Edit tour

Windows Analysis Report
42.exe

Overview

General Information

Sample name:	42.exe
Analysis ID:	1466691
MD5:	cb5a596f6ae023f22312ac155b442817
SHA1:	3bbc4dcd644056c062dc4f3e9bdb0ac93dd372ab
SHA256:	03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

42.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\42.exe" MD5: CB5A596F6AE023F22312AC155B442817)

RegSvcs.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\42.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.funworld.co.id", "Username": "elly_k@funworld.co.id", "Password": "fwp123mail          "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4081635789.00000000028E9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33527:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33599:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33623:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33791:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33827:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: 42.exe PID: 7412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 42.exe PID: 7412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7428	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.42.exe.1db0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.42.exe.1db0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.42.exe.1db0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33527:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33599:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33623:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33791:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33827:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.42.exe.1db0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.42.exe.1db0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.42.exe.1db0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31727:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31799:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31823:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3191f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31991:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a27:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31ab7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33527:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33599:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33623:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33791:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33827:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 180.235.148.163, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7428, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.funworld.co.id", "Username": "elly_k@funworld.co.id", "Password": "fwp123mail "}

Multi AV Scanner detection for submitted file

Source: 42.exe	ReversingLabs: Detection: 42%
Source: 42.exe	Virustotal: Detection: 33%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 42.exe

Joe Sandbox ML: detected

Source: 42.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: 42.exe, 00000000.00000003.1630876537.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, 42.exe, 00000000.00000003.1631654014.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 42.exe, 00000000.00000003.1630876537.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, 42.exe, 00000000.00000003.1631654014.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F84696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F84696
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F8C9C7
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8C93C FindFirstFileW,FindClose,	0_2_00F8C93C
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F8F200
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F8F35D
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F8F65E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F83A2B
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F83D4E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F8BF27

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 180.235.148.163:587

Source: Joe Sandbox View

IP Address: 180.235.148.163 180.235.148.163

Source: Joe Sandbox View

ASN Name: ARDH-AS-IDARDHGLOBALINDONESIAPTID ARDH-AS-IDARDHGLOBALINDONESIAPTID

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 180.235.148.163:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00F925E2

Source: global traffic

DNS traffic detected: DNS query: mail.funworld.co.id

Source: RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://funworld.co.id
Source: RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.funworld.co.id
Source: RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 42.exe, 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.42.exe.1db0000.1.raw.unpack, n00.cs

.Net Code: ueuwncg0Y

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F9425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00F9425A

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F94458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00F94458

Source: C:\Users\user\Desktop\42.exe

0_2_00F9425A

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F80219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00F80219

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00FACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FACDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.42.exe.1db0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.42.exe.1db0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\42.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00F23B4C
Source: 42.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 42.exe, 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_44b5fac4-2
Source: 42.exe, 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5f350d91-5
Source: 42.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f34f878c-7
Source: 42.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c5d8dfce-e

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F840B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00F840B1

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F78858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F78858

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F8545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00F8545F

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F2E800	0_2_00F2E800
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4DBB5	0_2_00F4DBB5
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F2E060	0_2_00F2E060
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00FA804A	0_2_00FA804A
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F34140	0_2_00F34140
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F42405	0_2_00F42405
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F56522	0_2_00F56522
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F5267E	0_2_00F5267E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00FA0665	0_2_00FA0665
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F36843	0_2_00F36843
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4283A	0_2_00F4283A
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F589DF	0_2_00F589DF
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00FA0AE2	0_2_00FA0AE2
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F56A94	0_2_00F56A94
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F38A0E	0_2_00F38A0E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F88B13	0_2_00F88B13
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F7EB07	0_2_00F7EB07
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4CD61	0_2_00F4CD61
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F57006	0_2_00F57006
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F33190	0_2_00F33190
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F3710E	0_2_00F3710E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F21287	0_2_00F21287
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F433C7	0_2_00F433C7
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4F419	0_2_00F4F419
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F416C4	0_2_00F416C4
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F35680	0_2_00F35680
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F478D3	0_2_00F478D3
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F358C0	0_2_00F358C0
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F41BB8	0_2_00F41BB8
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F59D05	0_2_00F59D05
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F2FE40	0_2_00F2FE40
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4BFE6	0_2_00F4BFE6
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F41FD0	0_2_00F41FD0
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_01DA3630	0_2_01DA3630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D9C66F	1_2_00D9C66F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D94AA0	1_2_00D94AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D93E88	1_2_00D93E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D9CE80	1_2_00D9CE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D941D0	1_2_00D941D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00D99BEB	1_2_00D99BEB

Source: C:\Users\user\Desktop\42.exe	Code function: String function: 00F48B40 appears 42 times
Source: C:\Users\user\Desktop\42.exe	Code function: String function: 00F40D27 appears 70 times
Source: C:\Users\user\Desktop\42.exe	Code function: String function: 00F27F41 appears 35 times

Source: 42.exe, 00000000.00000003.1631654014.0000000003E0D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 42.exe
Source: 42.exe, 00000000.00000003.1629947135.0000000003C63000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 42.exe
Source: 42.exe, 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb252bcf1-5281-48d2-8f88-ade6e346ac49.exe4 vs 42.exe

Source: 42.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.42.exe.1db0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.42.exe.1db0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.42.exe.1db0000.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, NpXw3kw.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.42.exe.1db0000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, gyfrCFT5x9I.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.42.exe.1db0000.1.raw.unpack, fpnV0Qjz.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@1/1

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F8A2D5 GetLastError,FormatMessageW,

0_2_00F8A2D5

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F78713 AdjustTokenPrivileges,CloseHandle,		0_2_00F78713
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F78CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F78CC3

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F8B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00F8B59E

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F9F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00F9F121

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F986D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00F986D0

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F24FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F24FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\42.exe

File created: C:\Users\user\AppData\Local\Temp\aut2C63.tmp

Jump to behavior

Source: 42.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 42.exe	ReversingLabs: Detection: 42%
Source: 42.exe	Virustotal: Detection: 33%

Source: unknown	Process created: C:\Users\user\Desktop\42.exe "C:\Users\user\Desktop\42.exe"
Source: C:\Users\user\Desktop\42.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\42.exe"
Source: C:\Users\user\Desktop\42.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\42.exe"	Jump to behavior

Source: C:\Users\user\Desktop\42.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 42.exe

Static file information: File size 1112064 > 1048576

Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 42.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 42.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: 42.exe, 00000000.00000003.1630876537.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, 42.exe, 00000000.00000003.1631654014.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 42.exe, 00000000.00000003.1630876537.0000000003B40000.00000004.00001000.00020000.00000000.sdmp, 42.exe, 00000000.00000003.1631654014.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp

Source: 42.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 42.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 42.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 42.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 42.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F9C304 LoadLibraryA,GetProcAddress,

0_2_00F9C304

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F88719 push FFFFFF8Bh; iretd	0_2_00F8871B
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4E94F push edi; ret	0_2_00F4E951
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4EA68 push esi; ret	0_2_00F4EA6A
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F48B85 push ecx; ret	0_2_00F48B98
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4EC43 push esi; ret	0_2_00F4EC45
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4ED2C push edi; ret	0_2_00F4ED2E

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F24A35
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00FA55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FA55FD

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F433C7

Source: C:\Users\user\Desktop\42.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\42.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\42.exe

API/Special instruction interceptor: Address: 1DA3254

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8733			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1129			Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98986

Source: C:\Users\user\Desktop\42.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F84696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00F84696
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00F8C9C7
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8C93C FindFirstFileW,FindClose,	0_2_00F8C93C
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F8F200
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00F8F35D
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F8F65E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F83A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F83A2B
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F83D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00F83D4E
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F8BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00F8BF27

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F24AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99870	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97685	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97446	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95763	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95426	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94422	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\42.exe

API call chain: ExitProcess graph end node

graph_0-97733

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F941FD BlockInput,

0_2_00F941FD

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F23B4C

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F55CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00F55CCC

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F9C304 LoadLibraryA,GetProcAddress,

0_2_00F9C304

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_01DA3520 mov eax, dword ptr fs:[00000030h]	0_2_01DA3520
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_01DA34C0 mov eax, dword ptr fs:[00000030h]	0_2_01DA34C0
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_01DA1E70 mov eax, dword ptr fs:[00000030h]	0_2_01DA1E70

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00F781F7

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F4A395
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F4A364 SetUnhandledExceptionFilter,		0_2_00F4A364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\42.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\42.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 63C008

Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F78C93 LogonUserW,

0_2_00F78C93

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F23B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F23B4C

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F24A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00F24A35

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F84EF5 mouse_event,

0_2_00F84EF5

Source: C:\Users\user\Desktop\42.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\42.exe"

Jump to behavior

Source: C:\Users\user\Desktop\42.exe

0_2_00F781F7

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F84C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F84C03

Source: 42.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 42.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F4886B cpuid

0_2_00F4886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F550D7

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F62230 GetUserNameW,

0_2_00F62230

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F5418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F5418A

Source: C:\Users\user\Desktop\42.exe

Code function: 0_2_00F24AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F24AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.42.exe.1db0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.42.exe.1db0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4081635789.00000000028E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 42.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7428, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: 42.exe	Binary or memory string: WIN_81
Source: 42.exe	Binary or memory string: WIN_XP
Source: 42.exe	Binary or memory string: WIN_XPe
Source: 42.exe	Binary or memory string: WIN_VISTA
Source: 42.exe	Binary or memory string: WIN_7
Source: 42.exe	Binary or memory string: WIN_8
Source: 42.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.42.exe.1db0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.42.exe.1db0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 42.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7428, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.42.exe.1db0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.42.exe.1db0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4081635789.00000000028E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 42.exe PID: 7412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7428, type: MEMORYSTR

Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F96596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00F96596
Source: C:\Users\user\Desktop\42.exe	Code function: 0_2_00F96A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00F96A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	4 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
42.exe	42%	ReversingLabs	Win32.Trojan.Strab
42.exe	34%	Virustotal		Browse
42.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
funworld.co.id	0%	Virustotal		Browse
mail.funworld.co.id	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://mail.funworld.co.id	0%	Avira URL Cloud	safe
http://funworld.co.id	0%	Avira URL Cloud	safe
http://mail.funworld.co.id	0%	Virustotal		Browse
http://funworld.co.id	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
funworld.co.id	180.235.148.163	true	true	0%, Virustotal, Browse	unknown
mail.funworld.co.id	unknown	unknown	true	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://funworld.co.id	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://account.dyn.com/	42.exe, 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.funworld.co.id	RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4081312596.0000000000D0B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4083392347.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
180.235.148.163	funworld.co.id	Indonesia		45731	ARDH-AS-IDARDHGLOBALINDONESIAPTID	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466691
Start date and time:	2024-07-03 09:37:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	42.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target RegSvcs.exe, PID 7428 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:37:53	API Interceptor	12049237x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
180.235.148.163	24.exe	Get hash	malicious	AgentTesla	Browse
	442.exe	Get hash	malicious	AgentTesla	Browse
	42.exe	Get hash	malicious	AgentTesla	Browse
	04.exe	Get hash	malicious	AgentTesla	Browse
	8tsQzCT3MHRQkUK.exe	Get hash	malicious	AgentTesla	Browse
	ipuqVGtm0WEGaLy.exe	Get hash	malicious	AgentTesla	Browse
	24.exe	Get hash	malicious	AgentTesla	Browse
	0424ss.exe	Get hash	malicious	AgentTesla	Browse
	04.exe	Get hash	malicious	AgentTesla	Browse
	RlTooRWTbL.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ARDH-AS-IDARDHGLOBALINDONESIAPTID	24.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	442.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	42.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	04.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	8tsQzCT3MHRQkUK.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	ipuqVGtm0WEGaLy.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	24.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	0424ss.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	04.exe	Get hash	malicious	AgentTesla	Browse	180.235.148.163
	C4zDQjrSzj.elf	Get hash	malicious	Unknown	Browse	113.20.31.73

Process:	C:\Users\user\Desktop\42.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.5949968959848553
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+Iw6lr4vfF3if6gyTz:miTZ+2QoioGRk6ZklputwjpjBkCiw2Rq
MD5:	E029D41CCE0A59260842AAAFDD53B67D
SHA1:	FD340576769BBBFA8ABDB8932A264B0A98E23F90
SHA-256:	5274EE76E8F0FA338F3C6D9E81F64EC72471B63BC41DB7702D2156A84FFB1405
SHA-512:	6234AE5293FC529A4850071C7910314D881D69B34739A31C50BD36BC7DC2FE6D07614E03EE27D7EDD5E07191277C0BC17A276815462029C0FD334BE0EBC872C7
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

C:\Users\user\AppData\Local\Temp\acrorrheuma

Download File

Process:	C:\Users\user\Desktop\42.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.686899323146974
Encrypted:	false
SSDEEP:	6144:QWAr8Isdxa9A6DM6g93KtaPTVMWpM6LNf09f94boaBzF:QWAr8IsCA6DDg93KabVMkM+NW4MahF
MD5:	9391B5D5C091ED8C3DE430CDC4B3C172
SHA1:	71D87B16C5FA2FB4D9A129C40AF3B15FDC4A97A2
SHA-256:	15E78E1D6D194B928FDA97EBCF20EBC8F77A3A83D58117F2362D7D7B4201194F
SHA-512:	A81E7DF79E2BA67B9CEED8ABC95E54246D95CC6DAC064271F598A1923A2597341FAAD9BCF0945AA7498E8891D8647C421FE77F700AC82F79AD69C5DB6CB3A9D9
Malicious:	false
Reputation:	low
Preview:	...X0Q0EL8KY..OP.EVLAA1E.AGBX3Q0EH8KYLLOPLEVLAA1EUAGBX3Q0EH8.YLLAO.KV.H...T..c.[8Ce8J$>>-"p/$8".5.'0a576.8^e.w.y!#+5bH[FeA1EUAGB.vQ0.I;K.~.PLEVLAA1.UCFIY8Q0.K8KQLLOPLE8.BA1eUAG.[3Q0.H8kYLLMPLAVLAA1EUEGBX3Q0EH8OYLNOPLEVLCAq.UAWBX#Q0EH(KY\LOPLEV\AA1EUAGBX3Q,.K8.YLLO.OE.IAA1EUAGBX3Q0EH8KYLL.SLIVLAA1EUAGBX3Q0EH8KYLLOPLEVLAA1EUAGBX3Q0EH8KYLLOPLEVLaA1MUAGBX3Q0EH8CyLL.PLEVLAA1EUAi6=K%0EHL.ZLLoPLE.OAA3EUAGBX3Q0EH8KYlLO0b7%>"A1E.DGBX.R0EN8KY.OOPLEVLAA1EUAG.X3..7-T$:LLCPLEV.BA1GUAG.[3Q0EH8KYLLOPL.VL.A1EUAGBX3Q0EH8KY..LPLEVL.A1EWABB..S0.y9KZLLOQLEPLAA1EUAGBX3Q0EH8KYLLOPLEVLAA1EUAGBX3Q0EH8KYLLOPLX....k.:\|RQV.c._.Z..\..<..N.$..U..u\...~9J..L.Y\|...L...-.Y5<I....w0G4X$.6.J4.Z..o..d<x..J"....2s._Cq.n...w.....V8....1..".\k417.=..Q#)J".N.NPLEV........+ x..FG&.K4.....b^9....9BX350EHJKYL-OPL.VLA.1EU/GBXMQ0E68KY.LOP.EVLvA1EpAGB53Q0aH8K'LLO.1JY..X6..GBX3Q.....4.....r..w@.+.%z..T....\..@8.2.....K.,..$.[Ckv.^MJKUNBROM\|?....cZ7U5GO<HUqB....w.g..\|..3...c?.DKYLLOP.EV.AA1..A.BX3.0.H..YLL.L.V.A...U

