229b9ed9198a2939f5a0b22568810d775d279822f9176737bb
Instruction Fuzzy Hash: EA312171901109BFEB14DFD0EC859FFB7BCEF08340F04017AE942E2651E6745E899AA5

Function 0046653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0046655B
GetWindowLongW.USER32(013355B8,000000F0), ref: 0046658E
GetWindowLongW.USER32(013355B8,000000F0), ref: 004665C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 004665F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0046661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00466630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0046664A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 4f6d664889fb578ac093d0fbc46d41daf3f9db0f98ac7699df131fab5189079f
Instruction ID: 984881a7cf0f332a1f974d452f8216ac86344a0a9572a4e881fd76ad2febbb8e
Opcode Fuzzy Hash: 4f6d664889fb578ac093d0fbc46d41daf3f9db0f98ac7699df131fab5189079f
Instruction Fuzzy Hash: CB312330605150AFDB20CF28EC86F563BE5FB4A714F1A017AF5128F2B5EB65AC44CB5A

Function 00456486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004580A0: inet_addr.WSOCK32(00000000), ref: 004580CB

socket.WSOCK32(00000002,00000001,00000006), ref: 004564D9
WSAGetLastError.WSOCK32(00000000), ref: 004564E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00456521
connect.WSOCK32(00000000,?,00000010), ref: 0045652A
WSAGetLastError.WSOCK32 ref: 00456534
closesocket.WSOCK32(00000000), ref: 0045655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00456576

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: c0890c6baf9cd739e50cd9f7518984d7d614b8ea1252d6cc1f51049ee5fd7615
Instruction ID: f1fc28d2ef11a24e371b75776db9b5e6e0bacb5bf63e36c7ca635472e4c07249
Opcode Fuzzy Hash: c0890c6baf9cd739e50cd9f7518984d7d614b8ea1252d6cc1f51049ee5fd7615
Instruction Fuzzy Hash: E231F531600118AFDB10AF14DC85BBE77ACEF45315F01406AFD459B382DB74AC08CB6A

Function 0043E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0043E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0043E120
SysAllocString.OLEAUT32(00000000), ref: 0043E123
SysAllocString.OLEAUT32 ref: 0043E144
SysFreeString.OLEAUT32 ref: 0043E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0043E167
SysAllocString.OLEAUT32(?), ref: 0043E175

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 3b3e1262ded30a62ef0c48d51c3094ee7e804314c788429f3bf92ee987e4d5ca
Instruction ID: 93a7d38a9b35ee23aceef6510418034e1d1e11eb8e829d3578173a82b1c13fd7
Opcode Fuzzy Hash: 3b3e1262ded30a62ef0c48d51c3094ee7e804314c788429f3bf92ee987e4d5ca
Instruction Fuzzy Hash: 10219231205108AFDF109FA9DC88CAB77ACEB0D760B008136F954CB2A0EA74DC418B69

Function 0043FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0043FB81
__wcsnicmp.LIBCMT ref: 0043FBA2
__wcsnicmp.LIBCMT ref: 0043FBBC

Strings

#OnAutoItStartRegister, xrefs: 0043FBB6
#notrayicon, xrefs: 0043FB79
#requireadmin, xrefs: 0043FB9C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: d1d378fc026ed19716e1dadd121e8d0c05fba062a7dc33da07a1c78a8da267c0
Instruction ID: 7d211e8aabd2e8653bced74b2ab26bd832b7fb500e8b5af70eab026031013544
Opcode Fuzzy Hash: d1d378fc026ed19716e1dadd121e8d0c05fba062a7dc33da07a1c78a8da267c0
Instruction Fuzzy Hash: C7216A72A40150A6D231A731DD12FABB39CEF19304F10903BF98596282E76CAD86C2AD

Function 0046783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003E1D73
Part of subcall function 003E1D35: GetStockObject.GDI32(00000011), ref: 003E1D87
Part of subcall function 003E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 003E1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004678A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004678AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004678B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004678C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004678D4

Strings

Msctls_Progress32, xrefs: 00467872

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 00e63f24c2b0bed99e83a9a45531fdc368eb2baa97bfa67564d1924097b24988
Instruction ID: 297a8d4b50010ac9978d3b8449b9d89204223421d07270668946e58aee158f87
Opcode Fuzzy Hash: 00e63f24c2b0bed99e83a9a45531fdc368eb2baa97bfa67564d1924097b24988
Instruction Fuzzy Hash: AB1190B2110219BFEF159F60CC85EE77F6DEF08798F014125FA04A61A0D776AC21DBA4

Function 004041C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00404292,?), ref: 004041E3
GetProcAddress.KERNEL32(00000000), ref: 004041EA
EncodePointer.KERNEL32(00000000), ref: 004041F6
DecodePointer.KERNEL32(00000001,00404292,?), ref: 00404213

Strings

combase.dll, xrefs: 004041DE
RoInitialize, xrefs: 004041D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 2e67733d220ad8d2500e92d98ea2b085a8708bfc143bc069d54a384a177e7d55
Instruction ID: ae67de11a1b3eeb5d3f797b37026df4bbe52d4edc3f0ec2dd0f35e59d0dca1e7
Opcode Fuzzy Hash: 2e67733d220ad8d2500e92d98ea2b085a8708bfc143bc069d54a384a177e7d55
Instruction Fuzzy Hash: 21E0E5B0690300AAEB205BB0EC0DB493AA5B7E2B42F108435F951E51E0EAF944999E0D

Function 0040429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,004041B8), ref: 004042B8
GetProcAddress.KERNEL32(00000000), ref: 004042BF
EncodePointer.KERNEL32(00000000), ref: 004042CA
DecodePointer.KERNEL32(004041B8), ref: 004042E5

Strings

RoUninitialize, xrefs: 004042A7
combase.dll, xrefs: 004042B3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 5320c34e0a36ed7d4eaa1ff6e955dcc22f35f241a1be7c4f064a4849b633ba04
Instruction ID: 560b03124d7e4c0aed4206a368bb16745fcaa38fdcf238bf493013ba3cb04db3
Opcode Fuzzy Hash: 5320c34e0a36ed7d4eaa1ff6e955dcc22f35f241a1be7c4f064a4849b633ba04
Instruction Fuzzy Hash: E9E0BF786413009FDB109B60FD0EB593EA4B795782F204079F551E11E0DFF94684CA1D

Function 0044675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004468AD
_memmove.LIBCMT ref: 004467E8

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

_memmove.LIBCMT ref: 0044685B
_memmove.LIBCMT ref: 00446942
_memmove.LIBCMT ref: 0044695B
_memmove.LIBCMT ref: 00446977

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction ID: bad1950267ce35315e06c03de1f60aefabcf441577f5ce5bde35f2b03cc897cf
Opcode Fuzzy Hash: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction Fuzzy Hash: E161D33050069A9BEF12EF61CC81FFE37A8AF05308F05452AF8956B2D2DB789D45CB56

Function 0046046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 004610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00460038,?,?), ref: 004610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00460548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00460588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 004605AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 004605D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00460617
RegCloseKey.ADVAPI32(00000000), ref: 00460624

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 799f99a7027ec08d3cfbd947d6448617901fae007bed1718cc40c7ea4f939698
Instruction ID: b283ff30dfecc12b201b2f836f1d9199544a8b015ac17fe63895a5bb837e2fb6
Opcode Fuzzy Hash: 799f99a7027ec08d3cfbd947d6448617901fae007bed1718cc40c7ea4f939698
Instruction Fuzzy Hash: 12517A31108240AFC711EF65C885E6FBBE8FF88314F04492EF4869B2A1EB75E905CB56

Function 00465A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00465A82
GetMenuItemCount.USER32(00000000), ref: 00465AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00465AE1
GetMenuItemID.USER32(?,?), ref: 00465B50
GetSubMenu.USER32(?,?), ref: 00465B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00465BAF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: f52179511381c0298a345a123579f8014567c793976d7c910f3a3dacef5c85f1
Instruction ID: e906b73cd404e7d2d9ff97f708721c552496b6427f5d3bda2407ba9a0c1b0e7e
Opcode Fuzzy Hash: f52179511381c0298a345a123579f8014567c793976d7c910f3a3dacef5c85f1
Instruction Fuzzy Hash: 1251A431A00615EFDF11DFA5C845AAEB7B4EF48710F10446AF841BB391DB74BE418B99

Function 0043F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0043F3F7
VariantClear.OLEAUT32(00000013), ref: 0043F469
VariantClear.OLEAUT32(00000000), ref: 0043F4C4
_memmove.LIBCMT ref: 0043F4EE
VariantClear.OLEAUT32(?), ref: 0043F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0043F569

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 7f3335155205e63ccb5c5900e8c51d40b2a26970b070532edfc716a1bd5b7213
Instruction ID: 891df4535e943896b9cf5a0b3b9ce66790ccf0d06d6cdda9d709cbed68e85423
Opcode Fuzzy Hash: 7f3335155205e63ccb5c5900e8c51d40b2a26970b070532edfc716a1bd5b7213
Instruction Fuzzy Hash: 10515AB5A00209AFCB10CF58D880AAAB7B8FF5C354F15816AE959DB311E734E915CFA4

Function 004426F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00442747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00442792
IsMenu.USER32(00000000), ref: 004427B2
CreatePopupMenu.USER32 ref: 004427E6
GetMenuItemCount.USER32(000000FF), ref: 00442844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00442875

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ee366db010de24bdeff0a9abcee53ce864a217360c3d4e52394563419b63aa22
Instruction ID: 73b231c56a12808ac44a50d8a0a96449b15ca90d8f4d988b93eb0486c1e7dd9c
Opcode Fuzzy Hash: ee366db010de24bdeff0a9abcee53ce864a217360c3d4e52394563419b63aa22
Instruction Fuzzy Hash: A651A270A00205EFEF24DF69DA88AAEBBF4AF44314F50466AF4119B291D7B88944CB59

Function 003E1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 003E179A
GetWindowRect.USER32(?,?), ref: 003E17FE
ScreenToClient.USER32(?,?), ref: 003E181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 003E182C
EndPaint.USER32(?,?), ref: 003E1876

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 4293c1f014e7baad5f9927c2b6be232b99bebb6c904a405d590be4c607681af7
Instruction ID: 292ede446abb382e20726594238d1d0619c82b4dde1aa07008f4aacfce221210
Opcode Fuzzy Hash: 4293c1f014e7baad5f9927c2b6be232b99bebb6c904a405d590be4c607681af7
Instruction Fuzzy Hash: 9B41BC70100350AFC711EF26DC84FBA7BE8EB4A724F040639F9A58A2E1D7759C45DB66

Function 0046B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(004A67B0,00000000,013355B8,?,?,004A67B0,?,0046B862,?,?), ref: 0046B9CC
EnableWindow.USER32(00000000,00000000), ref: 0046B9F0
ShowWindow.USER32(004A67B0,00000000,013355B8,?,?,004A67B0,?,0046B862,?,?), ref: 0046BA50
ShowWindow.USER32(00000000,00000004,?,0046B862,?,?), ref: 0046BA62
EnableWindow.USER32(00000000,00000001), ref: 0046BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0046BAA9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 4496a3c20ac2c6f8f994b506ca80e93c09827bc32af09b60ba46c24ce95160bd
Instruction ID: dfa691e26042f55a7b81904010be90fb7caca7499e3964f1063ea32aae58d066
Opcode Fuzzy Hash: 4496a3c20ac2c6f8f994b506ca80e93c09827bc32af09b60ba46c24ce95160bd
Instruction Fuzzy Hash: A0418670600140AFDB25CF54D489B967BE0FF05315F1842BAFA48CF3A2D775A889CB96

Function 004573B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00455134,?,?,00000000,00000001), ref: 004573BF

Part of subcall function 00453C94: GetWindowRect.USER32(?,?), ref: 00453CA7

GetDesktopWindow.USER32 ref: 004573E9
GetWindowRect.USER32(00000000), ref: 004573F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00457422

Part of subcall function 004454E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0044555E