C:\Users\user\AppData\Local\Temp\aut2C63.tmp

Download File

Process:	C:\Users\user\Desktop\42.exe
File Type:	data
Category:	dropped
Size (bytes):	156726
Entropy (8bit):	7.9441528543347
Encrypted:	false
SSDEEP:	3072:0G7yIy/9z8E04M6bzviijHdC0wtYTXaj1GBROtGbyexmoX8yHdJMu3kQmgf0rnp:Xy/f04MPA3wtscGgG+en8yHbM67fAnp
MD5:	43FC1EDCBAC1AFC5ACACA36243FE835F
SHA1:	CCDC2FB53BB584B8AD4F8D8734193F769A5B791E
SHA-256:	ADA9B1C74F556E722022D2A95A089A0794AADFD39C380E45D0B0032A564ADE65
SHA-512:	A28E26E7BD2BF9354099AECCFFA187AE29E2C89943F1F92823D823FB0DD7B9F0F507DD401AABF94CFBFFD4C9DF5067CC9846D2E1063CBE49FF8EBD108133C270
Malicious:	false
Reputation:	low
Preview:	EA06.....GzU..FaE.N)u...P.Qj....cE..h....d.....e>.L...T.g.....O.R..F2!..CqV8enqC..)RI..[".K...k...,3Y..'8.Ya.x..C#..lT.......E.0..gt...U.d..C.Rk3....K.R. ...\|.T......V..H-"qk.})..e..[4P.m..4.p.~(t....A...0..QK...21\....K.A.8\.>....p.@.N..L..}\|.".`..,4..4.g.;.2...2.m=..@.JgR.L.[..O.>.A..%.6.e>ab..g. ."'D..>u)....2{.......3.....uL.P..]`.aG..=U..o..V.@.+.8....B@.J...B.o.s.-.sK..)..e......V?^M.K....gW.F.......\..'...:.$.K...<N.\.....e.sJ.Fi.......S:....[..g...s...]..y.bI..G.SM.k....I....H....;.2...;.b....n.=....N"Q}_vc.....\.c7.Oc...SJ.x).jp.{...~....+.^!q.5.M...#^N...b.Nb.....9..&...(. ..d. ..\..K.8Jh..6..!@.$0...}....j..X@>.8....</...6.o.D.......;...?}r..q.z.nW.....US....k....q..E`.m.b....!.9$..C..u.m.U.P.T.m.....2v:..5.......mr7}.....t.]Y........@.\|l.n`.....w...Fa.n..^~...l.<........U..Bc'.Ng....M)...X.Fk'.O.p.I.R+..%....P.2*-V.m.I.5...m-.....U2.R.F.3....G.\..C2%......q0.Ph.;m..G.V.:....8..T.}Zc .S(..}.]:......5...4.4......d......+2]\|....G

C:\Users\user\AppData\Local\Temp\aut2CC2.tmp

Download File

Process:	C:\Users\user\Desktop\42.exe
File Type:	data
Category:	dropped
Size (bytes):	9870
Entropy (8bit):	7.597962402410301
Encrypted:	false
SSDEEP:	192:65jwEiqQ9pW+hCZcbZ/wzJkecGgL98GtYkJ8hjhqGwMwb81fSzx:I6qy2ZcbZ/YeecGgL20Gqx
MD5:	8B553E655726D54F70FC763D3C4BCC47
SHA1:	5B9BF5A974245C0EDB7EB3CA446D8FFB462338F6
SHA-256:	785F65FB5C6E2748337C8B43C13D8D9765637AA3219E9E1448FB4B0F2BD92D5E
SHA-512:	619ADFB95C87566E393888763B56376B3E3BDCBF5A420749B8FA222FE85760D9B737EEC7FC45441B4B16281E7FE7F9DF2BFBA5F89DA9329EB72FF6D5DCABC840
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.877053274611739
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	42.exe
File size:	1'112'064 bytes
MD5:	cb5a596f6ae023f22312ac155b442817
SHA1:	3bbc4dcd644056c062dc4f3e9bdb0ac93dd372ab
SHA256:	03665ef38e9753bab4a9f071bfd6fb52426fa14dbe9d55f019b7cead8bcbacfb
SHA512:	6ef7537f5173fe1f501f0a273534f6ba2f840a8e85242420e58d55962598d88d12db545baaa4d8fdc062286fcfae28b8a7aafb43b3d9bed517e8d46424bb01c6
SSDEEP:	24576:5AHnh+eWsN3skA4RV1Hom2KXMmHa9Ts7q0U/mV3Uv/35:Ah+ZkldoPK8Ya9o7ruVZ
TLSH:	AE358C02739180E5FFAA91735B55B20156FD693531338D2F12982DB8BCFF1A12E2DE62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	01449a1a796c95a9

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6684975E [Wed Jul 3 00:12:14 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FDFEC96533Dh
jmp 00007FDFEC9580F4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FDFEC95827Ah
cmp edi, eax
jc 00007FDFEC9585DEh
bt dword ptr [004C41FCh], 01h
jnc 00007FDFEC958279h
rep movsb
jmp 00007FDFEC95858Ch
cmp ecx, 00000080h
jc 00007FDFEC958444h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FDFEC958280h
bt dword ptr [004BF324h], 01h
jc 00007FDFEC958750h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FDFEC95841Dh
test edi, 00000003h
jne 00007FDFEC95842Eh
test esi, 00000003h
jne 00007FDFEC95840Dh
bt edi, 02h
jnc 00007FDFEC95827Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FDFEC958283h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FDFEC9582D5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x450a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10e000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x450a0	0x45200	c3fe109da5035e74071a822afcf7559d	False	0.7474146699819169	data	7.25954276564609	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10e000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc86a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc87d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 30236 x 30236 px/m	English	Great Britain	0.06435584999408495
RT_MENU	0xd8ff8	0x50	data	English	Great Britain	0.9
RT_STRING	0xd9048	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xd95dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xd9c68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xda0f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xda6f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdad50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdb1b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdb310	0x31874	data			1.000349981268608
RT_GROUP_ICON	0x10cb84	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10cb98	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10cbac	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10cbc0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10cbd4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x10ccb0	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:37:54.967643023 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:54.975389004 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:54.975477934 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:57.420880079 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:57.421892881 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:57.426791906 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:57.774852037 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:57.775136948 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:57.780154943 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.128710032 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.137448072 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:58.142373085 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.494040012 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.494057894 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.494067907 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.494112015 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:58.530042887 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:58.534804106 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.873919964 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:58.898946047 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:58.903888941 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.252125025 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.253173113 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:59.258043051 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.606621981 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.607748032 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:59.612670898 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.977432013 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:37:59.977771997 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:37:59.982614994 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:00.330576897 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:00.330816984 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:00.335679054 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:00.698117018 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:00.698442936 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:00.703299046 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.051570892 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.052259922 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:01.052259922 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:01.052259922 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:01.052259922 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:38:01.057384014 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.057394028 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.057400942 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.057409048 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.707822084 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:38:01.751991987 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:39:34.330523014 CEST	49730	587	192.168.2.4	180.235.148.163
Jul 3, 2024 09:39:34.336858988 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:39:34.686230898 CEST	587	49730	180.235.148.163	192.168.2.4
Jul 3, 2024 09:39:34.690151930 CEST	49730	587	192.168.2.4	180.235.148.163

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:37:54.309730053 CEST	50783	53	192.168.2.4	1.1.1.1
Jul 3, 2024 09:37:54.960287094 CEST	53	50783	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 09:37:54.309730053 CEST	192.168.2.4	1.1.1.1	0x6991	Standard query (0)	mail.funworld.co.id	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 09:37:54.960287094 CEST	1.1.1.1	192.168.2.4	0x6991	No error (0)	mail.funworld.co.id	funworld.co.id		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 09:37:54.960287094 CEST	1.1.1.1	192.168.2.4	0x6991	No error (0)	funworld.co.id		180.235.148.163	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 09:37:57.420880079 CEST	587	49730	180.235.148.163	192.168.2.4	220-server.funworld.co.id ESMTP Exim 4.97.1 #2 Wed, 03 Jul 2024 14:37:57 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 3, 2024 09:37:57.421892881 CEST	49730	587	192.168.2.4	180.235.148.163	EHLO 878411
Jul 3, 2024 09:37:57.774852037 CEST	587	49730	180.235.148.163	192.168.2.4	250-server.funworld.co.id Hello 878411 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Jul 3, 2024 09:37:57.775136948 CEST	49730	587	192.168.2.4	180.235.148.163	STARTTLS
Jul 3, 2024 09:37:58.128710032 CEST	587	49730	180.235.148.163	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	03:37:51
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\42.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\42.exe"
Imagebase:	0xf20000
File size:	1'112'064 bytes
MD5 hash:	CB5A596F6AE023F22312AC155B442817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1632891463.0000000001DB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:37:52
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\42.exe"
Imagebase:	0x500000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4081635789.00000000028E9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4081635789.00000000028BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4080665749.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4081635789.0000000002871000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	5.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	168

Executed Functions

Function 00F23B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F23B7A
IsDebuggerPresent.KERNEL32 ref: 00F23B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,00FE62F8,00FE62E0,?,?), ref: 00F23BFD

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Part of subcall function 00F30A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00F23C26,00FE62F8,?,?,?), ref: 00F30ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00F23C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00FD93F0,00000010), ref: 00F5D4BC
SetCurrentDirectoryW.KERNEL32(?,00FE62F8,?,?,?), ref: 00F5D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00FD5D40,00FE62F8,?,?,?), ref: 00F5D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00F5D581

Part of subcall function 00F23A58: GetSysColorBrush.USER32(0000000F), ref: 00F23A62
Part of subcall function 00F23A58: LoadCursorW.USER32(00000000,00007F00), ref: 00F23A71
Part of subcall function 00F23A58: LoadIconW.USER32(00000063), ref: 00F23A88
Part of subcall function 00F23A58: LoadIconW.USER32(000000A4), ref: 00F23A9A
Part of subcall function 00F23A58: LoadIconW.USER32(000000A2), ref: 00F23AAC
Part of subcall function 00F23A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F23AD2
Part of subcall function 00F23A58: RegisterClassExW.USER32(?), ref: 00F23B28

Part of subcall function 00F239E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F23A15
Part of subcall function 00F239E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F23A36
Part of subcall function 00F239E7: ShowWindow.USER32(00000000,?,?), ref: 00F23A4A
Part of subcall function 00F239E7: ShowWindow.USER32(00000000,?,?), ref: 00F23A53

Part of subcall function 00F243DB: _memset.LIBCMT ref: 00F24401
Part of subcall function 00F243DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F244A6

Strings

runas, xrefs: 00F5D575
This is a third-party compiled AutoIt script., xrefs: 00F5D4B4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: d64089862ec7a1465b17815446e8cf92f95ed9fb33c2a8c9942e230fe5c9ee68
Instruction ID: bf1831fc6004218593471de445d2f312a8b6ee4757fbb4c305a474ef6a59fcf1
Opcode Fuzzy Hash: d64089862ec7a1465b17815446e8cf92f95ed9fb33c2a8c9942e230fe5c9ee68
Instruction Fuzzy Hash: 75515671D0829CAACF11FBF0FC41EED7B78AB15350F044069F911AA1A2DA7C9A05FB21

Function 00F24AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F24B2B

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

GetCurrentProcess.KERNEL32(?,00FAFAEC,00000000,00000000,?), ref: 00F24BF8
IsWow64Process.KERNEL32(00000000), ref: 00F24BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00F24C45
FreeLibrary.KERNEL32(00000000), ref: 00F24C50
GetSystemInfo.KERNEL32(00000000), ref: 00F24C81
GetSystemInfo.KERNEL32(00000000), ref: 00F24C8D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: bddd6e5085b9e34ba533f9fd956d3fa460b983e74c3568a9469b1cad07945188
Instruction ID: d7c764f59bedd45af78ce2c9e67a938a0b062ad909d16478b5bff07e517abfd0
Opcode Fuzzy Hash: bddd6e5085b9e34ba533f9fd956d3fa460b983e74c3568a9469b1cad07945188
Instruction Fuzzy Hash: CE91173198ABD4DEC731DB7894512AAFFE4AF66310B444D5DE4CB83A41D260F90CE719

Function 00F24FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F24EEE,?,?,00000000,00000000), ref: 00F24FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F24EEE,?,?,00000000,00000000), ref: 00F25010
LoadResource.KERNEL32(?,00000000,?,?,00F24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F24F8F), ref: 00F5DD60
SizeofResource.KERNEL32(?,00000000,?,?,00F24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F24F8F), ref: 00F5DD75
LockResource.KERNEL32(00F24EEE,?,?,00F24EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F24F8F,00000000), ref: 00F5DD88

Strings

SCRIPT, xrefs: 00F25006

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 8cc5f9108dbcb40c0fdeb723f9d71c2a23d992fb30f1c6bb2ea835a97e930947
Instruction ID: c8edfe05a17cc2760ecb9b155de4a238e05adf48b9d84292bd3b1d7a9947e788
Opcode Fuzzy Hash: 8cc5f9108dbcb40c0fdeb723f9d71c2a23d992fb30f1c6bb2ea835a97e930947
Instruction Fuzzy Hash: BE1170B5640705BFD7218B65EC58F677BBDEBCAB11F10416CF405CA260DB71EC04A660

Function 00F84696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00F5E7C1), ref: 00F846A6
FindFirstFileW.KERNELBASE(?,?), ref: 00F846B7
FindClose.KERNEL32(00000000), ref: 00F846C7

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 23d8fa105ebd6f6b07fe925250af65e21e8e130cf2394acffb6475253ec5f39f
Instruction ID: d4b7f537c050188b58f8f5f04d74e2c1845ab83545d5f08ddbfa3b1390583cea
Opcode Fuzzy Hash: 23d8fa105ebd6f6b07fe925250af65e21e8e130cf2394acffb6475253ec5f39f
Instruction Fuzzy Hash: ECE0DF728105056B8610B778EC4D9EAB79C9E07335F100726F836C20E0FBB0AD64A69A

Function 00F2E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00F6428C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: dcddfc720e6062a989beebc3b00f15cde75b33f5395189b4c04d22f324789919
Instruction ID: 2d0ef019c1d314a399d991eb61bc624458a1b71c18f7f2d1cb6a4bfb330cb78a
Opcode Fuzzy Hash: dcddfc720e6062a989beebc3b00f15cde75b33f5395189b4c04d22f324789919
Instruction Fuzzy Hash: E1A2AE75E04225CFCB24DF58E880AADB7B1FF59310F648069E906AB351D734EC86EB91

Function 00F30B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F30BBB
timeGetTime.WINMM ref: 00F30E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F30FB3
TranslateMessage.USER32(?), ref: 00F30FC7
DispatchMessageW.USER32(?), ref: 00F30FD5
Sleep.KERNEL32(0000000A), ref: 00F30FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00F3105A
DestroyWindow.USER32 ref: 00F31066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F31080
Sleep.KERNEL32(0000000A,?,?), ref: 00F652AD
TranslateMessage.USER32(?), ref: 00F6608A
DispatchMessageW.USER32(?), ref: 00F66098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F660AC

Strings

@GUI_CTRLID, xrefs: 00F65364
@COM_EVENTOBJ, xrefs: 00F6591A
@GUI_WINHANDLE, xrefs: 00F653B9
@GUI_CTRLHANDLE, xrefs: 00F6540E
@TRAY_ID, xrefs: 00F65BB9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 54cc068393c7779450b9c4577efd89840a674467ac6edc65b1cc1e8ef5d672d2
Instruction ID: df0d5c10958b2f76b5200651f4d0e360b2930d6e93b9fe9ef7139e522988ae24
Opcode Fuzzy Hash: 54cc068393c7779450b9c4577efd89840a674467ac6edc65b1cc1e8ef5d672d2
Instruction Fuzzy Hash: 2AB2E470A08741DFD724DF24C894BAAB7E4FF84714F14491EF48A9B291DB75E884EB82

Function 00F893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F891E9: __time64.LIBCMT ref: 00F891F3