GetCursorPos.USER32(?), ref: 0045744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004574AC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: a8bb719df99b799d386469cd62a735441b28ba800d1afbc5647e4919f3a0eec1
Instruction ID: b8fc21fcdf2b868ae3798b9b41552054c72ccf8d6e6c4afe6cc22b15fcc571aa
Opcode Fuzzy Hash: a8bb719df99b799d386469cd62a735441b28ba800d1afbc5647e4919f3a0eec1
Instruction Fuzzy Hash: 0C310672508305ABD720DF14E849F5BBBE9FF89305F00092AF88997192D774E909CB97

Function 00438D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004385F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00438608
Part of subcall function 004385F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00438612
Part of subcall function 004385F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00438621
Part of subcall function 004385F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00438628
Part of subcall function 004385F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0043863E

GetLengthSid.ADVAPI32(?,00000000,00438977), ref: 00438DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00438DB8
HeapAlloc.KERNEL32(00000000), ref: 00438DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00438DD8
GetProcessHeap.KERNEL32(00000000,00000000,00438977), ref: 00438DEC
HeapFree.KERNEL32(00000000), ref: 00438DF3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 69018780070682eee79432987856fc81f161f006981a7d2f10f630eaae1e3632
Instruction ID: 15131218a2201311775e6bb0107e1b1cc86a12262b2b66d6d6f9006497116657
Opcode Fuzzy Hash: 69018780070682eee79432987856fc81f161f006981a7d2f10f630eaae1e3632
Instruction Fuzzy Hash: 6C11CD31500604FBDB108B64DC08BEFB769EB49355F10502EF88593250DB3AAD04CB68

Function 00438AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00438B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00438B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00438B40
CloseHandle.KERNEL32(00000004), ref: 00438B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00438B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00438B8E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: fdf5eb26067536d6187a08d84fd841a59814f7d93d345fc926a63eba64cb2636
Instruction ID: 8955ef4a4ae58780d8f27852de0863429e8a5d4cb24f298f039fe98297204e73
Opcode Fuzzy Hash: fdf5eb26067536d6187a08d84fd841a59814f7d93d345fc926a63eba64cb2636
Instruction Fuzzy Hash: F5116DB250020EEBDF018FA4ED49FDEBBA9EF08304F045069FE44A2160D776AD64DB65

Function 0046C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 003E12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003E134D
Part of subcall function 003E12F3: SelectObject.GDI32(?,00000000), ref: 003E135C
Part of subcall function 003E12F3: BeginPath.GDI32(?), ref: 003E1373
Part of subcall function 003E12F3: SelectObject.GDI32(?,00000000), ref: 003E139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0046C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0046C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0046C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0046C1F6
EndPath.GDI32(00000000), ref: 0046C206
StrokePath.GDI32(00000000), ref: 0046C216

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: bee2c377957aab172cb6a84b9c240222516e0f4aff0e78f9e27ead6147a799ea
Instruction ID: 5576e1642223dd7db7a379d851d3cd4218157e2eae573f506609e70e6e0bf316
Opcode Fuzzy Hash: bee2c377957aab172cb6a84b9c240222516e0f4aff0e78f9e27ead6147a799ea
Instruction Fuzzy Hash: BC113C7640010CBFDB019F90EC88EEA3FACEB08390F048031FE485A161D7719D58DBA5

Function 004003A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 004003D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 004003DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004003E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004003F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 004003F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00400401

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 7fa6679feccad70622b8fa201a480361002d931a93b931163519034b20ea9ceb
Instruction ID: e5032460450de690e6f85642a4d0a2e5d7b840e1fe5db74a0b31aa0c6fb96a05
Opcode Fuzzy Hash: 7fa6679feccad70622b8fa201a480361002d931a93b931163519034b20ea9ceb
Instruction Fuzzy Hash: FC016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BE15C47941C7F5A868CBE5

Function 0044568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0044569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 004456B1
GetWindowThreadProcessId.USER32(?,?), ref: 004456C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004456CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004456D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004456E0

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 5c7c1dafda6601fdef2a4122045969cab62b83d9ab297c499c47eb5cdf7a9077
Instruction ID: cea1dc0372c9b719cbed6362b228f86685f2abc3222c1efb18b28e5292f18ab1
Opcode Fuzzy Hash: 5c7c1dafda6601fdef2a4122045969cab62b83d9ab297c499c47eb5cdf7a9077
Instruction Fuzzy Hash: 2FF06D32241118BBE7205BA2EC0DEEF7A7CEBC6B11F000179FA44D1050AAE01E0686BA

Function 004474D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 004474E5
EnterCriticalSection.KERNEL32(?,?,003F1044,?,?), ref: 004474F6
TerminateThread.KERNEL32(00000000,000001F6,?,003F1044,?,?), ref: 00447503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,003F1044,?,?), ref: 00447510

Part of subcall function 00446ED7: CloseHandle.KERNEL32(00000000,?,0044751D,?,003F1044,?,?), ref: 00446EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00447523
LeaveCriticalSection.KERNEL32(?,?,003F1044,?,?), ref: 0044752A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a5a432ff916c84424a94732b4fc3c371c418bbd4a4ea81cef4cc837f86da00e5
Instruction ID: da5d3f4218af25eb5452ab8941401b25e55b260a1db2d0dd4fa840736602e84d
Opcode Fuzzy Hash: a5a432ff916c84424a94732b4fc3c371c418bbd4a4ea81cef4cc837f86da00e5
Instruction Fuzzy Hash: 54F0823A144A12EBEB112B64FC9C9EB773AFF45302B500572F242954B0EFB65805CF5A

Function 00438E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00438E7F
UnloadUserProfile.USERENV(?,?), ref: 00438E8B
CloseHandle.KERNEL32(?), ref: 00438E94
CloseHandle.KERNEL32(?), ref: 00438E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00438EA5
HeapFree.KERNEL32(00000000), ref: 00438EAC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 1ffcf3d4f2e3966547a2ec5871d374f7049d77a9a70fecdb2629077b2b21f065
Instruction ID: 3d758373f8c5d96e7ecae254c30d03acc32f239a0a6bdaec646c7e4620a947b2
Opcode Fuzzy Hash: 1ffcf3d4f2e3966547a2ec5871d374f7049d77a9a70fecdb2629077b2b21f065
Instruction Fuzzy Hash: 03E0C236104401FBDA011FE1FC0C94ABB69FB8A362B108230F25981170EBB2A868DB5A

Function 00437A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00472C7C,?), ref: 00437C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00472C7C,?), ref: 00437C4A
CLSIDFromProgID.OLE32(?,?,00000000,0046FB80,000000FF,?,00000000,00000800,00000000,?,00472C7C,?), ref: 00437C6F
_memcmp.LIBCMT ref: 00437C90

Strings

,,G, xrefs: 00437A85

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,G
API String ID: 314563124-530569483
Opcode ID: 20495b03a3fe2873d692341b30de8c899e6458c6f697b55b8b2066f682775ad6
Instruction ID: e3b3eb6fdae6381125cb05d2c1515659815c874584e7a5eac61ea5f8cd10cff9
Opcode Fuzzy Hash: 20495b03a3fe2873d692341b30de8c899e6458c6f697b55b8b2066f682775ad6
Instruction Fuzzy Hash: 39812BB1A00109EFCB14DF94C984EEEB7B9FF89315F204199F546AB250DB75AE06CB60

Function 00458902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00458928
CharUpperBuffW.USER32(?,?), ref: 00458A37
VariantClear.OLEAUT32(?), ref: 00458BAF

Part of subcall function 00447804: VariantInit.OLEAUT32(00000000), ref: 00447844
Part of subcall function 00447804: VariantCopy.OLEAUT32(00000000,?), ref: 0044784D
Part of subcall function 00447804: VariantClear.OLEAUT32(00000000), ref: 00447859

Strings

AUTOIT.ERROR, xrefs: 00458A3D
Incorrect Parameter format, xrefs: 00458960, 00458B22

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: eda4296621b6d17754168f62c399fe94c2b595172e041c26d3d3553008b911ff
Instruction ID: 48a0a47e54ab554618aba3269d8cf14504b936544832b9eed81942739274c402
Opcode Fuzzy Hash: eda4296621b6d17754168f62c399fe94c2b595172e041c26d3d3553008b911ff
Instruction Fuzzy Hash: D0918F706043419FC700DF25C48096BBBE8EF89315F14496EF8869B3A2DF34E90ACB56

Function 00442F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003FFEC6: _wcscpy.LIBCMT ref: 003FFEE9

_memset.LIBCMT ref: 00443077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004430A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00443159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00443187

Strings

0, xrefs: 00443063

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 02132dd7b1f84e4cb5c4ba86e5fcae81889ed66c3abed036793b9c5d1cbca7bf
Instruction ID: 7645669df484d82076f7ea32e5abcabb1152ebd6acad8adf0533c6c2c88218ea
Opcode Fuzzy Hash: 02132dd7b1f84e4cb5c4ba86e5fcae81889ed66c3abed036793b9c5d1cbca7bf
Instruction Fuzzy Hash: BF51C0316083009AF7159F28D845A6BB7E8AF55B25F040A2FF895E22D1DB78CE44C75A

Function 00442C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00442CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00442CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00442D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,004A6890,00000000), ref: 00442D5A

Strings

0, xrefs: 00442CA4

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: c994bbf4c0e6fb4eb1df1d313ba282b2629ff0f09c18a7093c485edbae13c597
Instruction ID: 0337a4c3d87e8ea18e1245af1a286b54215f4ec285a8aad6ced92e2988d384a2
Opcode Fuzzy Hash: c994bbf4c0e6fb4eb1df1d313ba282b2629ff0f09c18a7093c485edbae13c597
Instruction Fuzzy Hash: 8441C1B0504302AFE710DF24C941B1BB7E4AF85324F44462EF86297291D7B4E904CB9A

Function 0045DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0045DAD9

Part of subcall function 003E79AB: _memmove.LIBCMT ref: 003E79F9

Strings

stdcall, xrefs: 0045DB5B
winapi, xrefs: 0045DB4A
cdecl, xrefs: 0045DB30
none, xrefs: 0045DBB4

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: f1d38c701368699e0016dbbad154c0e8773cd1b8c1316a05f4cae3ab22f10e63
Instruction ID: e10a4b667a88190cf745cdb52bbf0ce8bf49f228f37ba741d35ed5b765526fe5
Opcode Fuzzy Hash: f1d38c701368699e0016dbbad154c0e8773cd1b8c1316a05f4cae3ab22f10e63
Instruction Fuzzy Hash: 2831C5709042199FCF10EF55CC819AEB7B5FF15314B10872AE865AB7D2CB75B90ACB84

Function 00439372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004393F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00439409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00439439

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Strings

ComboBox, xrefs: 00439380
ListBox, xrefs: 004393B5

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: f54eb19a905ca32b681fd2bb5bb50238b0267ed0ab2878f630d6e66b54aa8720
Instruction ID: d5dcf7d8631718782351939fac6af1c8800208d8abe62fadc3b683a3ec6dbab8
Opcode Fuzzy Hash: f54eb19a905ca32b681fd2bb5bb50238b0267ed0ab2878f630d6e66b54aa8720
Instruction Fuzzy Hash: 9E212671904104BBDB15AB75DC85DFFB778DF49360F10422EF921AB2E0DBB80D0A9A24

Function 00466656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003E1D73
Part of subcall function 003E1D35: GetStockObject.GDI32(00000011), ref: 003E1D87
Part of subcall function 003E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 003E1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004666D0
LoadLibraryW.KERNEL32(?), ref: 004666D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004666EC
DestroyWindow.USER32(?), ref: 004666F4

Strings

SysAnimate32, xrefs: 004666AB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 79a7e3a61e6d909ab568b869df42720a6858d17f120f0ca849bfcd1a1aa02024
Instruction ID: d0db861edd2ccc89607f86936962fd6522a611e1ca5d6e6ab6940618cd949ab5
Opcode Fuzzy Hash: 79a7e3a61e6d909ab568b869df42720a6858d17f120f0ca849bfcd1a1aa02024
Instruction Fuzzy Hash: 4D21C271200205ABEF104F64EC80EBB37ADEB19328F12022AF95192290E775CC41976A

Function 0044703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0044705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00447091
GetStdHandle.KERNEL32(0000000C), ref: 004470A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 004470DD

Strings

nul, xrefs: 004470D8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 686f20389a735f4b9f04578251761d0f9ffc1c0d9c140b322064979f87e49757
Instruction ID: a3b55653642168540c0ec93930d9baa135a901ed98baf4da815a1c67288850c9
Opcode Fuzzy Hash: 686f20389a735f4b9f04578251761d0f9ffc1c0d9c140b322064979f87e49757
Instruction Fuzzy Hash: F321B5745052059BEF209F39DC04A9A77F8BF45720F204A2AFCA0D73D0E7759841CB59

Function 0044710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0044712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0044715D
GetStdHandle.KERNEL32(000000F6), ref: 0044716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 004471A8

Strings

nul, xrefs: 004471A3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e49c368776258416023f2f4f8fa32c762da5749f258f90a25eb8fef91530c031
Instruction ID: 4e8cff45e528f7438587c33d38523490445aa9c7b8ba987d62f4346ba226dc6e
Opcode Fuzzy Hash: e49c368776258416023f2f4f8fa32c762da5749f258f90a25eb8fef91530c031
Instruction Fuzzy Hash: 9E21B6756042059BFF209F699C04A9A77E8AF55724F200A1AFDE0D33D0EB749846CB59

Function 0044AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0044AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0044AF13
__swprintf.LIBCMT ref: 0044AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0046F910), ref: 0044AF6A

Strings

%lu, xrefs: 0044AF26

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: b2bed581ab59c456469c2f805337b92af11eccee89b7176ae28e4dbb3b378c3a
Instruction ID: 6b860c6cd3754da6f01089cee34c6a57ce05f2558fd0bf7d2f5be4f197ad8a4c
Opcode Fuzzy Hash: b2bed581ab59c456469c2f805337b92af11eccee89b7176ae28e4dbb3b378c3a
Instruction Fuzzy Hash: 9E219230600109AFCB10EF55DC85EEE7BB8EF49704B1040BAF905AB251DB75EE45CB25

Function 0043A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

Part of subcall function 0043A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0043A399
Part of subcall function 0043A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0043A3AC
Part of subcall function 0043A37C: GetCurrentThreadId.KERNEL32 ref: 0043A3B3
Part of subcall function 0043A37C: AttachThreadInput.USER32(00000000), ref: 0043A3BA

GetFocus.USER32 ref: 0043A554

Part of subcall function 0043A3C5: GetParent.USER32(?), ref: 0043A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0043A59D
EnumChildWindows.USER32(?,0043A615), ref: 0043A5C5
__swprintf.LIBCMT ref: 0043A5DF

Strings

%s%d, xrefs: 0043A5D9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 943c7366765bbcc18ca46ddf635566f22d6f4914439d790dd61b786d447c3ec1
Instruction ID: 313953ea357b2f79f6daa3ddd7521b5b0d18bbb640370f6e1c16115b4cc3be90
Opcode Fuzzy Hash: 943c7366765bbcc18ca46ddf635566f22d6f4914439d790dd61b786d447c3ec1
Instruction Fuzzy Hash: 5911E7712442047BCF11BF61DC86FEA377CAF4C304F00507AFD88AA192DA7559558B7A

Function 00442017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00442048

Strings

EXISTS, xrefs: 00442070
APPEND, xrefs: 00442081
KEYS, xrefs: 0044205F
REMOVE, xrefs: 0044204E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: dccb3f609ae2270adb7da8db794b19d178888c7aa23d1663d772e010874c8521
Instruction ID: b37473ad6587716d17c073dd1257752371adace847e2585c9c9bceac5611208e
Opcode Fuzzy Hash: dccb3f609ae2270adb7da8db794b19d178888c7aa23d1663d772e010874c8521
Instruction Fuzzy Hash: 87118B309001198FDF00EFA4D9415EEB7B0FF25304F50857AE951A7392EB76690ACB54

Function 0045EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0045EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0045EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0045F07E
CloseHandle.KERNEL32(?), ref: 0045F0FF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 658a8f6f79f0fd36a896370b96b5989fb394cbf69e68e39f447ea3f35e6dcee2
Instruction ID: b45a000b3f6a34f4c0147da9f2db8b04921eaff383d7f58da0292572cb087efc
Opcode Fuzzy Hash: 658a8f6f79f0fd36a896370b96b5989fb394cbf69e68e39f447ea3f35e6dcee2
Instruction Fuzzy Hash: D881A5B16003109FD721DF25C846F6AB7E5AF88B10F14892EF999DB3D2DB74AC448B46

Function 004602C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 004610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00460038,?,?), ref: 004610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00460388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004603C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0046040E
RegCloseKey.ADVAPI32(?,?), ref: 0046043A
RegCloseKey.ADVAPI32(00000000), ref: 00460447

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: cfdc72059626ef0ef4c86b081bbf3c6fc2ba6c2dada01a8a6adeb9a620e8ae31
Instruction ID: 77714556994d3c57d758c8b27da3e880b0933760003ac2b9cd6133851c727b51
Opcode Fuzzy Hash: cfdc72059626ef0ef4c86b081bbf3c6fc2ba6c2dada01a8a6adeb9a620e8ae31
Instruction Fuzzy Hash: 2E515B31208244AFD705EF55D881F6BB7E8FF88304F04892EF5958B2A1EB74E905CB56

Function 0044E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0044E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0044E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0044E8F2

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0044E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0044E91F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 7f2ed2be690a0e62d21bfed6a97dcda074578e97080cd391e889e59b3d8139ac
Instruction ID: 39b4a6724344c9447aab1e2beea21da4a6c801a26481dfaed8d6e242f5931fd6
Opcode Fuzzy Hash: 7f2ed2be690a0e62d21bfed6a97dcda074578e97080cd391e889e59b3d8139ac
Instruction Fuzzy Hash: 3D515E35600115DFCF01EF65C981A6EBBF5FF08314B1480AAE849AB3A2CB35ED11DB54

Function 0046A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072354e938a58b4757db341f7bce5b08614585e29aa2b905d48cea95e687c085
Instruction ID: 99a32964d147dc68ea6290d6b7f0b810166bc96dd633ca937b7415e05e076fb3
Opcode Fuzzy Hash: 072354e938a58b4757db341f7bce5b08614585e29aa2b905d48cea95e687c085
Instruction Fuzzy Hash: 7641E535900504ABC710DF28DC48FAABB68EB09310F154166EC56B73E1E7789DA1CE5B

Function 003E2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003E2357
ScreenToClient.USER32(004A67B0,?), ref: 003E2374
GetAsyncKeyState.USER32(00000001), ref: 003E2399
GetAsyncKeyState.USER32(00000002), ref: 003E23A7

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 210296178fadfea1e951831b88418e887611d43721542e8139f1dd65b2bdab76
Instruction ID: acffd5e63fed85ce7893442520cd2c4749f9fe1f0fbe83838c6a6d3ce2f798c5
Opcode Fuzzy Hash: 210296178fadfea1e951831b88418e887611d43721542e8139f1dd65b2bdab76
Instruction Fuzzy Hash: 74419F35904165FBCB168F69CC84AEABB78BB05320F20436BF825922D0C7745D94DF95

Function 00436920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0043695D
TranslateAcceleratorW.USER32(?,?,?), ref: 004369A9
TranslateMessage.USER32(?), ref: 004369D2
DispatchMessageW.USER32(?), ref: 004369DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004369EB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: d6c8b676bfdac524ecbe9056ba60d598fea9d9c66b6ef7337f327b6ff4df557c
Instruction ID: cb9ae32aecf1210b6c425d4d3c5a6610e98c56b86ab8ee4be4dc12d404621f52
Opcode Fuzzy Hash: d6c8b676bfdac524ecbe9056ba60d598fea9d9c66b6ef7337f327b6ff4df557c
Instruction Fuzzy Hash: 28310671500203BADB21DF74DC44BB77BACAF0A300F16917BE421C72A0E778984ACB99

Function 00438F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00438F12
PostMessageW.USER32(?,00000201,00000001), ref: 00438FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00438FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00438FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00438FDA

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 348584ace2d8c7bfa319aede78bf21dc9a6a087c736835a890ffb7e05a493ee3
Instruction ID: 0694cf4e8218f66c0a544f936aaf0d289b9ee88746302c8d2c5bbe269068b249
Opcode Fuzzy Hash: 348584ace2d8c7bfa319aede78bf21dc9a6a087c736835a890ffb7e05a493ee3
Instruction Fuzzy Hash: DD31EE71500219EFDB00CF68E94CA9EBBB6FB48325F10422AF964EB2D0C7B49914CB95

Function 0043B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0043B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0043B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0043B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0043B742
_wcsstr.LIBCMT ref: 0043B74C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 398ce90aed7f4ea2fb554e2ef166d2daee90bd018df5a5b0065e685951ee5197
Instruction ID: 25828e84dd60f6070c86ce1fadf9b2e4738530f040ec2784ea7d77fc7ff1eff8
Opcode Fuzzy Hash: 398ce90aed7f4ea2fb554e2ef166d2daee90bd018df5a5b0065e685951ee5197
Instruction Fuzzy Hash: B621F831204204BAEB155B35DC49F7B7B98DF49710F10403FFD05DA2A1EBA9DC4192A9

Function 0046B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

GetWindowLongW.USER32(?,000000F0), ref: 0046B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0046B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0046B489
GetSystemMetrics.USER32(00000004), ref: 0046B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00451184,00000000), ref: 0046B4D0

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 3eb274eb49a2581dcc0de4201a01e5e684b1ded43ab6bc75fbcd18123e377a9a
Instruction ID: 3307cad0576b39ae29186954f1909c3cc0140c8fe423028ba39d4226e66c9426
Opcode Fuzzy Hash: 3eb274eb49a2581dcc0de4201a01e5e684b1ded43ab6bc75fbcd18123e377a9a
Instruction Fuzzy Hash: C8219171514265AFCB109F38DC04A6A3BA4FB05720F15473AF966C62E2FB349C91DB8A

Function 004397E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00439802

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00439834
__itow.LIBCMT ref: 0043984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00439874
__itow.LIBCMT ref: 00439885

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: ea6f28dc1f7de05e609512e114d6439c9fabaf1b2e5dc7dde2b49f4f560cf606
Instruction ID: a7567bd70c56084c4abab489525ad48f882425c63a9fc7982de4671c0963d0f5
Opcode Fuzzy Hash: ea6f28dc1f7de05e609512e114d6439c9fabaf1b2e5dc7dde2b49f4f560cf606
Instruction Fuzzy Hash: 9021F831700244ABEB15AB66DC86EAF3BA8EF8D720F04503AF904DB291D6B48D458796

Function 003E12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003E134D
SelectObject.GDI32(?,00000000), ref: 003E135C
BeginPath.GDI32(?), ref: 003E1373
SelectObject.GDI32(?,00000000), ref: 003E139C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 39e10724942be5f6a4997a62ff0e605282fb5d525cc3629491c94885c4b2d291
Instruction ID: f26230dd27d1a0e3b6cdfc3183fcc07341e79c2ca83d7a86bdcbee871f7c7d1c
Opcode Fuzzy Hash: 39e10724942be5f6a4997a62ff0e605282fb5d525cc3629491c94885c4b2d291
Instruction Fuzzy Hash: E121A174801254EFDB12AF26EC047A97FBCFB01721F19433AF810965E0E3B59895DB99

Function 0043C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0043C176
_memcmp.LIBCMT ref: 0043C194
_memcmp.LIBCMT ref: 0043C1A7
_memcmp.LIBCMT ref: 0043C1BF
_memcmp.LIBCMT ref: 0043C1D7

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b35538217fa759e452149d7d4cc120d74789c3acb2dd9313f4489749eea1c878
Instruction ID: 4911f78971c2de54b360da822c96509270365f42178d3ec60b66ab51a95c6620
Opcode Fuzzy Hash: b35538217fa759e452149d7d4cc120d74789c3acb2dd9313f4489749eea1c878
Instruction Fuzzy Hash: A30149726042057BEA00A5214D82FBB734C9B24398F148027FD04B6393EBADEE01A7ED