Part of subcall function 00F25045: _fseek.LIBCMT ref: 00F2505D

__wsplitpath.LIBCMT ref: 00F894BE

Part of subcall function 00F4432E: __wsplitpath_helper.LIBCMT ref: 00F4436E

_wcscpy.LIBCMT ref: 00F894D1
_wcscat.LIBCMT ref: 00F894E4
__wsplitpath.LIBCMT ref: 00F89509
_wcscat.LIBCMT ref: 00F8951F
_wcscat.LIBCMT ref: 00F89532

Part of subcall function 00F8922F: _memmove.LIBCMT ref: 00F89268
Part of subcall function 00F8922F: _memmove.LIBCMT ref: 00F89277

_wcscmp.LIBCMT ref: 00F89479

Part of subcall function 00F899BE: _wcscmp.LIBCMT ref: 00F89AAE
Part of subcall function 00F899BE: _wcscmp.LIBCMT ref: 00F89AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F896DC
_wcsncpy.LIBCMT ref: 00F8974F
DeleteFileW.KERNEL32(?,?), ref: 00F89785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00F8979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F897AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00F897BE

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f3455b22022995f0a9050ba7d6154323dc8df84371978fd8508dd1e7e0e3de26
Instruction ID: 7d4348479cfded7dc81ae90cf0cc14429290d9230c6f12c78ec3718c9206a98b
Opcode Fuzzy Hash: f3455b22022995f0a9050ba7d6154323dc8df84371978fd8508dd1e7e0e3de26
Instruction Fuzzy Hash: B3C15FB1D00129AECF21EF94CC85AEEBBBDEF45310F0440AAF609E6151EB749A449F65

Function 00F23015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F23074
RegisterClassExW.USER32(00000030), ref: 00F2309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F230AF
InitCommonControlsEx.COMCTL32(?), ref: 00F230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F230DC
LoadIconW.USER32(000000A9), ref: 00F230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F23101

Strings

AutoIt v3 GUI, xrefs: 00F23090
+, xrefs: 00F2305D
0, xrefs: 00F23056
TaskbarCreated, xrefs: 00F230A4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 86892729d06c5b8aa6c905c487814f98e9d84f8a04fbde0cd0d507d012b443ff
Instruction ID: d730244dd19f4e586f4c761d6ef02b8b2fd23e18e9e169a34b9424fffe879442
Opcode Fuzzy Hash: 86892729d06c5b8aa6c905c487814f98e9d84f8a04fbde0cd0d507d012b443ff
Instruction Fuzzy Hash: 863127B184134DAFDB509FE4EC85AC9BBF4FF19310F10412AE590EA2A0E3B90545EF51

Function 00F23041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F23074
RegisterClassExW.USER32(00000030), ref: 00F2309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F230AF
InitCommonControlsEx.COMCTL32(?), ref: 00F230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F230DC
LoadIconW.USER32(000000A9), ref: 00F230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F23101

Strings

AutoIt v3 GUI, xrefs: 00F23090
+, xrefs: 00F2305D
0, xrefs: 00F23056
TaskbarCreated, xrefs: 00F230A4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: caa79d15e024b04daf3dd7051c164bbe74112c66274e6e04acc935942fa3d640
Instruction ID: 4dd36e647fe1001e0420f2cc51c5ca7c1fb47736a07b80ff16f347ec56d65384
Opcode Fuzzy Hash: caa79d15e024b04daf3dd7051c164bbe74112c66274e6e04acc935942fa3d640
Instruction Fuzzy Hash: 3321E4B191025CAFDB00DFE4EC88A9DBBF4FB09750F00812AF510EA2A0D7B14648AF95

Function 00F271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F24864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00FE62F8,?,00F237C0,?), ref: 00F24882

Part of subcall function 00F4074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00F272C5), ref: 00F40771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F27308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00F5ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00F5ED32
RegCloseKey.ADVAPI32(?), ref: 00F5ED70
_wcscat.LIBCMT ref: 00F5EDC9

Strings

\, xrefs: 00F5EDEC
\Include\, xrefs: 00F272C5
Software\AutoIt v3\AutoIt, xrefs: 00F272FE
Include, xrefs: 00F5ECE8, 00F5ED29

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 1849c4ad01bdc1fa8be378c0d3ebf490e0e86fb11a927178c0a32d43132016e5
Instruction ID: 6b273653f68d1c3c162b3a9247022d37fbb85ba212382e856518e66e9ae49ca0
Opcode Fuzzy Hash: 1849c4ad01bdc1fa8be378c0d3ebf490e0e86fb11a927178c0a32d43132016e5
Instruction Fuzzy Hash: A4718C718083459EC314EF65EC8199BBBF8FF88710B40042EFA458B1A1EB349949EF62

Function 00F23A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F23A62
LoadCursorW.USER32(00000000,00007F00), ref: 00F23A71
LoadIconW.USER32(00000063), ref: 00F23A88
LoadIconW.USER32(000000A4), ref: 00F23A9A
LoadIconW.USER32(000000A2), ref: 00F23AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F23AD2
RegisterClassExW.USER32(?), ref: 00F23B28

Part of subcall function 00F23041: GetSysColorBrush.USER32(0000000F), ref: 00F23074
Part of subcall function 00F23041: RegisterClassExW.USER32(00000030), ref: 00F2309E
Part of subcall function 00F23041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F230AF
Part of subcall function 00F23041: InitCommonControlsEx.COMCTL32(?), ref: 00F230CC
Part of subcall function 00F23041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F230DC
Part of subcall function 00F23041: LoadIconW.USER32(000000A9), ref: 00F230F2
Part of subcall function 00F23041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F23101

Strings

0, xrefs: 00F23B06
#, xrefs: 00F23B0D
AutoIt v3, xrefs: 00F23B17

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: c1e1b27dc6aa9de1b2142e2013d6b5361a6ca6fb295a5e2db05647e93389fa1b
Instruction ID: ce4c18eb2635c67d022184ee1c83d625e2ade3924646d20e6d61f2c08ea12d7e
Opcode Fuzzy Hash: c1e1b27dc6aa9de1b2142e2013d6b5361a6ca6fb295a5e2db05647e93389fa1b
Instruction Fuzzy Hash: E7215CB1D0134CAFDF109FA4EC89B9D7BB4EB19751F000129E604EA2A0C3BA5544AF41

Function 00F23633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00F236D2
KillTimer.USER32(?,00000001), ref: 00F236FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F2371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F2372A
CreatePopupMenu.USER32 ref: 00F2373E
PostQuitMessage.USER32(00000000), ref: 00F2375F

Strings

TaskbarCreated, xrefs: 00F23725

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c2b0494e2e90711ca9d9b77635b1527cf995b35638d08d689e44f9343c8f32b6
Instruction ID: 31c2feebfa78c0e49c947f005373a9acc68df03cb1595495a0a9dde2e6244876
Opcode Fuzzy Hash: c2b0494e2e90711ca9d9b77635b1527cf995b35638d08d689e44f9343c8f32b6
Instruction Fuzzy Hash: 37415CF260516DBBDF206F64FC49F793B58EB10351F040129FA02CA2B2CA6DAE05B761

Function 00F23778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00F238A4
/AutoIt3ExecuteScript, xrefs: 00F238CE
/AutoIt3ExecuteLine, xrefs: 00F238B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00F237C0
CMDLINERAW, xrefs: 00F2380D
CMDLINE, xrefs: 00F23834
/ErrorStdOut, xrefs: 00F2388F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 6c8da636a47339f988edde34ee7b2dfc7d8c3d9d46507effe433385e99947b78
Instruction ID: 6e1b6c1161a233963f1fa5f35eaeffa66c1f67882e5aca169f18335a7a3d68cd
Opcode Fuzzy Hash: 6c8da636a47339f988edde34ee7b2dfc7d8c3d9d46507effe433385e99947b78
Instruction Fuzzy Hash: EEA150B2D1423D9ACF14EBA0EC91AEEB778BF14750F000429F512B7191DB7C9A09EB60

Function 01DA2610 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01DA26E1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01DA2907

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: b4aeea84abaf9598b6be2fde27ae8c2d5dd0cec8955c51febd531a0d13227376
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: D5A1F674E00209EBDB14CFA5C894BEEBBB5FF48304F608159E611BB280D7799A41CBA4

Function 00F239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F23A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F23A36
ShowWindow.USER32(00000000,?,?), ref: 00F23A4A
ShowWindow.USER32(00000000,?,?), ref: 00F23A53

Strings

edit, xrefs: 00F23A30
AutoIt v3, xrefs: 00F23A0D, 00F23A12, 00F23A13

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 7ceb696bad011a13035c48e9f13504481ad3d86ce06b45bc4b00bd9865ce9359
Instruction ID: 6fc5c0f89a9510959f22de3c134243acbe76bb6b5bf9463dda663078f7e015e4
Opcode Fuzzy Hash: 7ceb696bad011a13035c48e9f13504481ad3d86ce06b45bc4b00bd9865ce9359
Instruction Fuzzy Hash: 7FF03AB06012DC7EEF301763AC88E773E7DD7D7FA0B00002ABA00EA170C2A51840EAB0

Function 01DA23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01DA22A0: Sleep.KERNELBASE(000001F4), ref: 01DA22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01DA2507

Strings

AGBX3Q0EH8KYLLOPLEVLAA1EU, xrefs: 01DA256A, 01DA256D

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: CreateFileSleep
String ID: AGBX3Q0EH8KYLLOPLEVLAA1EU
API String ID: 2694422964-1895678267
Opcode ID: 65a2ee721fabedac0b03924e82e21832a2465e394e5dcae82e153523726c30ef
Instruction ID: d2d6188bfe41e90875b23cf4ecaa6ccc637cebbc4e4f9fa9150141062a12b4e5
Opcode Fuzzy Hash: 65a2ee721fabedac0b03924e82e21832a2465e394e5dcae82e153523726c30ef
Instruction Fuzzy Hash: F5619270D04248DBEF11DBB8C858BEEBB75AF19304F444198E249BB2C1D7B95B48CB65

Function 00F2410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00F5D5EC

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

_memset.LIBCMT ref: 00F2418D
_wcscpy.LIBCMT ref: 00F241E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F241F1

Strings

Line: , xrefs: 00F5D615

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 2c4dc32a2047498bae78b99eaca4e4fe66c55c30496407cce24f7283007610d2
Instruction ID: ac26d6db9f2a1aa992e3cc7857bdddfea6e48bbcfb303b90f71da94d93e6bb28
Opcode Fuzzy Hash: 2c4dc32a2047498bae78b99eaca4e4fe66c55c30496407cce24f7283007610d2
Instruction Fuzzy Hash: 6931E7714083689AD721FB60EC46FDB77E8AF54310F10451EF684960A1EB78A648E797

Function 00F4564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F456AB
_memcpy_s.LIBCMT ref: 00F4571D
__read_nolock.LIBCMT ref: 00F4577B
__filbuf.LIBCMT ref: 00F4579E
_memset.LIBCMT ref: 00F457E2

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 589c21360949f3bc3911bcde8e07683c9de1499cf92d30a081db2d68192d9fff
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: B351B131E00B09DBDB24AFA9C88066E7FB1AF40B30F258739FC25962D2D7749D55AB40

Function 00F269CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00F24F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00FE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F24F6F

_free.LIBCMT ref: 00F5E68C
_free.LIBCMT ref: 00F5E6D3

Part of subcall function 00F26BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F26D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00F5E462
Bad directive syntax error, xrefs: 00F5E6BB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: c42a23ffe8fab9022b5d07dd850e3f6f05ae321dd8694fdf38718d9ff851ab60
Instruction ID: 1bfb21eafc7af5b590cb8a99c2f9fad787ea435b631f19ac11b66589982c7686
Opcode Fuzzy Hash: c42a23ffe8fab9022b5d07dd850e3f6f05ae321dd8694fdf38718d9ff851ab60
Instruction Fuzzy Hash: D89170719102299FCF08EFA4DC919EDBBB4FF15310F14446AF915AB291EB34AA09EB50

Function 00F235B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00F235A1,SwapMouseButtons,00000004,?), ref: 00F235D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00F235A1,SwapMouseButtons,00000004,?,?,?,?,00F22754), ref: 00F235F5
RegCloseKey.KERNELBASE(00000000,?,?,00F235A1,SwapMouseButtons,00000004,?,?,?,?,00F22754), ref: 00F23617

Strings

Control Panel\Mouse, xrefs: 00F235D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 70641f0e8ec752213c37f14ffcbfadf0087686f12714f85280a3ad350fb6ed86
Instruction ID: 1b7708b71c86be629124d0dfb966f7065feec0f436cadfdd488c7cf8db3115b7
Opcode Fuzzy Hash: 70641f0e8ec752213c37f14ffcbfadf0087686f12714f85280a3ad350fb6ed86
Instruction Fuzzy Hash: F9115EB1910218BFDB208FA4EC40EAFBBBCEF05750F018469F805D7210D2719F44A760

Function 01DA12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01DA1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01DA1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01DA1B13

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction ID: 9da7499870441d2cb0ca8b383c598ffb85837c184ccafb7d9ef137c81c252f70
Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction Fuzzy Hash: C4620B30A14258DBEB24CFA4C850BDEB776EF58300F5091A9D20DEB3A4E7759E81CB59

Function 00F897E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00F25045: _fseek.LIBCMT ref: 00F2505D

Part of subcall function 00F899BE: _wcscmp.LIBCMT ref: 00F89AAE
Part of subcall function 00F899BE: _wcscmp.LIBCMT ref: 00F89AC1

_free.LIBCMT ref: 00F8992C
_free.LIBCMT ref: 00F89933
_free.LIBCMT ref: 00F8999E

Part of subcall function 00F42F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00F49C64), ref: 00F42FA9
Part of subcall function 00F42F95: GetLastError.KERNEL32(00000000,?,00F49C64), ref: 00F42FBB

_free.LIBCMT ref: 00F899A6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: fd58ff954d820e82f1433f7530f1d75bcb60f7d4300c08518f50802db2e17822
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: 85515CB1D04219AFDF249F64DC81AAEBBB9EF48310F0404AEF609A7241DB755E80DF58

Function 00F4493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F449D0
__flush.LIBCMT ref: 00F449F0
__write.LIBCMT ref: 00F44A23
__flsbuf.LIBCMT ref: 00F44A51

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 1d9464b95ae0312b5792643ad6e50a2ce88dbc399e55cb06246c15795ac4cb28
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 9C41C571A006059BDB18CEA9C880B6F7FA6EF80360B24813DEC55E7680D774ED40BB44

Function 00F273E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F5EE62
GetOpenFileNameW.COMDLG32(?), ref: 00F5EEAC

Part of subcall function 00F248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F248A1,?,?,00F237C0,?), ref: 00F248CE

Part of subcall function 00F409D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F409F4

Strings

X, xrefs: 00F5EE7A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 585a30adc4c757eb562cc3f7262133e8563e89102ecce191b9672ab8f3a6d246
Instruction ID: 5d40fd753388ebb05daddbd51411e4d1f653321bf74b3356a0856c28ca2cc6e6
Opcode Fuzzy Hash: 585a30adc4c757eb562cc3f7262133e8563e89102ecce191b9672ab8f3a6d246
Instruction Fuzzy Hash: 3021F6719142589BCB01EF94DC457EE7BF99F49310F04401AE908EB342DBF8598DABA1

Function 00F8901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F89036
__fread_nolock.LIBCMT ref: 00F8904B

Strings

EA06, xrefs: 00F8907D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: fd97ce141f839364fdaec6c30a4c8cfd7f4b4662821fd58a771fdd7eb315d4d1
Instruction ID: d2af60f4c8ea8db9f42b90d379c52c4b4dfd2e19c97f8b47f6f828738d09a147
Opcode Fuzzy Hash: fd97ce141f839364fdaec6c30a4c8cfd7f4b4662821fd58a771fdd7eb315d4d1
Instruction Fuzzy Hash: 3001F9728042186EDB28D6A8CC16FFE7BF89B01301F04419AF552D2181E5B9E604D760

Function 00F89B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00F89B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00F89B99