Function 00444D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00444D5C
__beginthreadex.LIBCMT ref: 00444D7A
MessageBoxW.USER32(?,?,?,?), ref: 00444D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00444DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00444DAC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 284d6c0c0d65a822fadc65823ee2c83352503a7a28d31f985c3aed554da36d49
Instruction ID: 6a74a0f06871ec959b67c8528a7ecc239ac38b6dd07756ced4ddee7e8ddf1994
Opcode Fuzzy Hash: 284d6c0c0d65a822fadc65823ee2c83352503a7a28d31f985c3aed554da36d49
Instruction Fuzzy Hash: 5B1108B2D04244BBD7019FA8EC04BDB7FACEB86320F1442B6F914D3351D6B58D4487A5

Function 0043874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00438766
GetLastError.KERNEL32(?,0043822A,?,?,?), ref: 00438770
GetProcessHeap.KERNEL32(00000008,?,?,0043822A,?,?,?), ref: 0043877F
HeapAlloc.KERNEL32(00000000,?,0043822A,?,?,?), ref: 00438786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0043879D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b23a906689839236bdc42bc26989360b4c4a81ea2f0905cf02b255f457446578
Instruction ID: 4eb9df50e126fc213bb892d544a5ff49f03ebb7a1b0205607cd9701214ec9dd4
Opcode Fuzzy Hash: b23a906689839236bdc42bc26989360b4c4a81ea2f0905cf02b255f457446578
Instruction Fuzzy Hash: 22014F75200204EFDB104FA5EC48DA7BB6DFF8A365B200439F849C2360EB758C14CA65

Function 004454E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00445502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00445510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00445518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00445522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0044555E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 712d52d0156e83187e854c4f0aeab07080ba0db8255fefa7283adaba39848b32
Instruction ID: 789ee0cfb6e05c49b0110c730e79aba420dca5e52fe9528da00ff69c32075c58
Opcode Fuzzy Hash: 712d52d0156e83187e854c4f0aeab07080ba0db8255fefa7283adaba39848b32
Instruction Fuzzy Hash: 92016132C00A1DEBDF00DFE4E8485EDBB78FB09701F040066E441B2145DB745954C7AA

Function 00437652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?,?,0043799D), ref: 0043766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?), ref: 0043768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?), ref: 00437698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?), ref: 004376A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0043758C,80070057,?,?), ref: 004376B4

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: fa7ae8d489ae6798267ad622e5292783ab8abab3dbef62641f15f38db0e2c53d
Instruction ID: b263f93b6fba6f368d40290d77e5e9af8a7cfae5edbd81ee62aada6419e7befd
Opcode Fuzzy Hash: fa7ae8d489ae6798267ad622e5292783ab8abab3dbef62641f15f38db0e2c53d
Instruction Fuzzy Hash: B401D4B3604604BBDB205F59EC45BAA7BECEB48761F101079FD84D3211E775DD4087A4

Function 004385F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00438608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00438612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00438621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00438628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0043863E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4070178843055a6deceedb4241e0c397b88b6bb6dab2a1359432cbf0fa19e745
Instruction ID: 49ea311d3419684f79a8d93d237e456e7658b04dd0daa4df3a28891f0eb75552
Opcode Fuzzy Hash: 4070178843055a6deceedb4241e0c397b88b6bb6dab2a1359432cbf0fa19e745
Instruction Fuzzy Hash: 28F04F31201304AFEB100FA5EC8AEAB7BACEF8A754F10143AF985D7250DBA59C45DA65

Function 00438652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00438669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00438673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00438682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00438689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0043869F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8e1781fba00b8d6288924496946be26fef8ad599a347b0512f4e7e18e4117035
Instruction ID: c6368464a795bb3aacd97991d7cbd024436f0781fe15fe3f3a72d51894671ec6
Opcode Fuzzy Hash: 8e1781fba00b8d6288924496946be26fef8ad599a347b0512f4e7e18e4117035
Instruction Fuzzy Hash: 58F0C2B0200304AFEB111FA4EC89EA77BACFF8A764F10003AF985C2250DBB5DC54DA65

Function 0043C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0043C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0043C6D1
MessageBeep.USER32(00000000), ref: 0043C6E9
KillTimer.USER32(?,0000040A), ref: 0043C705
EndDialog.USER32(?,00000001), ref: 0043C71F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d7ad583a6c648406801044e28608c8913a46b1203291a5157e43788f58ad09bc
Instruction ID: 37f777a834f07c0532ea4b328c303711528bdc8607c9f0238aed56e2d28b7b9b
Opcode Fuzzy Hash: d7ad583a6c648406801044e28608c8913a46b1203291a5157e43788f58ad09bc
Instruction Fuzzy Hash: 9601A73050030497EB215B24ED8EF967778FF04745F00166AF582B10E0EBE469598F59

Function 003E13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 003E13BF
StrokeAndFillPath.GDI32(?,?,0041BAD8,00000000,?), ref: 003E13DB
SelectObject.GDI32(?,00000000), ref: 003E13EE
DeleteObject.GDI32 ref: 003E1401
StrokePath.GDI32(?), ref: 003E141C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 4bfac7c12aed2b8823742bfe42b8a9a071e9bcd86facc94ccabdbf314ba4e51f
Instruction ID: 6bbcfec9cc324dd3dd60e36d3d3866ef7982015bf70f3d943b511f7ff6953557
Opcode Fuzzy Hash: 4bfac7c12aed2b8823742bfe42b8a9a071e9bcd86facc94ccabdbf314ba4e51f
Instruction Fuzzy Hash: CBF01974005348EBDB226F27EC0C7583FA8A702326F098238E469441F1E7794999DF19

Function 003F2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00400FF6: std::exception::exception.LIBCMT ref: 0040102C
Part of subcall function 00400FF6: __CxxThrowException@8.LIBCMT ref: 00401041

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 003E7BB1: _memmove.LIBCMT ref: 003E7C0B

__swprintf.LIBCMT ref: 003F302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 003F2EC6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: e5456eae5c10a37051017d34df73c8fe0242777d657010cda7e15939da10cce1
Instruction ID: d1a023ed683702bef61f3f5a88f877f96be5108940e10634f938909926ed5ae1
Opcode Fuzzy Hash: e5456eae5c10a37051017d34df73c8fe0242777d657010cda7e15939da10cce1
Instruction Fuzzy Hash: 8B91AD312083569FCB16EF25D985C7FB7A8EF84740F01492EF5869B2A1DA34EE04CB56

Function 0043B7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0043B981

Strings

Container, xrefs: 0043B8FE
%G, xrefs: 0043BA24
AutoIt3GUI, xrefs: 0043B8F9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%G
API String ID: 3565006973-450436197
Opcode ID: 714a7184e7d351fce5fbeeb962edd907c22b2a9bb2d946e879486af82ca3a85a
Instruction ID: 327adf022c3210595d1aed5b94ec03ede2e2d748f8184223d1b155ddaffbefac
Opcode Fuzzy Hash: 714a7184e7d351fce5fbeeb962edd907c22b2a9bb2d946e879486af82ca3a85a
Instruction Fuzzy Hash: 34914C706006019FDB24DF68C884B66BBE9FF48710F24956EFA49CB791DB74E841CB94

Function 0040524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004052DD

Part of subcall function 00410340: __87except.LIBCMT ref: 0041037B

Strings

pow, xrefs: 004052B5, 004052D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 25704dd6e27f3722f5e105e5e966f28a9b2dcd9f5501ef9fc484f975ca353dc4
Instruction ID: c8bd06a5efbf838751f880afc5b03f657f0374c6a2a883b7c33248c2fa9eb903
Opcode Fuzzy Hash: 25704dd6e27f3722f5e105e5e966f28a9b2dcd9f5501ef9fc484f975ca353dc4
Instruction Fuzzy Hash: 70515A31A1960196CB117724CA413AF2B94DF40750F60497FE899953E5EEBC8CD49E4E

Function 0040023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00400277
#, xrefs: 00400280

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: de845c37f2718d455c5169c654d80bb4e098ad824b635e37622ecadf0d1513e0
Instruction ID: 1ecc503c72b2495466597d6f0005037e0f3f3127a4ebbd87f9ab256d6f433431
Opcode Fuzzy Hash: de845c37f2718d455c5169c654d80bb4e098ad824b635e37622ecadf0d1513e0
Instruction Fuzzy Hash: 725131745046568FCF269F29C4886FA7BA4EF19310F148066EC91AF3E0D7389C42CB69

Function 003F3297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003F33D7
_memmove.LIBCMT ref: 003F3470
_free.LIBCMT ref: 003F3496
_memmove.LIBCMT ref: 003F3549

Strings

Oa?, xrefs: 003F3482

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa?
API String ID: 2620147621-1309107252
Opcode ID: 2e59b45c57e7409692c2e98109443a226e426341dea97c033bf4855a1b45741b
Instruction ID: 543fde3cd3b96a63411ba4a83cbd68fd13c99e86cd3bde91e5157677dd691e3a
Opcode Fuzzy Hash: 2e59b45c57e7409692c2e98109443a226e426341dea97c033bf4855a1b45741b
Instruction Fuzzy Hash: C35169B1A083459FDB25CF29C481B2BBBE1EF85304F45492DEA89D7361DB35E901CB92

Function 003F62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003F63A8
_memmove.LIBCMT ref: 003F6446
_memset.LIBCMT ref: 003F646A

Strings

ERCP, xrefs: 003F6313

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1f125d3af2f2330e47190fbe3a90406cc1563558abef7b4eb09f3c5cf5e1ee89
Instruction ID: d87026267924982622f358e948d88c31327f831ab42f305599ce42b811b4382d
Opcode Fuzzy Hash: 1f125d3af2f2330e47190fbe3a90406cc1563558abef7b4eb09f3c5cf5e1ee89
Instruction Fuzzy Hash: F551D4719003099BDB25DF65C8817AABBF8EF08314F20857FEA4AC7251E7749980CB44

Function 00467648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004676D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004676E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00467708

Strings

SysMonthCal32, xrefs: 0046769B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 31740655c3e3209b379ef13f5a13500387fcfe673caeb69a515ac148fd41b1b3
Instruction ID: f2727c8e0438de8a094742ef5bb78a4de30b75484510b84f8825fd4d90daf105
Opcode Fuzzy Hash: 31740655c3e3209b379ef13f5a13500387fcfe673caeb69a515ac148fd41b1b3
Instruction Fuzzy Hash: 7421E232504218BBDF11CFA4CC42FEB3B79EF48728F110215FE156B1D0EAB5A8518BA5

Function 00466F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00466FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00466FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00466FDF

Strings

Listbox, xrefs: 00466F77

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 12302298a05f8c473384fa54343a4df9dcbbb66d6d0944f3fbe97e0a91feb261
Instruction ID: efee1de2ee3065fd0ddabd11af4c92da4fa2464a1c1f193c22563e741c172a3a
Opcode Fuzzy Hash: 12302298a05f8c473384fa54343a4df9dcbbb66d6d0944f3fbe97e0a91feb261
Instruction Fuzzy Hash: 64214632610118BFDF158F54EC80FBF3BAAEF89710F028125F9009B290D675AC11CBA4

Function 0046797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004679E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004679F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00467A03

Strings

msctls_trackbar32, xrefs: 004679B8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: d92e1ca1174a9652b76e57c005e537158fdfb80c01b35547da1a6f2ee7cc490d
Instruction ID: 3ba5a00f580f90577f81764e0a41608f5132fba14040a66829ee73337e29d823
Opcode Fuzzy Hash: d92e1ca1174a9652b76e57c005e537158fdfb80c01b35547da1a6f2ee7cc490d
Instruction Fuzzy Hash: ED113A72244208BBEF109F70CC05FEB3BADEF89768F11052AF641A61D0E275D851CB64

Function 003E4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003E4C2E), ref: 003E4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 003E4CB5