Strings

aut, xrefs: 00F89B93

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 39083bd651fdd07c71e86b04a98d12d2a0dbb6d9b8f4c7f246e9459465bdd15f
Instruction ID: c727691b68f7a0ff169e4f89c8c1df283ea604b3e964a39035dafe8a538ab2b7
Opcode Fuzzy Hash: 39083bd651fdd07c71e86b04a98d12d2a0dbb6d9b8f4c7f246e9459465bdd15f
Instruction Fuzzy Hash: 7AD05EB954030DABDB10DBE0DC0EFDA776CE705701F0042A1BE94951A1DEB495989B96

Function 00F9CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fead585b10567871c1d667c8162608cf877b23f75c93c139844590f1d40a726
Instruction ID: 8656f8b76d6b5fce1e0adfcde99276c0b6d9e874e621528ef98e9c77fceb5e28
Opcode Fuzzy Hash: 7fead585b10567871c1d667c8162608cf877b23f75c93c139844590f1d40a726
Instruction Fuzzy Hash: 47F17C719083019FDB14DF28C880A6ABBE5FF88314F14892EF8999B351D775E946DF82

Function 00F2F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F403A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F403D3
Part of subcall function 00F403A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00F403DB
Part of subcall function 00F403A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F403E6
Part of subcall function 00F403A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F403F1
Part of subcall function 00F403A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00F403F9
Part of subcall function 00F403A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00F40401

Part of subcall function 00F36259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00F2FA90), ref: 00F362B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F2FB2D
OleInitialize.OLE32(00000000), ref: 00F2FBAA
CloseHandle.KERNEL32(00000000), ref: 00F649F2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 589890bcc052ce227b3c5522559ab65368a19ab6bc5b776a66443558a26f72eb
Instruction ID: aebf2c563cc974f7e159c9c9a628d5c30d6971d1fafb925e0b066f273e6a9067
Opcode Fuzzy Hash: 589890bcc052ce227b3c5522559ab65368a19ab6bc5b776a66443558a26f72eb
Instruction Fuzzy Hash: 4681A9B09013DD8EC784EF2AED916557BE5FBB83A8710813AA418CF3A2EB355404BF51

Function 00F243DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F24401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F244A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F244C3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: d6ca1ed104de9f4954720c63422eff3018eab4739fdefd03a8ed997421fcf70e
Instruction ID: f9f987cbb98da2e31f593c9b9a419accf55084ea29c875091798bfba34e88548
Opcode Fuzzy Hash: d6ca1ed104de9f4954720c63422eff3018eab4739fdefd03a8ed997421fcf70e
Instruction Fuzzy Hash: BF31C3B09043548FC720EF24E884797BBF8FB58318F00092EFA8AC7240D7B56948EB52

Function 00F4594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00F45963

Part of subcall function 00F4A3AB: __NMSG_WRITE.LIBCMT ref: 00F4A3D2
Part of subcall function 00F4A3AB: __NMSG_WRITE.LIBCMT ref: 00F4A3DC

__NMSG_WRITE.LIBCMT ref: 00F4596A

Part of subcall function 00F4A408: GetModuleFileNameW.KERNEL32(00000000,00FE43BA,00000104,?,00000001,00000000), ref: 00F4A49A
Part of subcall function 00F4A408: ___crtMessageBoxW.LIBCMT ref: 00F4A548

Part of subcall function 00F432DF: ___crtCorExitProcess.LIBCMT ref: 00F432E5
Part of subcall function 00F432DF: ExitProcess.KERNEL32 ref: 00F432EE

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

RtlAllocateHeap.NTDLL(01120000,00000000,00000001,00000000,?,?,?,00F41013,?), ref: 00F4598F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a489c30339b9a8c68b097e261183599809d665314b2484f0bcdf782b5c37afb6
Instruction ID: 9f11503613bd0fc9ed7a219b6f4ef7066ee73d4d3123af55412c8a5cde3a24dd
Opcode Fuzzy Hash: a489c30339b9a8c68b097e261183599809d665314b2484f0bcdf782b5c37afb6
Instruction Fuzzy Hash: 8501D232A41A1ADFE6113B65DC42B2E7A599F42B70F10002AFD00AA292DA749D01B660

Function 00F89B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00F897D2,?,?,?,?,?,00000004), ref: 00F89B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00F897D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00F89B5B
CloseHandle.KERNEL32(00000000,?,00F897D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00F89B62

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 1639f25513139322ea92babe708f29023efa2f9f36beabe8549b1ecffd4d1547
Instruction ID: 971e756ed8fb99929dd2facdb7bac851dda2fa188fb8f9001a1e0c4d28444af6
Opcode Fuzzy Hash: 1639f25513139322ea92babe708f29023efa2f9f36beabe8549b1ecffd4d1547
Instruction Fuzzy Hash: AFE08632680318BBDB312B94EC09FDA7B18AB06771F144120FB646D0E087B16615A798

Function 00F88F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F88FA5

Part of subcall function 00F42F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00F49C64), ref: 00F42FA9
Part of subcall function 00F42F95: GetLastError.KERNEL32(00000000,?,00F49C64), ref: 00F42FBB

_free.LIBCMT ref: 00F88FB6
_free.LIBCMT ref: 00F88FC8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 40db779c96ef09ef1aec1ab9d198ca660db0d8e8fee454cbf6b0b4f0168accc1
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 14E012A1B097114ACA64B578AD41AD36FEE5F483F07D8082DB909DB146DE28F846A624

Function 00F2AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00F6002B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 1e8f4fb5d33a79050f42f5599ffaed6fa12635cd41492646b98abde607dd99f9
Instruction ID: 87f54ccc9929a8461542bbc701e333d5aa11c2b95f213cbba3fcb7077da6caf2
Opcode Fuzzy Hash: 1e8f4fb5d33a79050f42f5599ffaed6fa12635cd41492646b98abde607dd99f9
Instruction Fuzzy Hash: 8B224871908351DFC724DF14D894B2ABBE1BF84310F15895DE8968B362DB35EC85EB82

Function 00F24DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F24E1A

Strings

EA06, xrefs: 00F5DCF5

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 0e82aad45aa6f0125db2a28d4afe7791efebb908df70db7507d5b24b42e329bd
Instruction ID: ac531285f2e51b32a4ce680bfc6a64fb242b077da71a50d089032f294b1519eb
Opcode Fuzzy Hash: 0e82aad45aa6f0125db2a28d4afe7791efebb908df70db7507d5b24b42e329bd
Instruction Fuzzy Hash: 3741AF32E049745BEF21DB64EC517BE7FA2AB41310F594074EC429B182C6B5BD44B7A1

Function 00F2492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00F24992

Part of subcall function 00F435AC: __lock.LIBCMT ref: 00F435B2
Part of subcall function 00F435AC: DecodePointer.KERNEL32(00000001,?,00F249A7,00F781BC), ref: 00F435BE
Part of subcall function 00F435AC: EncodePointer.KERNEL32(?,?,00F249A7,00F781BC), ref: 00F435C9

Part of subcall function 00F24A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00F24A73
Part of subcall function 00F24A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F24A88

Part of subcall function 00F23B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F23B7A
Part of subcall function 00F23B4C: IsDebuggerPresent.KERNEL32 ref: 00F23B8C
Part of subcall function 00F23B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,00FE62F8,00FE62E0,?,?), ref: 00F23BFD
Part of subcall function 00F23B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00F23C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F249D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 6902f81d0692355f68f25c0fd668e5fd746f943d17fc5bf5e275ca6288b35ac8
Instruction ID: 29328bfe1ef31a9506252046ac63d4e7450610e7fcfc41f39f0232c8cc53ac53
Opcode Fuzzy Hash: 6902f81d0692355f68f25c0fd668e5fd746f943d17fc5bf5e275ca6288b35ac8
Instruction Fuzzy Hash: 0B11CD719083699BC700EF28EC8590AFFF8EF99750F00451EF5448B2B1DBB4A544EB92

Function 00F25DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00F25981,?,?,?,?), ref: 00F25E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00F25981,?,?,?,?), ref: 00F5E19C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b4ec098ce865f9433a6b37506c5841d6ae11f4a46d1a064fe952612f97d5a6b0
Instruction ID: 828cd298e16a170c39d5db144d5cde8339cf900f3535d03e0f804a4158654691
Opcode Fuzzy Hash: b4ec098ce865f9433a6b37506c5841d6ae11f4a46d1a064fe952612f97d5a6b0
Instruction Fuzzy Hash: 3201B971644B18BEF3240E24DC86F76379CEB01B78F108314BAE55A1D0C6B45E499B50

Function 00F40FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F4594C: __FF_MSGBANNER.LIBCMT ref: 00F45963
Part of subcall function 00F4594C: __NMSG_WRITE.LIBCMT ref: 00F4596A
Part of subcall function 00F4594C: RtlAllocateHeap.NTDLL(01120000,00000000,00000001,00000000,?,?,?,00F41013,?), ref: 00F4598F

std::exception::exception.LIBCMT ref: 00F4102C
__CxxThrowException@8.LIBCMT ref: 00F41041

Part of subcall function 00F487DB: RaiseException.KERNEL32(?,?,?,00FDBAF8,00000000,?,?,?,?,00F41046,?,00FDBAF8,?,00000001), ref: 00F48830

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: c6b3c7a44bce7bbc86b6b13e1328525abc18371b50a52bacd2f839ebebf7005f
Instruction ID: 9ae6c4a81115d0bf9571985800ebbf00a419f195ca484375d2253ddc9ed8458d
Opcode Fuzzy Hash: c6b3c7a44bce7bbc86b6b13e1328525abc18371b50a52bacd2f839ebebf7005f
Instruction Fuzzy Hash: A9F0A435500219A6CB20BA5DEC159DF7FA8AF053A1F100526FC0496692EFB58AC1B695

Function 00F4582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4585C
__lock_file.LIBCMT ref: 00F4587D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: d5972afc130f36f83d01e1fe7303a4668334dd819c0b2503c9377613ecd9fbce
Instruction ID: c281e59cf29ec7a9ec9307244aca0316e84f2b0b880cf6223811532c8ee5dce9
Opcode Fuzzy Hash: d5972afc130f36f83d01e1fe7303a4668334dd819c0b2503c9377613ecd9fbce
Instruction Fuzzy Hash: 93018471C00609EBCF22BF698C0159E7F61AF81BA0F148215BC245B1A2DF398A52FB91

Function 00F455D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

__lock_file.LIBCMT ref: 00F4561B

Part of subcall function 00F46E4E: __lock.LIBCMT ref: 00F46E71

__fclose_nolock.LIBCMT ref: 00F45626

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: dc833854456cf465dc3be16c2960a1a3d90eb78161f76fcb04e9e1b93cbd66a4
Instruction ID: d0c019eff264ad76ed8e074b287cbe24ec617a2cbc84a14ceaae34c80f44ea1e
Opcode Fuzzy Hash: dc833854456cf465dc3be16c2960a1a3d90eb78161f76fcb04e9e1b93cbd66a4
Instruction Fuzzy Hash: 72F09072C01A059BDB20BF758C0276E7FA16F41B74F568209AC24AB1C2CF7C8942BB55

Function 01DA129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01DA1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01DA1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01DA1B13

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: 5a54894fc845ef47653183a2fa5c258d7f9fb972a19c1d5b38bff4ae8ee82da1
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: DF12CD24E24658C6EB24DF64D8507DEB232EF68300F5090E9910DEB7A5E77A4F81CF5A

Function 00F2F3F0 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e1eaecd0661574d0f2cf6bae390920a762722f26bb763a1892f7021cc87ab9
Instruction ID: 03b0fdbf473f6450eea54d37e256de91d493fa06920c90314f210624aa4a57f8
Opcode Fuzzy Hash: a7e1eaecd0661574d0f2cf6bae390920a762722f26bb763a1892f7021cc87ab9
Instruction Fuzzy Hash: A561CE71A1021A9FDB10EF24E981BABB7F4EF04310F14813DE9068B281E775ED59EB51

Function 00F32123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37bf4a81a97d2e6301a6c808e5eabc98ad9b009729714522a1da640af38884f7
Instruction ID: f70803581c1100cf70c7b96abbf7e0827616dd72b50e18c78fd5a68288fca8b3
Opcode Fuzzy Hash: 37bf4a81a97d2e6301a6c808e5eabc98ad9b009729714522a1da640af38884f7
Instruction Fuzzy Hash: AB51A335A00614AFDF14EF64CD92F6E77A5AF84720F148168F806AB392CB38ED04EB51

Function 00F2766F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F2774A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ff4398cb78296a2dbd202ebd1e29aa3c893a1f701c43b194804ea4deae2e0d62
Instruction ID: eb80429c35fcfe22c7ee4fcc351e4b0427be1388949ef608036a1af04961e562
Opcode Fuzzy Hash: ff4398cb78296a2dbd202ebd1e29aa3c893a1f701c43b194804ea4deae2e0d62
Instruction Fuzzy Hash: D4318775608B12DFC724AF1DD490A22FBA0FF09320714C56DE9598B755EB30D881EB54

Function 00F25C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00F25CF6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e5618e2355b4fc18f9ed36122d7746335ce2cc7a32df73d4a7c4aadd2b7d492f
Instruction ID: 1ae959c9dd960862201beddcc5dada393cbfbc5e364116371e29f6e3b2771cd3
Opcode Fuzzy Hash: e5618e2355b4fc18f9ed36122d7746335ce2cc7a32df73d4a7c4aadd2b7d492f
Instruction Fuzzy Hash: 42316E71A00B2AAFCB18CF6DD48465DB7B5FF48720F148629D81997710E731BD50EB90

Function 00F600D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00F600E1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4446fd6f4e0d66f531788983b729fd7ea0816353569f055ccb3156314e219c78
Instruction ID: f7c36cf2661a451b93ea30a86110a05f953ad1159c95a05b94a2f09e6418055f
Opcode Fuzzy Hash: 4446fd6f4e0d66f531788983b729fd7ea0816353569f055ccb3156314e219c78
Instruction Fuzzy Hash: F0411B74908351CFDB24DF14C884B1ABBE0BF45318F19889CE8898B362C775EC85DB52

Function 00F2C68D Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00F2C73D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 673a25b9b800fe66fbddc35c298a3757295b3b476248960ad9d1c2940db7a80f
Instruction ID: a6855e6acb0f9318d9148906ea3835b5870306b82bbcc36930a645b6f0541935
Opcode Fuzzy Hash: 673a25b9b800fe66fbddc35c298a3757295b3b476248960ad9d1c2940db7a80f
Instruction Fuzzy Hash: 7521C772C483E54FD7229B799C50399BFB49F67624F4941D6CC905B2E3E2288C06DB92

Function 00F2C707 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00F2C73D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 01a48180207af67d1b6c02c41677056d1e9833ae5e32ea519f7942b88612dd98
Instruction ID: 6f29b78935213979bcd1aa9f6993b75e9d4f37e5d6f5045cb04d3424f5b077be
Opcode Fuzzy Hash: 01a48180207af67d1b6c02c41677056d1e9833ae5e32ea519f7942b88612dd98
Instruction Fuzzy Hash: 62119072904229DBCB14ABA9EC819EEF778BF90760F144116E811A7190EB349D05EB91

Function 00F280D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F28109

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction ID: ddd61b2d268aca65e1800548b4e36fc9ad76b8f062751d4c306c095e2a410044
Opcode Fuzzy Hash: 46acc021f7701719685bd31058d1bf319928b5265fe0d6ec76a5632e42df60c5
Instruction Fuzzy Hash: 89115176605605DFC724CF28E481A16BBE5FF48354720C42EE98ACB361DB32E852DB50

Function 00F24F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F24D13: FreeLibrary.KERNEL32(00000000,?), ref: 00F24D4D

Part of subcall function 00F4548B: __wfsopen.LIBCMT ref: 00F45496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00FE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F24F6F

Part of subcall function 00F24CC8: FreeLibrary.KERNEL32(00000000), ref: 00F24D02

Part of subcall function 00F24DD0: _memmove.LIBCMT ref: 00F24E1A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: caa7fee0bd518b5cc07c2a14c369a275e31a70745c3217fa8ecb11b7e7f2c358
Instruction ID: 7fd24dc86c37831d6eb7b511f4990f254f836a788670b1e49cbc5b02f871502c
Opcode Fuzzy Hash: caa7fee0bd518b5cc07c2a14c369a275e31a70745c3217fa8ecb11b7e7f2c358
Instruction Fuzzy Hash: AF110D32600326ABCF10FF74EC12FAD77A49F80711F108429F9419F1C1DAB9AA05BB60

Function 00F601AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00F601BB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8dbad99e825c6f1613eec1c5872f635cc78641dacee506c1583a133586a26399
Instruction ID: a20fee0fe4ac8ae62be9b6b7328e06b35ac1d503fe2cf22377cee17d70eaffd4
Opcode Fuzzy Hash: 8dbad99e825c6f1613eec1c5872f635cc78641dacee506c1583a133586a26399
Instruction Fuzzy Hash: DE2124B4908351CFCB24DF64D844B1BBBE0BF88314F058968E88A47761D735E849EB53

Function 00F25D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00F25807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00F25D76

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c08eb76b52d979e774986e78a11695f3e6f594dba539a770b9a0e0bad38930bf
Instruction ID: 74fc4276bf835437116c66905549f01849a9498a9da8efb9e52babec2a268b21
Opcode Fuzzy Hash: c08eb76b52d979e774986e78a11695f3e6f594dba539a770b9a0e0bad38930bf
Instruction Fuzzy Hash: 9A116A35608B009FD3308F15E884B62B7E4EF45B20F50C92EE8AA8AA50D770E944DF60

Function 00F44A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00F44AD6

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: f1139447a64c7e18e72cab76d41b23f267e8bab65c101827c447ef7694d2b971
Instruction ID: 9ddd4dd8e950bca25b8c8eb50ff3240b07af52b1eb114461fa09a3894e11d59f
Opcode Fuzzy Hash: f1139447a64c7e18e72cab76d41b23f267e8bab65c101827c447ef7694d2b971
Instruction Fuzzy Hash: B3F0AF31940209ABDF61AF648C0639E3EA1AF40375F088515BC24BA1D1DB7C9A51FF55

Function 00F24FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00FE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F24FDE

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f8837e7667e3f231fce935cf97a735a651a2c57735909d3e165f63f85ae6d279
Instruction ID: 46b6415d74eb83da1dcd1a161bd5d3c9bef2e9849f8794d891895f0c5815ff97
Opcode Fuzzy Hash: f8837e7667e3f231fce935cf97a735a651a2c57735909d3e165f63f85ae6d279
Instruction Fuzzy Hash: 52F03972505722CFCB34DFA4F994822BBE1BF443293248A3EE5D683A10C7B1A844EF40

Function 00F409D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00F409F4

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 2d3ce3ababaf2054e880290a995704051cf64ffac64507d2585766c112c92b55
Instruction ID: b36b0b72dba18e7e2bb1dd87e65b9bf6a9c36533770743a11918cce0be3cc4bc
Opcode Fuzzy Hash: 2d3ce3ababaf2054e880290a995704051cf64ffac64507d2585766c112c92b55
Instruction Fuzzy Hash: 12E07D3290022C57C720E2989C05FFA73ECDFC9390F0001B1FC0CC7204D964AC818690

Function 00F89129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F8914B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: ece3a6448a6be0b914e8c606efadba80c71aab9a1684fa97a8a5fab751195183
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 48E092B0518B005FDB349A24DC147E377E0AB06315F04081CF69A83342EFA37841D759

Function 00F25DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00F5E16B,?,?,00000000), ref: 00F25DBF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 30bb2593a7eb36bddf7acf5d8d5543ee652f40b0c5a2114fc57328132fe5d056
Instruction ID: e82b404784f0137d9034197ca05f1b2123f7937d17eafcaddd2eabd051139f60
Opcode Fuzzy Hash: 30bb2593a7eb36bddf7acf5d8d5543ee652f40b0c5a2114fc57328132fe5d056
Instruction Fuzzy Hash: D8D0C77464020CBFE710DB80DC46FA9777CD705710F100194FD0456290D6B27D549795

Function 00F4548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00F45496

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 0b9ebdcc3d2bca2be2e9f73b9a6e2bc48d479c6ebdeadbd98e9e07712fbe00c5
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 80B0927684020C77DE012E82EC02A593F199B40A78F808020FF0C1C172A677AAA0A689

Function 00F8D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00F8D46A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: ff6b817b317661851deec48e597e528f2db8e62c40f35088000498f74f388f22
Instruction ID: 8c4948a930edf25afa83169a0999278097b7cdca4d36a98fe960f705644fe5db
Opcode Fuzzy Hash: ff6b817b317661851deec48e597e528f2db8e62c40f35088000498f74f388f22
Instruction Fuzzy Hash: E67166306083118FCB14FF24D891AAEB7E0AF88714F04456DF5969B2A1DF74ED49EB52

Function 00F40E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00F40EF7

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 9d6abbf9036e0171bb968f0dc152833f6518ec94fb611fa8c1c9e60c3f312d97
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6131CB71A00105DFC718DF58D480A69FBA5FF99310B648AA5E909CB651EB31EDD1EBC0

Function 01DA229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01DA22B1

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: feb76373901ad26097e0963b36ac45bf0d802c735044772b88a9d02fe97139bd
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 99E0BF7494010EEFDB00EFA4D5496DE7BB4EF04311F1005A1FD05D7681DB309E548A62

Function 01DA22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01DA22B1

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 38556891578e84a9e0d14826d2f3302d1e2f0d0e21298345d45b10793488872e
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 80E0E67494010EDFDB00EFB4D54969E7FF4EF04301F100161FD01D2281D6309D508A72

Non-executed Functions

Function 00FACDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00FACE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FACE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00FACED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FACF00
SendMessageW.USER32 ref: 00FACF29
_wcsncpy.LIBCMT ref: 00FACFA1
GetKeyState.USER32(00000011), ref: 00FACFC2
GetKeyState.USER32(00000009), ref: 00FACFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00FACFE5
GetKeyState.USER32(00000010), ref: 00FACFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00FAD018
SendMessageW.USER32 ref: 00FAD03F
SendMessageW.USER32(?,00001030,?,00FAB602), ref: 00FAD145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00FAD15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00FAD16E
SetCapture.USER32(?), ref: 00FAD177
ClientToScreen.USER32(?,?), ref: 00FAD1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00FAD1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FAD203
ReleaseCapture.USER32 ref: 00FAD20E
GetCursorPos.USER32(?), ref: 00FAD248
ScreenToClient.USER32(?,?), ref: 00FAD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FAD2B1
SendMessageW.USER32 ref: 00FAD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FAD31C
SendMessageW.USER32 ref: 00FAD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00FAD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00FAD37B
GetCursorPos.USER32(?), ref: 00FAD39B
ScreenToClient.USER32(?,?), ref: 00FAD3A8
GetParent.USER32(?), ref: 00FAD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00FAD431
SendMessageW.USER32 ref: 00FAD462
ClientToScreen.USER32(?,?), ref: 00FAD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00FAD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00FAD51A
SendMessageW.USER32 ref: 00FAD53D
ClientToScreen.USER32(?,?), ref: 00FAD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00FAD5C3

Part of subcall function 00F225DB: GetWindowLongW.USER32(?,000000EB), ref: 00F225EC

GetWindowLongW.USER32(?,000000F0), ref: 00FAD65F

Strings

F, xrefs: 00FAD543
@GUI_DRAGID, xrefs: 00FAD1AA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 9425665c2268fc45bb9ae63892c27a70cde19bee003d8ad45297d30e3d9e1de0
Instruction ID: 2a5686a8a924ad2afd9c628fde40d1c3e00b72b75d9f49c5f44fd48744eb4feb
Opcode Fuzzy Hash: 9425665c2268fc45bb9ae63892c27a70cde19bee003d8ad45297d30e3d9e1de0
Instruction Fuzzy Hash: 1A42B1B0604345EFD724CF68C884F6ABBE5FF4A364F14051DF6968B2A1C731A944EB92

Function 00FA804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00FA873F

Strings

%d/%02d/%02d, xrefs: 00FA8478

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 1fc9551f861598d9eb34b3f15ea18ed5a911aee2d32eecf24f18449fc0a39e51
Instruction ID: 4bd9f2b876b41abfd356157a475318be5865879e261119fac7b9a070ee3000b4
Opcode Fuzzy Hash: 1fc9551f861598d9eb34b3f15ea18ed5a911aee2d32eecf24f18449fc0a39e51
Instruction Fuzzy Hash: 3812D5B1900208AFEB258F64CC49FAA7BF4EF46360F144129F915DB2E1DFB49946EB50

Function 00F3710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F375C2
_memset.LIBCMT ref: 00F376B1
_memmove.LIBCMT ref: 00F37C4B
_memmove.LIBCMT ref: 00F37E4F

Strings

\b(?=\w), xrefs: 00F73C34
[:>:]], xrefs: 00F3760A
[:<:]], xrefs: 00F375F1
\b(?<=\w), xrefs: 00F73C41
DEFINE, xrefs: 00F725AF
Q\E, xrefs: 00F381C1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: de0a2de6e1b363c014bab2892e090885a6df1c05f6e167efe15541b55405d5c1
Instruction ID: 0d209db5c3ae79ee3237db67fa84f11a1137de4392714ef4a0417df3215ec4c0
Opcode Fuzzy Hash: de0a2de6e1b363c014bab2892e090885a6df1c05f6e167efe15541b55405d5c1
Instruction Fuzzy Hash: 0F93A371E04215DFDB24DF58C881BADB7B1FF48320F24816BE949AB281E7749E81EB51

Function 00F24A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00F24A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00F5DA8E
IsIconic.USER32(?), ref: 00F5DA97
ShowWindow.USER32(?,00000009), ref: 00F5DAA4
SetForegroundWindow.USER32(?), ref: 00F5DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F5DAC4
GetCurrentThreadId.KERNEL32 ref: 00F5DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F5DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F5DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00F5DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00F5DAF8
SetForegroundWindow.USER32(?), ref: 00F5DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F5DB10
keybd_event.USER32(00000012,00000000), ref: 00F5DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F5DB25
keybd_event.USER32(00000012,00000000), ref: 00F5DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F5DB33
keybd_event.USER32(00000012,00000000), ref: 00F5DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F5DB42
keybd_event.USER32(00000012,00000000), ref: 00F5DB47
SetForegroundWindow.USER32(?), ref: 00F5DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00F5DB71

Strings

Shell_TrayWnd, xrefs: 00F5DA89

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: fec74750cacf753bcf2c3709a03296e4bfd271dfecddb92828e34d018ba8bf17
Instruction ID: fa9199c61bb2cf787cee019b0e7d520c1d8a5fefa8874fa6b45841fda8022567
Opcode Fuzzy Hash: fec74750cacf753bcf2c3709a03296e4bfd271dfecddb92828e34d018ba8bf17
Instruction Fuzzy Hash: D2316FB1E4131CBEEB306FA19C49F7F3E6CEB85B61F154025FA04AA1D1D6B05904BAA0

Function 00F78858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00F78CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F78D0D
Part of subcall function 00F78CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F78D3A
Part of subcall function 00F78CC3: GetLastError.KERNEL32 ref: 00F78D47

_memset.LIBCMT ref: 00F7889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00F788ED
CloseHandle.KERNEL32(?), ref: 00F788FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00F78915
GetProcessWindowStation.USER32 ref: 00F7892E
SetProcessWindowStation.USER32(00000000), ref: 00F78938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00F78952

Part of subcall function 00F78713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F78851), ref: 00F78728
Part of subcall function 00F78713: CloseHandle.KERNEL32(?,?,00F78851), ref: 00F7873A

Strings

, xrefs: 00F788AA
default, xrefs: 00F7894D
winsta0, xrefs: 00F78910

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 5fcfe7724896b0141fd3368ede98977cdcdd9a6c0730a42dd56159614dfb69bc
Instruction ID: a7e99931af017d1e2dec18be4457e9024177b41bbdd352e90a89090095b089e6
Opcode Fuzzy Hash: 5fcfe7724896b0141fd3368ede98977cdcdd9a6c0730a42dd56159614dfb69bc
Instruction Fuzzy Hash: 86815171D40209BFEF11DFA4DC49AEE7B78EF04354F08812BF914A6161DB358E15AB61

Function 00F9425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00FAF910), ref: 00F94284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00F94292
GetClipboardData.USER32(0000000D), ref: 00F9429A
CloseClipboard.USER32 ref: 00F942A6
GlobalLock.KERNEL32(00000000), ref: 00F942C2
CloseClipboard.USER32 ref: 00F942CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00F942E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00F942EE
GetClipboardData.USER32(00000001), ref: 00F942F6
GlobalLock.KERNEL32(00000000), ref: 00F94303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00F94337
CloseClipboard.USER32 ref: 00F94447

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 5b5710fbd890aac7a703e1217ee949ac18bf913db6f85f53a0967d9adc523e89
Instruction ID: 7e78aa79c3643fd3b2820ddb587a1cd1c09f0070b167f779d465df90871be0c3
Opcode Fuzzy Hash: 5b5710fbd890aac7a703e1217ee949ac18bf913db6f85f53a0967d9adc523e89
Instruction Fuzzy Hash: 4C510771204305AFE710EFA0EC85F6E77A8AF95B10F000529F546D61E1DF74E90AAB62

Function 00F8C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F8C9F8
FindClose.KERNEL32(00000000), ref: 00F8CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F8CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00F8CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00F8CAAF
__swprintf.LIBCMT ref: 00F8CAFB
__swprintf.LIBCMT ref: 00F8CB3E

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

__swprintf.LIBCMT ref: 00F8CB92

Part of subcall function 00F438D8: __woutput_l.LIBCMT ref: 00F43931

__swprintf.LIBCMT ref: 00F8CBE0

Part of subcall function 00F438D8: __flsbuf.LIBCMT ref: 00F43953
Part of subcall function 00F438D8: __flsbuf.LIBCMT ref: 00F4396B

__swprintf.LIBCMT ref: 00F8CC2F
__swprintf.LIBCMT ref: 00F8CC7E
__swprintf.LIBCMT ref: 00F8CCCD

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F8CAF5
%4d, xrefs: 00F8CB38
%02d, xrefs: 00F8CB86, 00F8CB90, 00F8CBDE, 00F8CC2D, 00F8CC7C, 00F8CCCB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 5f778e9bae69f3e999434c04c0c1c9c9278bf18451d09c33dd488c5aaafab6a4
Instruction ID: ecb895465e840aad803f29bf7f0aa9b484bb4c63cfd921edf02f7e2ec2704bc8
Opcode Fuzzy Hash: 5f778e9bae69f3e999434c04c0c1c9c9278bf18451d09c33dd488c5aaafab6a4
Instruction Fuzzy Hash: 9FA130B2508314ABC700FB64DD96DAFB7ECEF94700F404919F585D7191EA78DA08DB62

Function 00F8F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F8F221
_wcscmp.LIBCMT ref: 00F8F236
_wcscmp.LIBCMT ref: 00F8F24D
GetFileAttributesW.KERNEL32(?), ref: 00F8F25F
SetFileAttributesW.KERNEL32(?,?), ref: 00F8F279
FindNextFileW.KERNEL32(00000000,?), ref: 00F8F291
FindClose.KERNEL32(00000000), ref: 00F8F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00F8F2B8
_wcscmp.LIBCMT ref: 00F8F2DF
_wcscmp.LIBCMT ref: 00F8F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00F8F308
SetCurrentDirectoryW.KERNEL32(00FDA5A0), ref: 00F8F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F8F330
FindClose.KERNEL32(00000000), ref: 00F8F33D
FindClose.KERNEL32(00000000), ref: 00F8F34F