Strings

GetNativeSystemInfo, xrefs: 003E4CAF
kernel32.dll, xrefs: 003E4C9E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 9c611ad478d6ccde5d924b9edb00a8b11240770c2436d842bb1004ea9d80d654
Instruction ID: 1fcf0349a292aa2c4f1c9c38ef3c7ebae3bbc170be2187547393bce7ec8fad5d
Opcode Fuzzy Hash: 9c611ad478d6ccde5d924b9edb00a8b11240770c2436d842bb1004ea9d80d654
Instruction Fuzzy Hash: 8BD0C730500323DFC7208F32EA0864272E4AF0AB80B228C3AD8C2C2190F6B4E884CA16

Function 003E4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003E4D2E,?,003E4F4F,?,004A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 003E4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 003E4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 003E4D7B
kernel32.dll, xrefs: 003E4D6A

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 8a93492490731964fdaea838df733add2490f01fd8c066fb16886f786002f9e5
Instruction ID: 0120639a5d90686ea900fd3dd0b64598cf62f72b99b460fb93f829abcbed4b4f
Opcode Fuzzy Hash: 8a93492490731964fdaea838df733add2490f01fd8c066fb16886f786002f9e5
Instruction Fuzzy Hash: BBD0C230510323CFC7208F31EC0838276D8BF09391B21893AD4C2C26A0E6B4D880CA15

Function 003E4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003E4CE1,?), ref: 003E4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 003E4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 003E4DAE
kernel32.dll, xrefs: 003E4D9D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: ac30b51227dfb9a91b5e4dc7197d2fb593d5dd63ea8ccbbfefb0941ae5277f2c
Instruction ID: 000ff817eb089b8c4e2c0feee25378b06532f22fea39e1f5169c48e14d84685c
Opcode Fuzzy Hash: ac30b51227dfb9a91b5e4dc7197d2fb593d5dd63ea8ccbbfefb0941ae5277f2c
Instruction Fuzzy Hash: 22D01731550723CFDB209F32EC08B8676E4AF0A795B22893AD8C6D6590E7B4D884CA55

Function 00461072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,004612C1), ref: 00461080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00461092

Strings

advapi32.dll, xrefs: 0046107B
RegDeleteKeyExW, xrefs: 0046108C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 3aec20a2783f57c8cc6ab3154077c92b39a6f7065eba3ca12819504fe79fc995
Instruction ID: 9e82dfd907149e8a327d528032d723cbe858a2c489c4d3a8b4870465d295b5ef
Opcode Fuzzy Hash: 3aec20a2783f57c8cc6ab3154077c92b39a6f7065eba3ca12819504fe79fc995
Instruction Fuzzy Hash: AED08C30400312CFCB204B30E81865776E4EF05391B14CC3AE4C5C6660E7B8C8808646

Function 004593F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00459009,?,0046F910), ref: 00459403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00459415

Strings

kernel32.dll, xrefs: 004593FE
GetModuleHandleExW, xrefs: 0045940F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 503f91a5abdce24bb3751002797abbe89b2f277187f2ead7d815fa49c15e35dc
Instruction ID: 748b11e5aa56c56a4def1863c5ae1376c9effa322118b73e9974c0c72a3192f1
Opcode Fuzzy Hash: 503f91a5abdce24bb3751002797abbe89b2f277187f2ead7d815fa49c15e35dc
Instruction Fuzzy Hash: D5D0C230504323CFC7208F30E90824376D4AF02382B10C83BD8C1D6650E6B8CC88C655

Function 004376C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68affa20e0602ab32d49f732bc0ced93f2e6d9f6698e658cc5205158107049e7
Instruction ID: 151653e197f7b49fb2a3e188bc62c139ae08218638eefb5856de50e0abddc44f
Opcode Fuzzy Hash: 68affa20e0602ab32d49f732bc0ced93f2e6d9f6698e658cc5205158107049e7
Instruction Fuzzy Hash: CBC17CB4A04216EFDB24DF94C884AAEB7B5FF48314F10959AE845EB350D734ED81CB94

Function 0045E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0045E3D2
CharLowerBuffW.USER32(?,?), ref: 0045E415

Part of subcall function 0045DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0045DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0045E615
_memmove.LIBCMT ref: 0045E628

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 563a9bed5ca87b5c78913eed29b8da9c51bdd03dbda016f56c171eb64e6f7983
Instruction ID: b2ed8b6f56d48659430d6d2fe64dba3d19d295c06957020b36b5acbf9145a147
Opcode Fuzzy Hash: 563a9bed5ca87b5c78913eed29b8da9c51bdd03dbda016f56c171eb64e6f7983
Instruction Fuzzy Hash: ACC18E716083519FC714DF29C480A5ABBE4FF49318F04896EF8999B352D774EA0ACF86

Function 004583A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004583D8
CoUninitialize.OLE32 ref: 004583E3

Part of subcall function 0043DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0043DAC5

VariantInit.OLEAUT32(?), ref: 004583EE
VariantClear.OLEAUT32(?), ref: 004586BF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 7f9b62c294fbe016e6c0d1beaeaab8d3209fdebe27a1c1d851a5f3bb33f16b97
Instruction ID: a7fba1e1146f65102566a16ac51dc48ca80afdb0f29196747657f5f0c955e514
Opcode Fuzzy Hash: 7f9b62c294fbe016e6c0d1beaeaab8d3209fdebe27a1c1d851a5f3bb33f16b97
Instruction Fuzzy Hash: 26A145752047519FCB11EF15C481B2AB7E4BF88314F14455EF99AAB3A2DB34EC08CB4A

Function 00436DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00436E04
SysAllocString.OLEAUT32(00000000), ref: 00436EAD
VariantCopy.OLEAUT32 ref: 00436EDC
VariantClear.OLEAUT32(?), ref: 00436F03

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: a7a9b4409b65b0127ade7f1c6279732d360bffdfca72e8661aff3ff628204901
Instruction ID: 57d13a428608dfbd6e9a0222279510f5005b6da8cff89a37653b64f7f4667e71
Opcode Fuzzy Hash: a7a9b4409b65b0127ade7f1c6279732d360bffdfca72e8661aff3ff628204901
Instruction Fuzzy Hash: 6751DC74604302AADB349F66D495B3AB3F59F4C310F20E81FE595DB2D1DB7898419B0D

Function 00469A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0133DC58,?), ref: 00469AD2
ScreenToClient.USER32(00000002,00000002), ref: 00469B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00469B72

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 1e3f92c0522dab714b4ad5b96224b121e86be10d7f4782b85599f79c778491a4
Instruction ID: a572b29db8fd84353a74daa9eb66c37da0ab5a336e95a14a4b8b7be271f5fd4c
Opcode Fuzzy Hash: 1e3f92c0522dab714b4ad5b96224b121e86be10d7f4782b85599f79c778491a4
Instruction Fuzzy Hash: 2D513F34A00249EFCF10DF68D8809AE7BB9FB55760F14816AF8159B390E774AD41CB55

Function 00456CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00456CE4
WSAGetLastError.WSOCK32(00000000), ref: 00456CF4

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00456D58
WSAGetLastError.WSOCK32(00000000), ref: 00456D64

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: d04dddb1d3cebda5ede1986f134bee828fdfaca89bd9f42086879cd1795e9ecd
Instruction ID: c09af68fb7b02363f38d1b77275aa8842f3c7a78d88be626e71f5d1cfa8aa7c0
Opcode Fuzzy Hash: d04dddb1d3cebda5ede1986f134bee828fdfaca89bd9f42086879cd1795e9ecd
Instruction Fuzzy Hash: 5241D274740210AFEB21AF25DC86F3A77A8AF44B10F44856AFA599F3C3DB748C008B95

Function 0045672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0046F910), ref: 004567BA
_strlen.LIBCMT ref: 004567EC

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 86cb14710940eaa422714a33dfb451e697d03cc6e8bbfdd1a21fd4918ae02a4d
Instruction ID: 636fc8fabbe1ca8648be64c980edc0e2d365d7d82f9b05ea57a76612a42b8f4e
Opcode Fuzzy Hash: 86cb14710940eaa422714a33dfb451e697d03cc6e8bbfdd1a21fd4918ae02a4d
Instruction Fuzzy Hash: 9E41F531A00104ABCB15FB65DCC1FAEB3A8AF08314F55816AFC159B2D2DB34AD08CB59

Function 0044BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0044BB09
GetLastError.KERNEL32(?,00000000), ref: 0044BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0044BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0044BB80

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c41b6cb09e712f8b258bfebbe6206bc5788498f6ab843c509eadbbe0e0edaf00
Instruction ID: 2ec85f5856b6e0a108e7bee80ea18932d5b6eb455b6e09a43592cfd29fda987a
Opcode Fuzzy Hash: c41b6cb09e712f8b258bfebbe6206bc5788498f6ab843c509eadbbe0e0edaf00
Instruction Fuzzy Hash: FA411839200660DFDB11EF16C584A5DBBE5EF49310B19849AF84A9F7A2CB34FD01CB95

Function 00468AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00468B4D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 5286205939f1d57d3d4da82016474657e4dbf981e9b6ab1f5f4c36ba52c2d5d7
Instruction ID: 0c2fc8bd0c5632942095dff1e7a5de5ee7e146c0f2d478a221f62a009b6b7927
Opcode Fuzzy Hash: 5286205939f1d57d3d4da82016474657e4dbf981e9b6ab1f5f4c36ba52c2d5d7
Instruction Fuzzy Hash: F331C5B4600204BEEF209E58DC59FAA3764EB0A710F14471BFA51D63A1EE38B9409B5F

Function 0046ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0046AE1A
GetWindowRect.USER32(?,?), ref: 0046AE90
PtInRect.USER32(?,?,0046C304), ref: 0046AEA0
MessageBeep.USER32(00000000), ref: 0046AF11

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 8233d9abbec8a370e813ce71e6efc40a87754bdd36a09af954c2ecf9f81961dd
Instruction ID: 95f4c25d58b86b391cb5a5b29640bde3f81f596df9a3370a3c9fe42dac7ff4f8
Opcode Fuzzy Hash: 8233d9abbec8a370e813ce71e6efc40a87754bdd36a09af954c2ecf9f81961dd
Instruction Fuzzy Hash: 5C419D70640519DFCB11DF58D884AA97BF5FF49300F1980BAE814AB351E739A812CF9B

Function 00440FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00441037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00441053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 004410B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0044110B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2246ee1765880fe58ef7f78f2f3277b8d616534a6585e39b0e7a795fb8183744
Instruction ID: ced1a208f7edf6967447ff106a8b2dcda40cdf55da6fe150291f53600b805a90
Opcode Fuzzy Hash: 2246ee1765880fe58ef7f78f2f3277b8d616534a6585e39b0e7a795fb8183744
Instruction Fuzzy Hash: 46317C30E40688AEFF348B668C05BFBBBA9AB44310F04422BE58152AF1D37C4DC5875E

Function 00441121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00441176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00441192
PostMessageW.USER32(00000000,00000101,00000000), ref: 004411F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00441243

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 564f31bbec1a8840650a65b65c40e9f9e3d748fc7e5cf3b9f6f0de1e87c6dc80
Instruction ID: 14630770cbed06ba3ea5a5facb1f36b5fbdbb49335191c53c3b0c4b24dd278e0
Opcode Fuzzy Hash: 564f31bbec1a8840650a65b65c40e9f9e3d748fc7e5cf3b9f6f0de1e87c6dc80
Instruction Fuzzy Hash: 56312830A407186AFF208BA5CC097FBBBAAAB49314F04435FE681922F1D37C49D5975A

Function 00416415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041644B
__isleadbyte_l.LIBCMT ref: 00416479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 004164A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 004164DD

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 181be05d64815400cafe24bdc207a193a1b146a4941d80e6559e30f408963279
Instruction ID: acd9c06c1ae05bb47b5bfcfd98f6934173c898e5cd3fda490d66e240e8ef1b34
Opcode Fuzzy Hash: 181be05d64815400cafe24bdc207a193a1b146a4941d80e6559e30f408963279
Instruction Fuzzy Hash: 8231D031600256AFDB218F69CD44BFB7BA9FF41310F16406AE86487290E739E891DB9C