Strings

*.*, xrefs: 00F8F2B3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 0290247bf128d5a100324cb77f178c93dd172152c654149822acda41ed288371
Instruction ID: 8c6c96e090f5cc23ef8a53ac05eb2b9b3d26a71ee14fdd481819c01634a9e471
Opcode Fuzzy Hash: 0290247bf128d5a100324cb77f178c93dd172152c654149822acda41ed288371
Instruction Fuzzy Hash: 0E31B276A002196EDB10EBB4EC48ADE77ECAF49371F140176E844D3090EB34DA49AB64

Function 00FA0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FA0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,00FAF910,00000000,?,00000000,?,?), ref: 00FA0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00FA0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00FA0D1D
RegCloseKey.ADVAPI32(?), ref: 00FA103D
RegCloseKey.ADVAPI32(00000000), ref: 00FA104A

Strings

REG_QWORD, xrefs: 00FA0F8B
REG_SZ, xrefs: 00FA0D5B
REG_EXPAND_SZ, xrefs: 00FA0CBA
REG_MULTI_SZ, xrefs: 00FA0E05
REG_BINARY, xrefs: 00FA0FD8
REG_DWORD, xrefs: 00FA0F0E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: a48100ce7dfaa19d4f469b7d24686e8a43ebbed2647743ca01667ef52cd747be
Instruction ID: c9ddbaa44928ebd5ee5da90766cd789198f19da1e1babcaaf02a5fee21cd931c
Opcode Fuzzy Hash: a48100ce7dfaa19d4f469b7d24686e8a43ebbed2647743ca01667ef52cd747be
Instruction Fuzzy Hash: 9802A0756046119FDB14EF24D881E2AB7E5FF89720F05885DF8899B362CB75EC40EB81

Function 00F8F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00F8F37E
_wcscmp.LIBCMT ref: 00F8F393
_wcscmp.LIBCMT ref: 00F8F3AA

Part of subcall function 00F845C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00F845DC

FindNextFileW.KERNEL32(00000000,?), ref: 00F8F3D9
FindClose.KERNEL32(00000000), ref: 00F8F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00F8F400
_wcscmp.LIBCMT ref: 00F8F427
_wcscmp.LIBCMT ref: 00F8F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00F8F450
SetCurrentDirectoryW.KERNEL32(00FDA5A0), ref: 00F8F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F8F478
FindClose.KERNEL32(00000000), ref: 00F8F485
FindClose.KERNEL32(00000000), ref: 00F8F497

Strings

*.*, xrefs: 00F8F3FB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: d656c6dd0b0d6b1767786230a9cec7783e5c570ac2a00bda140e2ea6ac3f5a90
Instruction ID: 53c2e3ba3f7dfbb2dd5524365622e89e14538e9b5eb2735ec6a4f496bcb9b7e9
Opcode Fuzzy Hash: d656c6dd0b0d6b1767786230a9cec7783e5c570ac2a00bda140e2ea6ac3f5a90
Instruction Fuzzy Hash: 3B318672A0121D6ECB10EBA4EC88ADE77AC9F49374F140176E850961A1E774DA4CEB64

Function 00F781F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F78766
Part of subcall function 00F7874A: GetLastError.KERNEL32(?,00F7822A,?,?,?), ref: 00F78770
Part of subcall function 00F7874A: GetProcessHeap.KERNEL32(00000008,?,?,00F7822A,?,?,?), ref: 00F7877F
Part of subcall function 00F7874A: HeapAlloc.KERNEL32(00000000,?,00F7822A,?,?,?), ref: 00F78786
Part of subcall function 00F7874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F7879D

Part of subcall function 00F787E7: GetProcessHeap.KERNEL32(00000008,00F78240,00000000,00000000,?,00F78240,?), ref: 00F787F3
Part of subcall function 00F787E7: HeapAlloc.KERNEL32(00000000,?,00F78240,?), ref: 00F787FA
Part of subcall function 00F787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F78240,?), ref: 00F7880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F7825B
_memset.LIBCMT ref: 00F78270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F7828F
GetLengthSid.ADVAPI32(?), ref: 00F782A0
GetAce.ADVAPI32(?,00000000,?), ref: 00F782DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F782F9
GetLengthSid.ADVAPI32(?), ref: 00F78316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F78325
HeapAlloc.KERNEL32(00000000), ref: 00F7832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F7834D
CopySid.ADVAPI32(00000000), ref: 00F78354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F78385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F783AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F783BF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 76b2520324400d1b081eff8b062129e6b306a1444ac057bb4c6e5ad2d9c91ca6
Instruction ID: 4de570c872d875caa2e4af375da56d6afe938f59fbe23fbfe3309ac999566027
Opcode Fuzzy Hash: 76b2520324400d1b081eff8b062129e6b306a1444ac057bb4c6e5ad2d9c91ca6
Instruction Fuzzy Hash: 23616E71940209AFDF10DF94DC48AEEBB79FF04750F14C12AF819AB291DB359A06EB61

Function 00F36843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF), xrefs: 00F71533
LIMIT_MATCH=, xrefs: 00F715A9
NO_AUTO_POSSESS), xrefs: 00F71567
ANYCRLF), xrefs: 00F71734
CR), xrefs: 00F716C0
ANY), xrefs: 00F71717
BSR_UNICODE), xrefs: 00F71771
UCP), xrefs: 00F71546
BSR_ANYCRLF), xrefs: 00F71757
LF), xrefs: 00F716DD
NO_START_OPT), xrefs: 00F71588
CRLF), xrefs: 00F716FA
LIMIT_RECURSION=, xrefs: 00F71635
UTF16), xrefs: 00F71508

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: b68b012690eef7f7801e03a4d0cca0783ba492809659c27743fd5a726575fec2
Instruction ID: b07fb15f18466843a4141eaf8a516eb3fc59892cd3a217b48cf4628cf6e57683
Opcode Fuzzy Hash: b68b012690eef7f7801e03a4d0cca0783ba492809659c27743fd5a726575fec2
Instruction Fuzzy Hash: A8726F71E00219DBDB24CF58C8907AEB7B5FF48720F14C16AE949EB280DB749D85EB91

Function 00FA0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FA0038,?,?), ref: 00FA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FA0737

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00FA07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00FA086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00FA0AAD
RegCloseKey.ADVAPI32(00000000), ref: 00FA0ABA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 773bf2c0bc840da8f9abe6f2cb420d7caa9fd73ca02e0d6cb6f5b59b94d324fe
Instruction ID: 77dea8eb9c3543a3c4f281ff3c9f4d8fe59b5adffbb3ee33398d6dac3ba00c51
Opcode Fuzzy Hash: 773bf2c0bc840da8f9abe6f2cb420d7caa9fd73ca02e0d6cb6f5b59b94d324fe
Instruction Fuzzy Hash: BAE14D71604310AFCB14DF24D891E2ABBE8EF89724F04896DF84ADB262DB34ED05DB51

Function 00F80219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F80241
GetAsyncKeyState.USER32(000000A0), ref: 00F802C2
GetKeyState.USER32(000000A0), ref: 00F802DD
GetAsyncKeyState.USER32(000000A1), ref: 00F802F7
GetKeyState.USER32(000000A1), ref: 00F8030C
GetAsyncKeyState.USER32(00000011), ref: 00F80324
GetKeyState.USER32(00000011), ref: 00F80336
GetAsyncKeyState.USER32(00000012), ref: 00F8034E
GetKeyState.USER32(00000012), ref: 00F80360
GetAsyncKeyState.USER32(0000005B), ref: 00F80378
GetKeyState.USER32(0000005B), ref: 00F8038A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 8f8dffcc1a0fbbfe1ffe9f7c37dc7f2c63f949f4072a3d4b7a2c0b5e19dc1adc
Instruction ID: 3b14563f04f73a468efa3c2ce4a2c2f181398ef2b62662a133f633811aa01aa3
Opcode Fuzzy Hash: 8f8dffcc1a0fbbfe1ffe9f7c37dc7f2c63f949f4072a3d4b7a2c0b5e19dc1adc
Instruction Fuzzy Hash: C141BC64D047C96EFFB1AAA488087F5BEA06F12360F88409DD5C5561C2DFD45DCCA7A2

Function 00F986D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

CoInitialize.OLE32 ref: 00F98718
CoUninitialize.OLE32 ref: 00F98723
CoCreateInstance.OLE32(?,00000000,00000017,00FB2BEC,?), ref: 00F98783
IIDFromString.OLE32(?,?), ref: 00F987F6
VariantInit.OLEAUT32(?), ref: 00F98890
VariantClear.OLEAUT32(?), ref: 00F988F1

Strings

Invalid parameter, xrefs: 00F9880F
NULL Pointer assignment, xrefs: 00F987C8
Failed to create object, xrefs: 00F9878E, 00F98844

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: dfc943e41a109e239338b928c00f1e55bea4bdd30c9f1904c1fce451f3eea52f
Instruction ID: 27e0f3ef03ac3e79f0f7b1a5fd2e44b739c804a1d593572b25efbbbd3dfb850f
Opcode Fuzzy Hash: dfc943e41a109e239338b928c00f1e55bea4bdd30c9f1904c1fce451f3eea52f
Instruction Fuzzy Hash: BA6103716083019FEB10DF64C844F5ABBE8AF4A760F10481DF9859B291CB74ED49EBA3

Function 00F94458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00F9447F
EmptyClipboard.USER32 ref: 00F94485
GlobalAlloc.KERNEL32(00000002,?), ref: 00F9449A
CloseClipboard.USER32 ref: 00F94539

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d90d2f4892e96937170fa69be7d299bad4e13b6bd3055cc9ec379c11903416cc
Instruction ID: 7d0e528a12a1178914aa40ef2e9811f36d1b303718e56c42c0b6e60f8c940d1b
Opcode Fuzzy Hash: d90d2f4892e96937170fa69be7d299bad4e13b6bd3055cc9ec379c11903416cc
Instruction Fuzzy Hash: 2F21D3756002249FEB109FA4EC09F6D7BA8EF14720F14802AF946DB261DB78AC02EB44

Function 00F83A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F248A1,?,?,00F237C0,?), ref: 00F248CE

Part of subcall function 00F84CD3: GetFileAttributesW.KERNEL32(?,00F83947), ref: 00F84CD4

FindFirstFileW.KERNEL32(?,?), ref: 00F83ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00F83B87
MoveFileW.KERNEL32(?,?), ref: 00F83B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00F83BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00F83BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00F83BF5

Strings

\*.*, xrefs: 00F83A8A, 00F83A93, 00F83AA8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 50ff6e243e89caedffe78cce1f3c4cafdf3437286fec13ad9e1fd5e1bac85bc7
Instruction ID: 2f463b5bdac82e99fad7113782bde04c2fcfeacdfb22c1b13f71c3a7531eda34
Opcode Fuzzy Hash: 50ff6e243e89caedffe78cce1f3c4cafdf3437286fec13ad9e1fd5e1bac85bc7
Instruction Fuzzy Hash: 4A519F7180125D9ACF15FBA0DD929EDB7B8AF15710F2441A9E442770A1EF386F0DEBA0

Function 00F8F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00F8F6AB
Sleep.KERNEL32(0000000A), ref: 00F8F6DB
_wcscmp.LIBCMT ref: 00F8F6EF
_wcscmp.LIBCMT ref: 00F8F70A
FindNextFileW.KERNEL32(?,?), ref: 00F8F7A8
FindClose.KERNEL32(00000000), ref: 00F8F7BE

Strings

*.*, xrefs: 00F8F690

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: a38c0aeeff487f71da7614d354ec45f799d3b04feb0a56486ca2a3395a76bf25
Instruction ID: 4cabd47e1f7e8d18821ba9ec1bc7b78e4c2dfb6aabbb9c7f4cd2ef43bd132d52
Opcode Fuzzy Hash: a38c0aeeff487f71da7614d354ec45f799d3b04feb0a56486ca2a3395a76bf25
Instruction Fuzzy Hash: 62418171D0021A9FDF15EFA4CC49AEEBBB4FF05310F144566E815A7190EB349E58EBA0

Function 00F34140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00F344ED
ERCP, xrefs: 00F3421F
VUUU, xrefs: 00F34520
VUUU, xrefs: 00F67B0C
VUUU, xrefs: 00F344DB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: cc6cbace1e3f9b3e5f5fc54abc456fffa6cba91fda58441e0bdbbd998ecac2e3
Instruction ID: a043c67ea4702b9351535443523186567b180ca090460c1f5c93d5e5fa6425e3
Opcode Fuzzy Hash: cc6cbace1e3f9b3e5f5fc54abc456fffa6cba91fda58441e0bdbbd998ecac2e3
Instruction Fuzzy Hash: 55A29071E0421ACBDF24DF58C9907ADB7B1BF54324F1486AAD856A7280E734BE81EF50

Function 00F358C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F35A05
_memmove.LIBCMT ref: 00F35A55
_memmove.LIBCMT ref: 00F35ABB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: add30e8463c43094cc8e40e1ee01e73e93753c463a04fd97b4454c50c1866859
Instruction ID: ab5a9fceb44b5b28fe70ca9b9d4dc4de0ba29df32f0eda5ded8f33b92c8d768a
Opcode Fuzzy Hash: add30e8463c43094cc8e40e1ee01e73e93753c463a04fd97b4454c50c1866859
Instruction Fuzzy Hash: 4F129070A00609DFDF14DFA4D981AAEB7F5FF88710F10852AE806E7251EB39AD11EB51

Function 00F8545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F78CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F78D0D
Part of subcall function 00F78CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F78D3A
Part of subcall function 00F78CC3: GetLastError.KERNEL32 ref: 00F78D47

ExitWindowsEx.USER32(?,00000000), ref: 00F8549B

Strings

SeShutdownPrivilege, xrefs: 00F8546B
, xrefs: 00F85489
@, xrefs: 00F8548E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: c8bd6a162c27f68ba31a336246c85a59836e610ad6a98dfcf7f78cd7e1055b76
Instruction ID: cc73d1035aebbc4673e5ea1f53f7dccfbd50d2c6094032e636f9a39154172693
Opcode Fuzzy Hash: c8bd6a162c27f68ba31a336246c85a59836e610ad6a98dfcf7f78cd7e1055b76
Instruction Fuzzy Hash: 5C014C71A54A051BE728F2B4DC5BBFA7258EB01F62F240122FC07D60D2D6645C847391

Function 00F96596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00F965EF
WSAGetLastError.WSOCK32(00000000), ref: 00F965FE
bind.WSOCK32(00000000,?,00000010), ref: 00F9661A
listen.WSOCK32(00000000,00000005), ref: 00F96629
WSAGetLastError.WSOCK32(00000000), ref: 00F96643
closesocket.WSOCK32(00000000,00000000), ref: 00F96657

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: c9fd67b812c5fbad963fce5588352b3c7199602719df47b280e69fb4a300c130
Instruction ID: e2f7b42ab9b06ac225aeefc5b4f3b1c8f6e51071ddda6f2daa6a7f98129a6d6d
Opcode Fuzzy Hash: c9fd67b812c5fbad963fce5588352b3c7199602719df47b280e69fb4a300c130
Instruction Fuzzy Hash: C921F031A002149FEF10EF64DC45B2EB3A8EF49320F108159E85AEB3D1CB78AC05EB51

Function 00F35680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00F40FF6: std::exception::exception.LIBCMT ref: 00F4102C
Part of subcall function 00F40FF6: __CxxThrowException@8.LIBCMT ref: 00F41041

_memmove.LIBCMT ref: 00F7062F
_memmove.LIBCMT ref: 00F70744
_memmove.LIBCMT ref: 00F707EB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 6585d983ef9fd37e560737461dd86bcbfcfa62cc1f2b725fead1c6d630f1d75d
Instruction ID: 557f4e8dbf3ba8db503f29d80002f727b0b4b078c78184b4fe28285d9b24c996
Opcode Fuzzy Hash: 6585d983ef9fd37e560737461dd86bcbfcfa62cc1f2b725fead1c6d630f1d75d
Instruction Fuzzy Hash: 0402D3B1E00209DFCF04DF64D981AAE7BB5FF84310F14806AE80ADB295EB35D951EB91

Function 00F21287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F219FA
GetSysColor.USER32(0000000F), ref: 00F21A4E
SetBkColor.GDI32(?,00000000), ref: 00F21A61

Part of subcall function 00F21290: DefDlgProcW.USER32(?,00000020,?), ref: 00F212D8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 6f5b8f5321abc5e3a7827d7abd9723e5bf994757ca267baaea63613571f7611f
Instruction ID: d0c08984dbba7f25517743a4b1d074c4edc45716fdbfc05ba859c5a8bcdae4e5
Opcode Fuzzy Hash: 6f5b8f5321abc5e3a7827d7abd9723e5bf994757ca267baaea63613571f7611f
Instruction Fuzzy Hash: D3A17DB25014A9BED638AB287C49F7F355CFFA23A2B140119F902D5192CE1E8D01F6BD

Function 00F96A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F980A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F980CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00F96AB1
WSAGetLastError.WSOCK32(00000000), ref: 00F96ADA
bind.WSOCK32(00000000,?,00000010), ref: 00F96B13
WSAGetLastError.WSOCK32(00000000), ref: 00F96B20
closesocket.WSOCK32(00000000,00000000), ref: 00F96B34

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 41a965c7550fb287b08f97c1f5519aa2708bc4d179d8a6defe0ad7c0123a7146
Instruction ID: 8397f617de7d3fa63468925ede41e8aa21dae421caddc786d1784a5f8ac390ba
Opcode Fuzzy Hash: 41a965c7550fb287b08f97c1f5519aa2708bc4d179d8a6defe0ad7c0123a7146
Instruction Fuzzy Hash: C741E975B006249FEF10AF64EC86F6E77A5DB48720F008058F90AEB3C2DA785D01AB91

Function 00FA55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00FA564C
IsWindowEnabled.USER32 ref: 00FA565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00FA5667
IsIconic.USER32 ref: 00FA5675
IsZoomed.USER32 ref: 00FA5683

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c1bb77c8b96f39f5a4efca4d63b98128d58073cc24be93c7adeec6efb0ae0d53
Instruction ID: c12bfb56cfea61f6066f74b9e935ab1e11bbbd03633b554f8e70246507dec3ef
Opcode Fuzzy Hash: c1bb77c8b96f39f5a4efca4d63b98128d58073cc24be93c7adeec6efb0ae0d53
Instruction Fuzzy Hash: 0E1127B2B00A206FE7211F66DC04B2F779CEF46B21F444029F806DB341CB74D901EAA4

Function 00F9C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F61D88,?), ref: 00F9C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00F9C324

Strings

kernel32.dll, xrefs: 00F9C30D
GetSystemWow64DirectoryW, xrefs: 00F9C31E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 5d3349ef427ec9c984443429d7163d265d181408b94e1491e3f57d0b4e6462f4
Instruction ID: 0894ebf59e149099724c16ccecb07f2f4e7f86cb44d72909d45b335499d31730
Opcode Fuzzy Hash: 5d3349ef427ec9c984443429d7163d265d181408b94e1491e3f57d0b4e6462f4
Instruction Fuzzy Hash: 6EE012B4A10713CFEF305F65D848E8676E4EF0A769B80C43AE895D6250E770D845EBA0

Function 00F33190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: c973618d694f230722cdb4366070bdfe956901482830524bdd8dcfcc447d5e26
Instruction ID: 41c96402f84a5a910c72894da8137f02c0391f730d614837fdc24b1bb0989ed7
Opcode Fuzzy Hash: c973618d694f230722cdb4366070bdfe956901482830524bdd8dcfcc447d5e26
Instruction Fuzzy Hash: DB22DE71A083119FC720EF24C891B6FB7E4BF84724F04491DF89A97291DB74EA44EB92

Function 00F9F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F9F151
Process32FirstW.KERNEL32(00000000,?), ref: 00F9F15F

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Process32NextW.KERNEL32(00000000,?), ref: 00F9F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00F9F22E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: d5293e53452ce17add2ffceb18c79ae812455ddcb3afcb0658de63b92d0cd950
Instruction ID: e8b948fbd50c000ad7ecd8d3b6174b523cf22595461a7c2bc327318abd2eb541
Opcode Fuzzy Hash: d5293e53452ce17add2ffceb18c79ae812455ddcb3afcb0658de63b92d0cd950
Instruction Fuzzy Hash: 1C517F715083119FD710EF20EC86E6BB7E8FF98710F14482DF59697291EB74A908DB92

Function 00F840B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00F840D1
_memset.LIBCMT ref: 00F840F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00F84144
CloseHandle.KERNEL32(00000000), ref: 00F8414D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: cc6f38f2632bc88f19f2c30bce63121b4df10cbc02a99a5d1536a54802a3e647
Instruction ID: 7f6ab66d322dee3f07a397fe690dbcb92e06c13f2f562315c1a7048d49b42320
Opcode Fuzzy Hash: cc6f38f2632bc88f19f2c30bce63121b4df10cbc02a99a5d1536a54802a3e647
Instruction Fuzzy Hash: AE11EBB5D0122C7AD7305BA59C4DFEBBB7CEF45760F104296F908D7180D6744E849BA4

Function 00F7EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00F7EB19

Strings

(, xrefs: 00F7EB5F
|, xrefs: 00F7EB49

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: a076936e626848508eb4ee3f95bc4bb68aa1493c367ae200adc07c8633b82fb2
Instruction ID: ce5eb4c0b80d9691aa68b9a0cefd275666b4005ae51d8ee560b1b56124dab7f7
Opcode Fuzzy Hash: a076936e626848508eb4ee3f95bc4bb68aa1493c367ae200adc07c8633b82fb2
Instruction Fuzzy Hash: 08323675A006059FD728CF29C481A6AB7F1FF48320B15C5AFE89ADB7A1E770E941DB40

Function 00F925E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00F926D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00F9270C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 4fc41fb462ea989e0adc65cc526d9f13b7ad20e7484ebcdfade019db655040a6
Instruction ID: 2a796a0bceb624803e83206674851da0ced342d19d9f5eb01aead78b5b827a99
Opcode Fuzzy Hash: 4fc41fb462ea989e0adc65cc526d9f13b7ad20e7484ebcdfade019db655040a6
Instruction Fuzzy Hash: 6A41F676900309BFFF60DE94DC85FBBB7BCEB40724F10406AFA01A6540EA719E41B661

Function 00F8B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F8B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00F8B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00F8B655

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 33911714aaacbf4a533d6280b675c874e67a1b78d011a804bfbc3555842e8125
Instruction ID: 51bb1765b4c9e3bec7e07ced29daa108382369db74bc6a10aaf27ea0c45fe505
Opcode Fuzzy Hash: 33911714aaacbf4a533d6280b675c874e67a1b78d011a804bfbc3555842e8125
Instruction Fuzzy Hash: 0F218E75A00618EFCB00EFA5DC81AEDBBB8FF49310F0480AAE805AB351DB35A905DF51

Function 00F78CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00F40FF6: std::exception::exception.LIBCMT ref: 00F4102C
Part of subcall function 00F40FF6: __CxxThrowException@8.LIBCMT ref: 00F41041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00F78D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00F78D3A
GetLastError.KERNEL32 ref: 00F78D47

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: fbcecd31aa30f28a32f7dc9bfb3fbe5524aa891f8d5b5eda7535763fc8eb4781
Instruction ID: d8b15683db7030ba455adfdbfee2cfe9c910f308ae52285327458320ea37f716
Opcode Fuzzy Hash: fbcecd31aa30f28a32f7dc9bfb3fbe5524aa891f8d5b5eda7535763fc8eb4781
Instruction Fuzzy Hash: 491194B1414209AFD728DF64DC85D6BBBBCFB44761B10C52EF85597241EF30AC459A60

Function 00F84C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00F84C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00F84C43
FreeSid.ADVAPI32(?), ref: 00F84C53

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b0cb2cb67e6e5c9a0898ecf271971554faac007f9689f3c1c4b94440115367ac
Instruction ID: f16ea9b27192b059988a27b2a65e5f5347d6160f8857607681312b14bb2efeb0
Opcode Fuzzy Hash: b0cb2cb67e6e5c9a0898ecf271971554faac007f9689f3c1c4b94440115367ac
Instruction Fuzzy Hash: 88F04975A1130DBFDF04DFF0DC89AAEBBBCEF09311F0084A9A901E6181E6706A089B50

Function 00F2E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd6e7dc98d652ae2f0f6b22e4cfb5b4bd2b02f9547eec69a876d3c0dcea9362
Instruction ID: 8dc719ab3cf6b415c95d6de7b5d1c42c737431fde5f7a305233e40658a8fc782
Opcode Fuzzy Hash: bbd6e7dc98d652ae2f0f6b22e4cfb5b4bd2b02f9547eec69a876d3c0dcea9362
Instruction Fuzzy Hash: EA228E75E00225CFDB24DF54D881BAABBF0FF08310F248169E8569B391E774AD85EB91

Function 00F8C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00F8C966
FindClose.KERNEL32(00000000), ref: 00F8C996

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 87e7d652a8f635baa5da4af9081b64c9792ae6e305e6752735a2c2e1ccfd2e4c
Instruction ID: c4dc46e2ced80bc3be594ad387b168f65ce738b9d63fc2f28bcb32063a63312a
Opcode Fuzzy Hash: 87e7d652a8f635baa5da4af9081b64c9792ae6e305e6752735a2c2e1ccfd2e4c
Instruction Fuzzy Hash: 2E11A5726046149FD710EF29DC45A2AF7E5FF45320F00895EF8A9DB291DB74AC04DB91

Function 00F8A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00F9977D,?,00FAFB84,?), ref: 00F8A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00F9977D,?,00FAFB84,?), ref: 00F8A314

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 9c2bc86a8efc0b64adef8acc0cb71dddf875dce470d3bdfe2e6ea2486ed21b96
Instruction ID: d7c33a0da099dbcf1e5dffe41cb08684fb5e372a8d7a7c6fcf54714d2e9aa5af
Opcode Fuzzy Hash: 9c2bc86a8efc0b64adef8acc0cb71dddf875dce470d3bdfe2e6ea2486ed21b96
Instruction Fuzzy Hash: 0BF0823554432DBBEB10AFA4CC48FEA776DFF09762F004166B908D6181D6309954DBE1

Function 00F78713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00F78851), ref: 00F78728
CloseHandle.KERNEL32(?,?,00F78851), ref: 00F7873A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 602a8054b5d7ca02bb309d71d21aef107aa16edb29a952df794b573f1f2900dd
Instruction ID: b92390d30ad67d0f39ea088a825d3de54829debbf0443722e78a6786da8ade4e
Opcode Fuzzy Hash: 602a8054b5d7ca02bb309d71d21aef107aa16edb29a952df794b573f1f2900dd
Instruction Fuzzy Hash: FBE0B676010650EFEB252B64EC09D777BA9FB05360724892DB89684470DB62ACD1EB10

Function 00F4A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F48F97,?,?,?,00000001), ref: 00F4A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00F4A3A3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fa74ac5cc1ea0c61e317eb2ce11f9446103b56a4e3c3914b004e2acb3b72b1a0
Instruction ID: 643fa0f9b326218c407c3d6f0842ff21c94da5a8835f60af4fe11f689f181ce6
Opcode Fuzzy Hash: fa74ac5cc1ea0c61e317eb2ce11f9446103b56a4e3c3914b004e2acb3b72b1a0
Instruction Fuzzy Hash: 76B0927505430CABCF002BD1EC59B883F68EB46AA2F404020F60D88060CBA25454AA91

Function 00F4F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37151cef7fd2fe39ad7e5f140dcb289fe048f547f964478f90990aff33c87b01
Instruction ID: b4e84b7578a8d49a647c9bb6b8eeb59f899ed71900ba3540805c557f1e714e7e
Opcode Fuzzy Hash: 37151cef7fd2fe39ad7e5f140dcb289fe048f547f964478f90990aff33c87b01
Instruction Fuzzy Hash: C7322522D29F054DD723A634D8B2335A648AFF73D4F15D737EC19B5AAAEB28C4836500

Function 00F5267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 262a18bc9e9986582f89867f3a29354ec16422deceed94033acc75674612620a
Instruction ID: 825bb3c0c07b54d43528b0f6507c05515dd2d7987deb7e1184de36e6b572a842
Opcode Fuzzy Hash: 262a18bc9e9986582f89867f3a29354ec16422deceed94033acc75674612620a
Instruction Fuzzy Hash: FCB11220D2AF454DD72396398871336BB8CAFBB2C5F55D71BFC2670D22EB2285836541

Function 00F88B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F88B25

Part of subcall function 00F4543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00F891F8,00000000,?,?,?,?,00F893A9,00000000,?), ref: 00F45443
Part of subcall function 00F4543A: __aulldiv.LIBCMT ref: 00F45463

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 58a4fe3587b99dbedc593ddeb9552a04c5a11679b22c62c7a27ad45a10587ed1
Instruction ID: 605ed911c4ff0cf939e666ca3b9941fcbf05960f54facd05e859eda7d656cce7
Opcode Fuzzy Hash: 58a4fe3587b99dbedc593ddeb9552a04c5a11679b22c62c7a27ad45a10587ed1
Instruction Fuzzy Hash: 4D21E4726356108BC729DF25D841A92B3E1EFA4321B688E6CD0E5CF2D0CA34BD05DB94

Function 00F941FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00F94218

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 32221de278b0b2a6f776ae34e3c265c381921b0f0883d9ac2a851ec3da795537
Instruction ID: 1798d384819ab06c79d1833d2bd3e1d939bdfb31fa0917dfca5d1d5945fb997f
Opcode Fuzzy Hash: 32221de278b0b2a6f776ae34e3c265c381921b0f0883d9ac2a851ec3da795537
Instruction Fuzzy Hash: 61E048712442149FD710DF59E845E5AF7D8AF68760F008025FC49C7351DAB4F8419F90

Function 00F84EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00F84F18

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: c6191b15a0dfcb28724a515530cb48818d60bfc99977f447997a0c6545f1cd01
Instruction ID: e28af302f232e8231dc04881477546c05f6a3e68d66c07472f0f3a28b0822211
Opcode Fuzzy Hash: c6191b15a0dfcb28724a515530cb48818d60bfc99977f447997a0c6545f1cd01
Instruction Fuzzy Hash: 95D05EB596420B3CFC186B20AC0FFF62108F3407A1F84498D33018B4C1AAE57800BA34

Function 00F78C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00F788D1), ref: 00F78CB3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 86e095a651ff71abbf44ca03665f6390f638aa3467b8ef7a661bbb79112fe874
Instruction ID: 4f91b27d977764da0f1c24cc08dacaa73b1002abf02f7cd186ba5dd5785196b8
Opcode Fuzzy Hash: 86e095a651ff71abbf44ca03665f6390f638aa3467b8ef7a661bbb79112fe874
Instruction Fuzzy Hash: 41D05E322A050EABEF018EA4DC01EAE3B69EB04B01F40C111FE15C50A1C775D835AB60

Function 00F62230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00F62242

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 9f9e733f189b0bcd43a357f26bc0ac2fe2cf7e87557fea9ca6379315d924e432
Instruction ID: 6d0cc237a4b72986c031ed9f0fd26584bb6256c6b3f6ebe1a73083145ebe9183
Opcode Fuzzy Hash: 9f9e733f189b0bcd43a357f26bc0ac2fe2cf7e87557fea9ca6379315d924e432
Instruction Fuzzy Hash: ABC04CF180010DDBDB05DB90D988DEE77BCBB04304F144155A141F2100D7749B449A71

Function 00F4A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00F4A36A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7cb2c4d247dfffaa79dde1946eeeb76003b2bfa205871bc937836e0ff40ee971
Instruction ID: 55719b4cf4560e1f0d296f8555da48c5ef775f3a9481120a3c7a938d082283f0
Opcode Fuzzy Hash: 7cb2c4d247dfffaa79dde1946eeeb76003b2bfa205871bc937836e0ff40ee971
Instruction Fuzzy Hash: CDA0113000020CAB8F002B82EC08888BFACEA022A0B008020F80C880228B32A820AA80

Function 00F38A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f63576cd555b70690fe29e9630868a2fd618c4f7e0420593b321d2e326a57a
Instruction ID: a1a58038a02adb6f67b97df49a83c3233000616c20650d994996f15460b11750
Opcode Fuzzy Hash: 61f63576cd555b70690fe29e9630868a2fd618c4f7e0420593b321d2e326a57a
Instruction Fuzzy Hash: 4722F431D017168BDF288A24C49467DB7B1FB417F0F68846BE4468B291DB789D83FB62

Function 00F42405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 540c8c8545b8c3a314359ae764857faf2348e4b5261479047fdae3197f14f8c5
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: F2C1B43260505309EB5D8639943413EBEE16AA27B139A076DFCB2CB4D5FF20D569F620

Function 00F4283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 528873b70cfe2825af71f5b022f476b59e248a82a700e3a01561b26dad2e2a14
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 5EC1B63260519309EB6D4639943413EBFE16A927B139A076DFCB2DB5C4FF20D568F620

Function 00F41BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 23b622333665e522df4ef16cbbd84b5200dd4d819604813d792feaab18b63f0c
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: A0C1B332A0515309EF2D4639947413EBEE17AA27B135A076DECB2CB5C4FF10D5A9B610

Function 01DA3630 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 63f06ebe2aabe491d3b5a755977f4eff3eeab4ab4c4ddd4a4f884ffef8c068c7
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: D141D571D1051CEBCF48CFADC991AEEBBF2AF88201F948299D516AB345D730AB41DB40

Function 01DA34C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 8551942f781730156ba24de59b954cc41ba1c546c7ffa8fa9978afc1b1234d14
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 74019D78A04209EFCB48DF98C5909AEF7B6FF48310F608599E809A7741E731EE41DB80

Function 01DA3520 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 3c3e633201d9a9950fb3b3ec0436c9f8ac59a704f91ae4c390b4ee5288cc7e48
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 87019278A04109EFCB48DF98C5909AEF7B6FF48310F608599D849A7701D730EE51DB80

Function 01DA1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632878401.0000000001DA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1da0000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00FA37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00FAF910), ref: 00FA38AF
IsWindowVisible.USER32(?), ref: 00FA38D3

Strings

GETLINE, xrefs: 00FA3C23
CHECK, xrefs: 00FA3AF5
SHOWDROPDOWN, xrefs: 00FA3968
TABRIGHT, xrefs: 00FA3925
DELSTRING, xrefs: 00FA39D1
GETLINECOUNT, xrefs: 00FA3B4E
SENDCOMMANDID, xrefs: 00FA3C62
ISVISIBLE, xrefs: 00FA38BF
ADDSTRING, xrefs: 00FA399E
GETCURRENTLINE, xrefs: 00FA3B75
GETSELECTED, xrefs: 00FA3B2B
HIDEDROPDOWN, xrefs: 00FA3988
TABLEFT, xrefs: 00FA390F
ISENABLED, xrefs: 00FA38F3
SETCURRENTSELECTION, xrefs: 00FA3A3E
ISCHECKED, xrefs: 00FA3AC1
SELECTSTRING, xrefs: 00FA3A8E
GETCURRENTSELECTION, xrefs: 00FA3A6B
FINDSTRING, xrefs: 00FA39FE
EDITPASTE, xrefs: 00FA3BE7
CURRENTTAB, xrefs: 00FA3945
GETCURRENTCOL, xrefs: 00FA3BB0
UNCHECK, xrefs: 00FA3B0B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: e270ecadec933469286b9750569f964119524abc85516ddb010a2b7de605db9a
Instruction ID: 499b0b15a89f1edd7c000c4a150c9e481116bdb86c400e1ae37956686ba14f8d
Opcode Fuzzy Hash: e270ecadec933469286b9750569f964119524abc85516ddb010a2b7de605db9a
Instruction Fuzzy Hash: 59D1A474604316CBCB14EF10CC51A6A7BA2AF95354F14445DB8865B3A3CF79EE0AFB42

Function 00FAA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00FAA89F
GetSysColorBrush.USER32(0000000F), ref: 00FAA8D0
GetSysColor.USER32(0000000F), ref: 00FAA8DC
SetBkColor.GDI32(?,000000FF), ref: 00FAA8F6
SelectObject.GDI32(?,?), ref: 00FAA905
InflateRect.USER32(?,000000FF,000000FF), ref: 00FAA930
GetSysColor.USER32(00000010), ref: 00FAA938
CreateSolidBrush.GDI32(00000000), ref: 00FAA93F
FrameRect.USER32(?,?,00000000), ref: 00FAA94E
DeleteObject.GDI32(00000000), ref: 00FAA955
InflateRect.USER32(?,000000FE,000000FE), ref: 00FAA9A0
FillRect.USER32(?,?,?), ref: 00FAA9D2
GetWindowLongW.USER32(?,000000F0), ref: 00FAA9FD

Part of subcall function 00FAAB60: GetSysColor.USER32(00000012), ref: 00FAAB99
Part of subcall function 00FAAB60: SetTextColor.GDI32(?,?), ref: 00FAAB9D
Part of subcall function 00FAAB60: GetSysColorBrush.USER32(0000000F), ref: 00FAABB3
Part of subcall function 00FAAB60: GetSysColor.USER32(0000000F), ref: 00FAABBE
Part of subcall function 00FAAB60: GetSysColor.USER32(00000011), ref: 00FAABDB
Part of subcall function 00FAAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FAABE9
Part of subcall function 00FAAB60: SelectObject.GDI32(?,00000000), ref: 00FAABFA
Part of subcall function 00FAAB60: SetBkColor.GDI32(?,00000000), ref: 00FAAC03
Part of subcall function 00FAAB60: SelectObject.GDI32(?,?), ref: 00FAAC10
Part of subcall function 00FAAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00FAAC2F
Part of subcall function 00FAAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FAAC46
Part of subcall function 00FAAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00FAAC5B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 336b06e835129ee4c2f2f6cacedc553a5e6e6a6ef3d1a5b98b50e8dd5a6a28bf
Instruction ID: 037b4873b143241479ea17765dcb61f05b99f5f93d3f927da06699a5ae72022a
Opcode Fuzzy Hash: 336b06e835129ee4c2f2f6cacedc553a5e6e6a6ef3d1a5b98b50e8dd5a6a28bf
Instruction Fuzzy Hash: A5A184B2408305EFD7109FA4DC08A5B7BA9FF8A331F144A29F562DA1A0D735D849EB52

Function 00F22C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00F22CA2
DeleteObject.GDI32(00000000), ref: 00F22CE8
DeleteObject.GDI32(00000000), ref: 00F22CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00F22CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00F22D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00F5C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00F5C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00F5CAED

Part of subcall function 00F21B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F22036,?,00000000,?,?,?,?,00F216CB,00000000,?), ref: 00F21B9A

SendMessageW.USER32(?,00001053), ref: 00F5CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00F5CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F5CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00F5CB62

Strings

0, xrefs: 00F5C981

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 24cebe010dede2271060d28e3e267af5078447a17fa0578f0ac47190dc7d4346
Instruction ID: 2d71f2ff3efe826f154b2998e5c4d5c4ccf83496d11ff85632bd1074ae50495f
Opcode Fuzzy Hash: 24cebe010dede2271060d28e3e267af5078447a17fa0578f0ac47190dc7d4346
Instruction Fuzzy Hash: B6129030904311EFDB10CF24D884BA9BBE5BF49322F544569FA86DB662C731EC49EB91

Function 00F977BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00F977F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00F978B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00F978EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00F97900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00F97946
GetClientRect.USER32(00000000,?), ref: 00F97952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00F97996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00F979A5
GetStockObject.GDI32(00000011), ref: 00F979B5
SelectObject.GDI32(00000000,00000000), ref: 00F979B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00F979C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F979D2
DeleteDC.GDI32(00000000), ref: 00F979DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00F97A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00F97A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00F97A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00F97A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00F97A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00F97AAE
GetStockObject.GDI32(00000011), ref: 00F97AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00F97AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00F97ACE

Strings

msctls_progress32, xrefs: 00F97A4F
DISPLAY, xrefs: 00F9799B
static, xrefs: 00F97990, 00F97AA8
AutoIt v3, xrefs: 00F9793E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 90a307f8f7c1c956d30dbe597ee96d7ee875d3b4175adba9a6be4ef685f24e3e
Instruction ID: 78be423214bbf2225eb145af2cf86201efb27bdc73230049b406092bdecd46f1
Opcode Fuzzy Hash: 90a307f8f7c1c956d30dbe597ee96d7ee875d3b4175adba9a6be4ef685f24e3e
Instruction Fuzzy Hash: 08A171B1A40219BFEB14DBA4DC4AFAE7BB9EB49710F104114FA15EB2E0C774AD04DB64

Function 00F8AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F8AF89
GetDriveTypeW.KERNEL32(?,00FAFAC0,?,\\.\,00FAF910), ref: 00F8B066
SetErrorMode.KERNEL32(00000000,00FAFAC0,?,\\.\,00FAF910), ref: 00F8B1C4

Strings

MMC, xrefs: 00F8B185
CDROM, xrefs: 00F8B09A
PhysicalDrive, xrefs: 00F8B012
ATAPI, xrefs: 00F8B138
RAMDisk, xrefs: 00F8B090
\\.\, xrefs: 00F8AFDB
SSA, xrefs: 00F8B14D
SCSI, xrefs: 00F8B131
SAS, xrefs: 00F8B170
Virtual, xrefs: 00F8B18C
SATA, xrefs: 00F8B177
Unknown, xrefs: 00F8B086, 00F8B12A
iSCSI, xrefs: 00F8B169
Network, xrefs: 00F8B0A4
Fibre, xrefs: 00F8B154
Removable, xrefs: 00F8B0B8
1394, xrefs: 00F8B146
RAID, xrefs: 00F8B162
Fixed, xrefs: 00F8B0AE
FileBackedVirtual, xrefs: 00F8B193
USB, xrefs: 00F8B15B
ATA, xrefs: 00F8B13F
SSD, xrefs: 00F8B0F1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: b5b5b0630d34a0b3cade2fdc31c17e1617f159887f02ace728c2ca6aa3c402f7
Instruction ID: ef12ac54f5d9721690c3341a80e8539390721cf673ffd3633f1ce8f0e41d9090
Opcode Fuzzy Hash: b5b5b0630d34a0b3cade2fdc31c17e1617f159887f02ace728c2ca6aa3c402f7
Instruction Fuzzy Hash: CA51B131A84B06ABCB00FB50CD9AAFD73B2AB14755B684017E40AAB291C779DD41FB47

Function 00F26A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F26A91
__wcsnicmp.LIBCMT ref: 00F26AA9
__wcsnicmp.LIBCMT ref: 00F26AC1
__wcsnicmp.LIBCMT ref: 00F26AD9
__wcsnicmp.LIBCMT ref: 00F26AF1
__wcsnicmp.LIBCMT ref: 00F26B09
__wcsnicmp.LIBCMT ref: 00F26B21
__wcsnicmp.LIBCMT ref: 00F26B35
__wcsnicmp.LIBCMT ref: 00F26B76
__wcsnicmp.LIBCMT ref: 00F26B8A
__wcsnicmp.LIBCMT ref: 00F26B9E
__wcsnicmp.LIBCMT ref: 00F26BB2

Strings

#include, xrefs: 00F26B03
#comments-end, xrefs: 00F26B98
#requireadmin, xrefs: 00F26ABB
#ce, xrefs: 00F26BAC
#include-once, xrefs: 00F26AEB
Bad directive syntax error, xrefs: 00F5E743
#cs, xrefs: 00F26B2F, 00F26B84
#OnAutoItStartRegister, xrefs: 00F26AD3
#notrayicon, xrefs: 00F26AA3
#pragma compile, xrefs: 00F26A8B
#comments-start, xrefs: 00F26B1B, 00F26B70
Cannot parse #include, xrefs: 00F5E819
Unterminated group of comments, xrefs: 00F5E82C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: d9734bb7ae3b7a2d3f766a818efaae337d6a0d107ca1f3a445da55fc7258ecc1
Instruction ID: d6a8e141b9e22a7c1882fdfe9d2397240a49d85009d68af2936cb4d8e251bfe5
Opcode Fuzzy Hash: d9734bb7ae3b7a2d3f766a818efaae337d6a0d107ca1f3a445da55fc7258ecc1
Instruction Fuzzy Hash: 6D815D71A40321BBCB24BF60EC82FAF3B68AF15711F044021FD41EA182EB68DB49F651

Function 00FAAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00FAAB99
SetTextColor.GDI32(?,?), ref: 00FAAB9D
GetSysColorBrush.USER32(0000000F), ref: 00FAABB3
GetSysColor.USER32(0000000F), ref: 00FAABBE
CreateSolidBrush.GDI32(?), ref: 00FAABC3
GetSysColor.USER32(00000011), ref: 00FAABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00FAABE9
SelectObject.GDI32(?,00000000), ref: 00FAABFA
SetBkColor.GDI32(?,00000000), ref: 00FAAC03
SelectObject.GDI32(?,?), ref: 00FAAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00FAAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00FAAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00FAAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00FAACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00FAACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00FAACEC
DrawFocusRect.USER32(?,?), ref: 00FAACF7
GetSysColor.USER32(00000011), ref: 00FAAD05
SetTextColor.GDI32(?,00000000), ref: 00FAAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00FAAD21
SelectObject.GDI32(?,00FAA869), ref: 00FAAD38
DeleteObject.GDI32(?), ref: 00FAAD43
SelectObject.GDI32(?,?), ref: 00FAAD49
DeleteObject.GDI32(?), ref: 00FAAD4E
SetTextColor.GDI32(?,?), ref: 00FAAD54
SetBkColor.GDI32(?,?), ref: 00FAAD5E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 86603fb0b4a4292543b30521b16502f537d9f1ff3a6abd47edeeb4b9ebe684dd
Instruction ID: cc0414a88bca7ada66a2a4bce9c1a5e87bc9c05a09d75724af51e55bb2ef9ad4
Opcode Fuzzy Hash: 86603fb0b4a4292543b30521b16502f537d9f1ff3a6abd47edeeb4b9ebe684dd
Instruction Fuzzy Hash: 80614EB1D00218EFDB119FA4DC48EAE7B79EF09320F148225F915AB2A1D7759D44EB90

Function 00FA8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00FA8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FA8D45
CharNextW.USER32(0000014E), ref: 00FA8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00FA8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00FA8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FA8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00FA8DF9
SetWindowTextW.USER32(?,0000014E), ref: 00FA8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00FA8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FA8E8C
_memset.LIBCMT ref: 00FA8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00FA8EFA
_memset.LIBCMT ref: 00FA8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00FA8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00FA8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00FA9088
InvalidateRect.USER32(?,00000000,00000001), ref: 00FA90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FA90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FA9121
DrawMenuBar.USER32(?), ref: 00FA9130
SetWindowTextW.USER32(?,0000014E), ref: 00FA9158

Strings

0, xrefs: 00FA90C2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: d2c744eac709b1d2b758d0e760936add2792aaa95d23151352f5a4c4f2b63db2
Instruction ID: b61c082b67fac093d7df0d22dc04e859418a800c33e2f4c00b679ca839983351
Opcode Fuzzy Hash: d2c744eac709b1d2b758d0e760936add2792aaa95d23151352f5a4c4f2b63db2
Instruction Fuzzy Hash: C4E1C6B1900219AFDF10DF50CC84EEE7B79FF06760F048155F9159A291DBB49A86EF60

Function 00FA4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FA4C51
GetDesktopWindow.USER32 ref: 00FA4C66
GetWindowRect.USER32(00000000), ref: 00FA4C6D
GetWindowLongW.USER32(?,000000F0), ref: 00FA4CCF
DestroyWindow.USER32(?), ref: 00FA4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00FA4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FA4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00FA4