Function 00465175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00465189

Part of subcall function 0044387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00443897
Part of subcall function 0044387D: GetCurrentThreadId.KERNEL32 ref: 0044389E
Part of subcall function 0044387D: AttachThreadInput.USER32(00000000,?,004452A7), ref: 004438A5

GetCaretPos.USER32(?), ref: 0046519A
ClientToScreen.USER32(00000000,?), ref: 004651D5
GetForegroundWindow.USER32 ref: 004651DB

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a4126439dc2fcde420a764c729d021185e87e35387f096f29972f5c6ecbe6c74
Instruction ID: 1df0c1b9f16babbcc2ad4f9e05f720e5e926360dcc873d2e61200513b4d1a850
Opcode Fuzzy Hash: a4126439dc2fcde420a764c729d021185e87e35387f096f29972f5c6ecbe6c74
Instruction Fuzzy Hash: E4312FB2900118AFDB00EFA6CC45AEFB7F9EF98304F10416BE415E7241EA759E05CBA5

Function 0046C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

GetCursorPos.USER32(?), ref: 0046C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0041BBFB,?,?,?,?,?), ref: 0046C7D7
GetCursorPos.USER32(?), ref: 0046C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0041BBFB,?,?,?), ref: 0046C85E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 66f1a390fc7ec06550d74baf27ee04fee0186335688e689e57dc5836029588e7
Instruction ID: 6dab262fe827668cf79cde4e85f36d1e76557315066737c0978badb57ad8db6d
Opcode Fuzzy Hash: 66f1a390fc7ec06550d74baf27ee04fee0186335688e689e57dc5836029588e7
Instruction Fuzzy Hash: C831D135600118EFCB21DF58C898EFB7BBAEB09311F04806AF9458B2A1D3355D50DB6A

Function 00400BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00400BF2

Part of subcall function 003E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00447B20,?,?,00000000), ref: 003E5B8C
Part of subcall function 003E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00447B20,?,?,00000000,?,?), ref: 003E5BB0

_fprintf.LIBCMT ref: 00400C29
OutputDebugStringW.KERNEL32(?), ref: 00436331

Part of subcall function 00404CDA: _flsall.LIBCMT ref: 00404CF3

__setmode.LIBCMT ref: 00400C5E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: c1b3ead090b81079c20bb5668b1a8d9d305b49b03780d78e1f2af45a60a80b58
Instruction ID: cd48b340c06a34246379362f98a7521d7dbd3589e29216a19b8bf033ef07454c
Opcode Fuzzy Hash: c1b3ead090b81079c20bb5668b1a8d9d305b49b03780d78e1f2af45a60a80b58
Instruction Fuzzy Hash: 3C116AB29082047AEB0973B69C43ABE7B689F81324F14027FF204672D2DF381C42479D

Function 00438B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00438652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00438669
Part of subcall function 00438652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00438673
Part of subcall function 00438652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00438682
Part of subcall function 00438652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00438689
Part of subcall function 00438652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0043869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00438BEB
_memcmp.LIBCMT ref: 00438C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00438C44
HeapFree.KERNEL32(00000000), ref: 00438C4B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4cf53c130d844d7d60b149ecf17561ae1b5019899e52281eb4c231f9d61c7bf3
Instruction ID: 7e4ad3647abd0919460b3adaaed6178cd056e3a15c3f73ccfad99ddcd62644a2
Opcode Fuzzy Hash: 4cf53c130d844d7d60b149ecf17561ae1b5019899e52281eb4c231f9d61c7bf3
Instruction Fuzzy Hash: EB218971E01209ABCB10CFA4C955BEEF7B8EF48344F04506AE454A7240EB79AE0ACB64

Function 00451A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00451A97

Part of subcall function 00451B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00451B40
Part of subcall function 00451B21: InternetCloseHandle.WININET(00000000), ref: 00451BDD

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: dfdef7497a353d453b160c6cd3434a49110fc5a371075efaf1d3b9b5e1488c9d
Instruction ID: 997dea391fe54b53b210fef7c2b359498a98840037d080e2f48232253bdef2af
Opcode Fuzzy Hash: dfdef7497a353d453b160c6cd3434a49110fc5a371075efaf1d3b9b5e1488c9d
Instruction Fuzzy Hash: 3F21A435200605BFDB129F609C01FBBB7ADFF48702F14002BFD5196662EB75E8199799

Function 0043E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0043F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0043E1C4,?,?,?,0043EFB7,00000000,000000EF,00000119,?,?), ref: 0043F5BC
Part of subcall function 0043F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0043F5E2
Part of subcall function 0043F5AD: lstrcmpiW.KERNEL32(00000000,?,0043E1C4,?,?,?,0043EFB7,00000000,000000EF,00000119,?,?), ref: 0043F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0043EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0043E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0043E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0043EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0043E237

Strings

cdecl, xrefs: 0043E22E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 3b27ff550395d01d52a018d23d309527897c6f150438972bfc65edf92b4c72a5
Instruction ID: 4125307b1a0f713c861869b0d0bca6e351e5be321c4437db4bf5a7befa375b9c
Opcode Fuzzy Hash: 3b27ff550395d01d52a018d23d309527897c6f150438972bfc65edf92b4c72a5
Instruction Fuzzy Hash: 5311E136101341EFCB25AF65D805A7B77A8FF49350F40503BF806CB2A0EB7598509799

Function 00415332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00415351

Part of subcall function 0040594C: __FF_MSGBANNER.LIBCMT ref: 00405963
Part of subcall function 0040594C: __NMSG_WRITE.LIBCMT ref: 0040596A
Part of subcall function 0040594C: RtlAllocateHeap.NTDLL(01320000,00000000,00000001,00000000,?,?,?,00401013,?), ref: 0040598F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 47a47a774668fde2999b2f0ffbf17312d300ecdac0cb66de39ec14fc3dbebcca
Instruction ID: e42cabbd421078c665748dd91f753274c2928eab54bbbbc3ad8a7c9f7b2d4e95
Opcode Fuzzy Hash: 47a47a774668fde2999b2f0ffbf17312d300ecdac0cb66de39ec14fc3dbebcca
Instruction Fuzzy Hash: 2511C432504A19EECB212F71AC046DE3B989F903E4B20053FFD99E72D0DABD8981965D

Function 003E4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003E4560

Part of subcall function 003E410D: _memset.LIBCMT ref: 003E418D
Part of subcall function 003E410D: _wcscpy.LIBCMT ref: 003E41E1
Part of subcall function 003E410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003E41F1

KillTimer.USER32(?,00000001,?,?), ref: 003E45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 003E45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0041D6CE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: e374fe667be873bd96020a66bf43271f0fde9be11bb921552acdf388c3e6865f
Instruction ID: 708ef0c06a5d438d1299a8abe83f485ed111a999d55f0cd1797aa74bf3a16099
Opcode Fuzzy Hash: e374fe667be873bd96020a66bf43271f0fde9be11bb921552acdf388c3e6865f
Instruction Fuzzy Hash: 88210AB09047949FEB338B24DC45BE7BFEC9F06304F04009EE69E562C1C7B41A848B55

Function 004440B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 004440D1
_memset.LIBCMT ref: 004440F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00444144
CloseHandle.KERNEL32(00000000), ref: 0044414D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 13843c48ab2ab48a5e41205a7242adaff7c06d8f116077e1562d5a4f76b88281
Instruction ID: 669b43598be1bc81f9769d74ac9cb75403db37f6711604cd504e81d6e184ba37
Opcode Fuzzy Hash: 13843c48ab2ab48a5e41205a7242adaff7c06d8f116077e1562d5a4f76b88281
Instruction Fuzzy Hash: 2911C1759012287AE7305B65AC4DFEBBB7CEF45760F1041A6F904D7180D6744F84CBA9

Function 0045667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00447B20,?,?,00000000), ref: 003E5B8C
Part of subcall function 003E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00447B20,?,?,00000000,?,?), ref: 003E5BB0

gethostbyname.WSOCK32(?), ref: 004566AC
WSAGetLastError.WSOCK32(00000000), ref: 004566B7
_memmove.LIBCMT ref: 004566E4
inet_ntoa.WSOCK32(?), ref: 004566EF

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 4235bf786a8360a0eee7a3a754d86f5f4127b01528a7d1e0d73ad34c76946f44
Instruction ID: 8d669fa0ba068f35c25e700e3f76c7868da721fdda423795d0b6583c4a375cf0
Opcode Fuzzy Hash: 4235bf786a8360a0eee7a3a754d86f5f4127b01528a7d1e0d73ad34c76946f44
Instruction Fuzzy Hash: 95119335500109AFCB01FBA1DD86DEE77B8AF44314B14417AF902AB2A2EF709E08CB65

Function 00439023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00439043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00439055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0043906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00439086

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f471c0938224c04959963d75eeb4c5d76b9c9635cc48f071b3aff3b9b5617a46
Instruction ID: fe199db445de6d8a883660bc2700975295ee5152d1372d091c1395e157374923
Opcode Fuzzy Hash: f471c0938224c04959963d75eeb4c5d76b9c9635cc48f071b3aff3b9b5617a46
Instruction Fuzzy Hash: 20115E79900218FFDB10DFA5CC84E9EBBB4FB48310F2040A6EA04B7250D6716E11DB94

Function 003E1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 003E2612: GetWindowLongW.USER32(?,000000EB), ref: 003E2623

DefDlgProcW.USER32(?,00000020,?), ref: 003E12D8
GetClientRect.USER32(?,?), ref: 0041B84B
GetCursorPos.USER32(?), ref: 0041B855
ScreenToClient.USER32(?,?), ref: 0041B860

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 17b16a4620decb1bb2e7e236f7a2cdaa94ca7958a3b35379fb08b91c5362c9c4
Instruction ID: 6a7dc935c5930ff06f5d6a121ce9653eaeb6720ea2783c9b138a87fdcc1c55bc
Opcode Fuzzy Hash: 17b16a4620decb1bb2e7e236f7a2cdaa94ca7958a3b35379fb08b91c5362c9c4
Instruction Fuzzy Hash: D3115835900069EBCB11EF95DC859EE77B8FB05300F000966FA51EB281D771AA558BAA

Function 00441652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,004401FD,?,00441250,?,00008000), ref: 0044166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,004401FD,?,00441250,?,00008000), ref: 00441694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,004401FD,?,00441250,?,00008000), ref: 0044169E
Sleep.KERNEL32(?,?,?,?,?,?,?,004401FD,?,00441250,?,00008000), ref: 004416D1

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 555b1616d7339745d1909f2e4f73368fc09b65ea41009ba9a542b5a5326e76af
Instruction ID: eef257767745d142e37fac274fba08fa4b36ac33333f02145f1477044a219c9e
Opcode Fuzzy Hash: 555b1616d7339745d1909f2e4f73368fc09b65ea41009ba9a542b5a5326e76af
Instruction Fuzzy Hash: 58115231C0151DD7DF009FA5E944AEEBB78FF09751F064066D940B6250DB7495908BDA

Function 00417207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0041722B

Part of subcall function 00417912: __fltout2.LIBCMT ref: 0041793B

__cftog_l.LIBCMT ref: 00417251
__cftoe_l.LIBCMT ref: 00417283

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 52fd84aeaf2c8cbaa96a7fa24e91f7dcb5fdfb95aac6fc1c37078efa1f418b45
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 49018C7208814ABBCF125F84DC018EE3F72BF29354B188656FA1858131C33BC9B2AB85

Function 0046B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0046B59E
ScreenToClient.USER32(?,?), ref: 0046B5B6
ScreenToClient.USER32(?,?), ref: 0046B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0046B5F5

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 50e345185d813028755c082d5a271f67ef9bd2a4a9f6ea7390d82863347f347a
Instruction ID: 5c472e7544efe703fdec4f305d0fc94c69feeea87d94a2f07ec5969a4332e339
Opcode Fuzzy Hash: 50e345185d813028755c082d5a271f67ef9bd2a4a9f6ea7390d82863347f347a
Instruction Fuzzy Hash: D11196B5D00209EFDB01CF98D444AEEFBB8FB08310F004066E954E3220E775AA558F95

Function 0046B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0046B8FE
_memset.LIBCMT ref: 0046B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,004A7F20,004A7F64), ref: 0046B93C
CloseHandle.KERNEL32 ref: 0046B94E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 8a2f908cbd80748ac3dd56eea5d993d0259d89df6bd5a8fc14b003e39cd18053
Instruction ID: e9cebf43eaf9437873a0717b96e664a654dc0bd5971f2994b502e6ef1b7883da
Opcode Fuzzy Hash: 8a2f908cbd80748ac3dd56eea5d993d0259d89df6bd5a8fc14b003e39cd18053
Instruction Fuzzy Hash: ECF05EB25443007FE2206B61AC45FBB3E5CEB0A358F004032FB08E9292E7795E1087AD

Function 00446E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00446E88

Part of subcall function 0044794E: _memset.LIBCMT ref: 00447983

_memmove.LIBCMT ref: 00446EAB
_memset.LIBCMT ref: 00446EB8
LeaveCriticalSection.KERNEL32(?), ref: 00446EC8

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 4dc5fcb26e07cc9d034a1637e4a6e8766f99956de57c63bc72ac9dcd687c8671
Instruction ID: 4c36370f5da1eda86d37e07c2cd5a2edc90945f8b51d5a4824d397cdf3a842bc
Opcode Fuzzy Hash: 4dc5fcb26e07cc9d034a1637e4a6e8766f99956de57c63bc72ac9dcd687c8671
Instruction Fuzzy Hash: 93F0547A204200ABDF016F55EC85A49BB29EF45324B048065FE085E26AC775A915CBB9

Function 0046C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 003E12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 003E134D
Part of subcall function 003E12F3: SelectObject.GDI32(?,00000000), ref: 003E135C
Part of subcall function 003E12F3: BeginPath.GDI32(?), ref: 003E1373
Part of subcall function 003E12F3: SelectObject.GDI32(?,00000000), ref: 003E139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0046C030
LineTo.GDI32(00000000,?,?), ref: 0046C03D
EndPath.GDI32(00000000), ref: 0046C04D
StrokePath.GDI32(00000000), ref: 0046C05B

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 25c61e8ec0b60c88a66fbb4fb17ad4d9add298e1a1dd39106331ad9b50540c1b
Instruction ID: f97746a3524d325f1338cb76bb0c2a5c568b0a9d8a92f37180241439a7859413
Opcode Fuzzy Hash: 25c61e8ec0b60c88a66fbb4fb17ad4d9add298e1a1dd39106331ad9b50540c1b
Instruction Fuzzy Hash: 45F0BE31006269BBDB122F91AC09FDE3F58AF06310F048021FA51210E297B90954CBAE

Function 0043A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0043A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0043A3AC
GetCurrentThreadId.KERNEL32 ref: 0043A3B3
AttachThreadInput.USER32(00000000), ref: 0043A3BA

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 265e1ccc4898c99168db9578a278d1d6f1990e2d1a4d62a8edc761058079fd5a
Instruction ID: 9ce06928b0e597fdb421a9e3b8f380b03f824559ec0d3083d2b388424e9b3a21
Opcode Fuzzy Hash: 265e1ccc4898c99168db9578a278d1d6f1990e2d1a4d62a8edc761058079fd5a
Instruction Fuzzy Hash: ADE03931281228BADB201BA2EC0CED73F1CEF1A7A1F009035F98884060D6B58955CBAA

Function 003E2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 003E2231
SetTextColor.GDI32(?,000000FF), ref: 003E223B
SetBkMode.GDI32(?,00000001), ref: 003E2250
GetStockObject.GDI32(00000005), ref: 003E2258
GetWindowDC.USER32(?,00000000), ref: 0041C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0041C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0041C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0041C112
GetPixel.GDI32(00000000,?,?), ref: 0041C132
ReleaseDC.USER32(?,00000000), ref: 0041C13D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 1886ba374d5b3b523c5f20636308dbb09fe7f6ae5b578eaf6eceae90987e2678
Instruction ID: 34aee3364a06402f5ff3abc004446d9908c2dc37cfceea9707713154654d60ed
Opcode Fuzzy Hash: 1886ba374d5b3b523c5f20636308dbb09fe7f6ae5b578eaf6eceae90987e2678
Instruction Fuzzy Hash: DDE03932544244EADB215FA4FC497D93B14AB06336F008376FAA9880E297B14984DB16

Function 00438C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00438C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0043882E), ref: 00438C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0043882E), ref: 00438C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0043882E), ref: 00438C7E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 39562fb5a9776a20f0c5b50593ff358288d59ab722ce469a49a143b0423fdc8e
Instruction ID: c7b4721d8e4b1abb82e872119995e1c3718e9f13c4e98d1478dd7c7401dad59f
Opcode Fuzzy Hash: 39562fb5a9776a20f0c5b50593ff358288d59ab722ce469a49a143b0423fdc8e
Instruction Fuzzy Hash: 99E04F36646311ABE7205FB07D0CB577BA8AF54792F145838F685C9040EA7584498B66

Function 00422187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00422187
GetDC.USER32(00000000), ref: 00422191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004221B1
ReleaseDC.USER32(?), ref: 004221D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3025251f9c4d61f66757aed89dbcd162a60c17e046683d5ddff9a9a5adaae185
Instruction ID: 2b07711d5468d52c13f4836e9e8a3290b27719519cf82e1189d40395733b8615
Opcode Fuzzy Hash: 3025251f9c4d61f66757aed89dbcd162a60c17e046683d5ddff9a9a5adaae185
Instruction Fuzzy Hash: A6E01AB5800214EFDB019FA1E808AAD7BF5FF4C351F108436F99A97260EBB88146DF46

Function 0042219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0042219B
GetDC.USER32(00000000), ref: 004221A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 004221B1
ReleaseDC.USER32(?), ref: 004221D2

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3f8c287cd944f144877a3c1b6268cfc8f9a7108eeddf5f1265945ffe5b56221d
Instruction ID: fb7676f16b48ebf7d8ba48a3343f81f04de0268afcfbb7c5ba0ce4e9dd93d04a
Opcode Fuzzy Hash: 3f8c287cd944f144877a3c1b6268cfc8f9a7108eeddf5f1265945ffe5b56221d
Instruction Fuzzy Hash: 4BE01AB5800214AFCB019FB1E80869D7BF5FF4C351F108035F99A97260EBB891469F45

Function 003E63A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%G, xrefs: 003E63AE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID:
String ID: %G
API String ID: 0-3833237576
Opcode ID: cd21a3e7b16ed02df3bdbe00fde1744cb702e6ef393d02e04d8dac1f72ccd296
Instruction ID: 0930fdb2609ba374e4555b2ad77810b449b895c4b8d7c6881a56145667050c83
Opcode Fuzzy Hash: cd21a3e7b16ed02df3bdbe00fde1744cb702e6ef393d02e04d8dac1f72ccd296
Instruction Fuzzy Hash: F1B1E771D001A99BCF26EF96C8829FDB7B8FF64390F104226E902A71D5DB349D82CB55

Function 0045B1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0045B2C3

Strings

xrJ, xrefs: 0045B325
xrJ, xrefs: 0045B2F9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __itow_s
String ID: xrJ$xrJ
API String ID: 3653519197-3908050795
Opcode ID: b861601fa7b7b763bace2ac1c00048e6b7ce1cdc257e4cd3ff638dccd70c5f05
Instruction ID: ec1cf65e12284b6f358d30b0bc8640f59b96cec387ba0ae5fd1650497251e8fa
Opcode Fuzzy Hash: b861601fa7b7b763bace2ac1c00048e6b7ce1cdc257e4cd3ff638dccd70c5f05
Instruction Fuzzy Hash: 5DB1A270A00109AFDB24DF55C880EAEB7B9FF58305F14819AFD459B392EB34E945CBA4

Function 0044B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 003FFEC6: _wcscpy.LIBCMT ref: 003FFEE9

Part of subcall function 003E9997: __itow.LIBCMT ref: 003E99C2
Part of subcall function 003E9997: __swprintf.LIBCMT ref: 003E9A0C

__wcsnicmp.LIBCMT ref: 0044B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0044B361

Strings

LPT, xrefs: 0044B292

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 511f56dc67728d2263f88678f8eb697b133850cd68a98b96967119bfa5e4410d
Instruction ID: f337de936fe7e71116f6433403ff45f71e707a79a166667a1ce6f6cca4274df0
Opcode Fuzzy Hash: 511f56dc67728d2263f88678f8eb697b133850cd68a98b96967119bfa5e4410d
Instruction Fuzzy Hash: FD61D075A00215AFDB04DF95C881EAEB7B8EF08310F10406BF846AB391DB74EE40CB95

Function 00428A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00428B1E
_memmove.LIBCMT ref: 00428B78

Strings

Oa?, xrefs: 00428BF2, 0042E39A, 0042E3B6

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _memmove
String ID: Oa?
API String ID: 4104443479-1309107252
Opcode ID: 421a971b5ac38c8cf187119665b649a55316ea74c86bef0efa8ab79bfcad4584
Instruction ID: b092575c2bc684bb5dd76fd2191fdb78d01371e95f95a5074e45119197102f2c
Opcode Fuzzy Hash: 421a971b5ac38c8cf187119665b649a55316ea74c86bef0efa8ab79bfcad4584
Instruction Fuzzy Hash: F1518DB0A01619DFCB24CFA9D480AAEBBF1FF44304F54852EE85AD7340EB34A955CB55

Function 003F2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 003F2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 003F2AE1

Strings

@, xrefs: 003F2AD5

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: fbca0a7033f5ea91168d39aae0cc472452dd85bce5c98f042a9a030447e1a999
Instruction ID: a4fdc3d4d39516816b8ad99837ae680af17418116a9e6550383566b2d13eeb03
Opcode Fuzzy Hash: fbca0a7033f5ea91168d39aae0cc472452dd85bce5c98f042a9a030447e1a999
Instruction Fuzzy Hash: 34517DB14187959BD321AF11DC85BAFB7F8FF84310F82495DF1D9450A1DB309929CB26

Function 004499BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 003E506B: __fread_nolock.LIBCMT ref: 003E5089

_wcscmp.LIBCMT ref: 00449AAE
_wcscmp.LIBCMT ref: 00449AC1

Strings

FILE, xrefs: 004499FA

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 96c2836fc65b8a4720d93e8a721598131df180259d4efabe05a7a96e062d799c
Instruction ID: bd6a042a4199c24635a10e8f2e2a79197aa98401b57a623a18352fb1b12f9e7d
Opcode Fuzzy Hash: 96c2836fc65b8a4720d93e8a721598131df180259d4efabe05a7a96e062d799c
Instruction Fuzzy Hash: AD411871A00659BAEF219EA1CC45FEFBBBDEF45714F00007AB900BB1C0C679AE0487A5

Function 0042099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004209A9

Strings

DtJ, xrefs: 003EA2B1
DtJ, xrefs: 003EA477

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClearVariant
String ID: DtJ$DtJ
API String ID: 1473721057-708937762
Opcode ID: 9c5df1f7e984bc7c51ba53a31d676f0eda763f44b89d98e43b5ece8d202f8645
Instruction ID: 437cf6684fbf5a1836fb7a636cf35543c0f0e5f878801cb27c6bf70dcf399fce
Opcode Fuzzy Hash: 9c5df1f7e984bc7c51ba53a31d676f0eda763f44b89d98e43b5ece8d202f8645
Instruction Fuzzy Hash: 985125786087918FC761CF1AC480A1ABBE1BF99344F55896DF9818B3A1D731EC81CF46

Function 00452882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00452892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 004528C8

Strings

|, xrefs: 00452899

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: a82d7f932d9e9c7ac85fa00d913b52fe010b47d50fd648887404ee356956ad90
Instruction ID: c78353b929bfa91f4c25c63eab6e6e1000688ba1ffe03b9f0c54712306f94913
Opcode Fuzzy Hash: a82d7f932d9e9c7ac85fa00d913b52fe010b47d50fd648887404ee356956ad90
Instruction Fuzzy Hash: 8A315071900119AFCF01DFA1CC85EEEBFB8FF19300F10012AF815AA266DB755916DBA0

Function 00466CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00466D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00466DC2

Strings

static, xrefs: 00466D22

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 0bdd897ed2cd5d13ee4f692a9633c15c94cca045afb79c1ff5e1291cb9a54bd1
Instruction ID: daf2110063c361138f4401905618f1128432b7abd1ea17e8ec6f65ff84a1c2b1
Opcode Fuzzy Hash: 0bdd897ed2cd5d13ee4f692a9633c15c94cca045afb79c1ff5e1291cb9a54bd1
Instruction Fuzzy Hash: AA31A171200604AEDB109F64DC40BFB77B8FF48724F11962EF899C7190EA35AC91CB69

Function 00442D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00442E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00442E3B

Strings

0, xrefs: 00442DF9

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 79e7579e2e425db42a2b10e359ed317b7f08cefe858d55a2ff4f40f9050c8271
Instruction ID: 9b03d5b72ee52ad8793622c89dde918b4d4b5fd8aec76904c0e3d155dd5ad567
Opcode Fuzzy Hash: 79e7579e2e425db42a2b10e359ed317b7f08cefe858d55a2ff4f40f9050c8271
Instruction Fuzzy Hash: 6231E831500305ABFB248F54CA4579FBBB9EF05340F64006FF985A72A0D7F89944CB19

Function 00466943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004669D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004669DB

Strings

Combobox, xrefs: 0046699D

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 3e229b31e07fe41adaf21cda13e7cc02614cbcf72d6f00c9bca28b77b02f52e5
Instruction ID: de76b7be5ce79a268f4b28a6dd29c9570b769d047d15fbf6ae55dfda6385662a
Opcode Fuzzy Hash: 3e229b31e07fe41adaf21cda13e7cc02614cbcf72d6f00c9bca28b77b02f52e5
Instruction Fuzzy Hash: 9311B6B16002086FEF119E24DC80EBB3B6EEB953A4F12012AFD5897390E6799C5587A5

Function 00466E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 003E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 003E1D73
Part of subcall function 003E1D35: GetStockObject.GDI32(00000011), ref: 003E1D87
Part of subcall function 003E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 003E1D91

GetWindowRect.USER32(00000000,?), ref: 00466EE0
GetSysColor.USER32(00000012), ref: 00466EFA

Strings

static, xrefs: 00466EBD

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 5ebd84fda1fe2b02048c4292d5f66d8467010533a61e63243319e68f77fad585
Instruction ID: 3dcb1e41cac5083772ee23e4aee3014ef010eae4405763b2686f0d54a2669f80
Opcode Fuzzy Hash: 5ebd84fda1fe2b02048c4292d5f66d8467010533a61e63243319e68f77fad585
Instruction Fuzzy Hash: 9D21977261020AAFDB04DFA8DC45AFA7BB8FB08304F01462AFD55D3240E738E861DB65

Function 00466B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00466C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00466C20

Strings

edit, xrefs: 00466BF5

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: c1c052a75ef0fe2d948b2756a11a1a49e879a647fa9c660d1fb938fbfaf89544
Instruction ID: 8858dc1edde249423970d4b70fb8d3a7b46eb86516233ec6cba877c1828c83bd
Opcode Fuzzy Hash: c1c052a75ef0fe2d948b2756a11a1a49e879a647fa9c660d1fb938fbfaf89544
Instruction Fuzzy Hash: 80119D71100118ABEB104F64DC41AAB3769EB05368F214726F961D72E0E679EC919B6A

Function 00442E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00442F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00442F30

Strings

0, xrefs: 00442F07

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e6c58e7e973ed7344b0b64e7e21919ecdeb375d69aaca34805eb12c929eb9d72
Instruction ID: 9db3b7d318b3a05f9a01a09d024fa0b82fa3b97f8c87103880dfb074d34d17fb
Opcode Fuzzy Hash: e6c58e7e973ed7344b0b64e7e21919ecdeb375d69aaca34805eb12c929eb9d72
Instruction Fuzzy Hash: 2E110631901114ABEB20DF98DD05B9A77B9EB12300F9900B7F850A73A0DBF8AD08979D

Function 004524CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00452520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00452549

Strings

<local>, xrefs: 00452511

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: e479835f6f8b96183f454c11c070d4af076f0f3479feee35649ecfc80ee4dfd8
Instruction ID: 4318d44b228df1366e0195047740088bb4ad9357a05283d61c62106e0fbf03b4
Opcode Fuzzy Hash: e479835f6f8b96183f454c11c070d4af076f0f3479feee35649ecfc80ee4dfd8
Instruction Fuzzy Hash: 8211E370100229BADB248F518D94EBBFF68FB07352F10812BFD4552141E2B46949D6E5

Function 004580A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0045830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,004580C8,?,00000000,?,?), ref: 00458322

inet_addr.WSOCK32(00000000), ref: 004580CB
htons.WSOCK32(00000000), ref: 00458108

Strings

255.255.255.255, xrefs: 004580E3

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: a219a61bc76a994a1400f00448bff632fa531f9fe11e138eaa66ff3cc2bcea26
Instruction ID: 79e201397160042fce584cdeaafd62871d157c2429e23cc3966e5a4f5171eb48
Opcode Fuzzy Hash: a219a61bc76a994a1400f00448bff632fa531f9fe11e138eaa66ff3cc2bcea26
Instruction Fuzzy Hash: F011C234200205ABDB10AF64CC46BBEB324FF04325F10852BED11A72D2DE76A819879A

Function 003F0A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,003E3C26,004A62F8,?,?,?), ref: 003F0ACE

Part of subcall function 003E7D2C: _memmove.LIBCMT ref: 003E7D66

_wcscat.LIBCMT ref: 004250E1

Strings

cJ, xrefs: 003F0B0E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: cJ
API String ID: 257928180-1021838454
Opcode ID: 2394e2cc8c3e9f1932c2e970460a47285c9aa8aab803d8e9637dfc881deb1fbb
Instruction ID: da4cb6c3470a33874ed1bcda003a01fc9c762cc26693e1e52952592cbf90eee8
Opcode Fuzzy Hash: 2394e2cc8c3e9f1932c2e970460a47285c9aa8aab803d8e9637dfc881deb1fbb
Instruction Fuzzy Hash: 1D11CC30A0421D9BCB06EBA4DD01EED77F8EF08344B0141A6BE48D7291EA74DF894755

Function 004392E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00439355

Strings

ComboBox, xrefs: 004392F4
ListBox, xrefs: 0043931F

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b44665478094e354165c87c2299bac9afc648484f8f6e4ed4dd2e183709ed1a9
Instruction ID: 42e064e08ef81e5acdc5ffdc989d5c0a56c5f6cbc0e481d05821129532c5fdba
Opcode Fuzzy Hash: b44665478094e354165c87c2299bac9afc648484f8f6e4ed4dd2e183709ed1a9
Instruction Fuzzy Hash: 8B01D271A05228AB8B05EBA5CC919FE7769FF4A320B10172AF9325B2D1EA755C088654

Function 004391DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0043924D

Strings

ComboBox, xrefs: 004391EC
ListBox, xrefs: 00439217

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 59609cd99a4545a5bea2a5d1bf2c09081b81de20bdc5ef5b2d4106e9a50d4f02
Instruction ID: 363cdae8ebc062dc360aa02c79b2730204e70ab69edc06709c3fda7f38841c66
Opcode Fuzzy Hash: 59609cd99a4545a5bea2a5d1bf2c09081b81de20bdc5ef5b2d4106e9a50d4f02
Instruction Fuzzy Hash: 42012071A4510877CF05E7A1C892EFF77ACDF49300F24116EB512672C1EA585F0C86B5

Function 00439264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003E7F41: _memmove.LIBCMT ref: 003E7F82

Part of subcall function 0043B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0043B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 004392D0

Strings

ComboBox, xrefs: 00439271
ListBox, xrefs: 0043929C

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: d9f71b778caeb2d8e16cbf9ff37255017d835e9d1803be85afa210e3569bd7e3
Instruction ID: c94932670a1959280d03bd2be7ef122093279094dba329e9c56fa62669572bc8
Opcode Fuzzy Hash: d9f71b778caeb2d8e16cbf9ff37255017d835e9d1803be85afa210e3569bd7e3
Instruction Fuzzy Hash: 6F012B71A4511877CF06E7A5C882EFF77AC9F09300F24116AB912672C1DA595F0C827A

Function 00406DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00406DD0
__calloc_crt.LIBCMT ref: 00406DE9

Strings

@RJ, xrefs: 00406E00

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: __calloc_crt
String ID: @RJ
API String ID: 3494438863-2438972298
Opcode ID: 7d990fab7a72f6e2428d34bfe4108cebb6fd98d07d72de9eb1d6e851ccedfafa
Instruction ID: 564ac91d4bb9f815dc090390066d635174e3732a9aad94fb4f6acebaa965df1b
Opcode Fuzzy Hash: 7d990fab7a72f6e2428d34bfe4108cebb6fd98d07d72de9eb1d6e851ccedfafa
Instruction Fuzzy Hash: EEF0C8723043139BF724DF15FD057922B95EF41334B16407FE502EA2D0EB388891568C

Function 004451CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 004451E8
_wcscmp.LIBCMT ref: 004451FA

Strings

#32770, xrefs: 004451F4

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: f564ac5285381c7e7754faa533a6fbb95e795af6a32765992fb0b5dc5a78458b
Instruction ID: 5a1a4547e582f751c8df46bcdebc13b7c1f09ac3739b86fea098c5525bb46ea7
Opcode Fuzzy Hash: f564ac5285381c7e7754faa533a6fbb95e795af6a32765992fb0b5dc5a78458b
Instruction Fuzzy Hash: 39E0613290432C27E7209B95AC05F97FBACEB41771F00007BFD10D3140E57499048BE5

Function 004381BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 004381CA

Part of subcall function 00403598: _doexit.LIBCMT ref: 004035A2

Strings

Error allocating memory., xrefs: 004381C3
AutoIt, xrefs: 004381BE

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: e26a2ce4ed6486b5c2ceee5f4259e1768c944eb06a3970175152c457454aaeeb
Instruction ID: e79a4324c4f6834db310a7a5507a760ac5b8320601ffab854b06d93ea18e4fe1
Opcode Fuzzy Hash: e26a2ce4ed6486b5c2ceee5f4259e1768c944eb06a3970175152c457454aaeeb
Instruction Fuzzy Hash: F7D05B323C535836D61532FA6D07FC67A484B09B56F10403BFB48655E38DE9599242DD

Function 0041B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0041B564: _memset.LIBCMT ref: 0041B571

Part of subcall function 00400B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0041B540,?,?,?,003E100A), ref: 00400B89

IsDebuggerPresent.KERNEL32(?,?,?,003E100A), ref: 0041B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,003E100A), ref: 0041B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0041B54E

Memory Dump Source

Source File: 00000000.00000002.1639207514.00000000003E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000000.00000002.1639192894.00000000003E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.000000000046F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639249914.0000000000495000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639286418.000000000049F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1639301369.00000000004A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3e0000_roger.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 0e209df8cbadb8f59e55d2828f1478823a0d8b9dfcee355430e05389fe9f78dc
Instruction ID: 9d9589162701e7d4a87a2ca52f5b78697d0fe2d0a1e2907d71e8ded57576bb18
Opcode Fuzzy Hash: 0e209df8cbadb8f59e55d2828f1478823a0d8b9dfcee355430e05389fe9f78dc
Instruction Fuzzy Hash: 56E06D742003518BD321EF69E5043867BE0EB04748F048D7EE886C2750E7F8E488CBA9

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report roger.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Maianthemum

C:\Users\user\AppData\Local\Temp\autBE4A.tmp

C:\Users\user\AppData\Local\Temp\autBE89.tmp

C:\Users\user\AppData\Local\Temp\inhumation

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
roger.exe

Function 003E3B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 003E4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 003E4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 004493DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 003E3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75
windowregistryCOMMON

Function 003E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 003E71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 003E3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 003E3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 003E3778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 003EF8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 021225F0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 003E39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 021223B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
fileCOMMON

Function 003E410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre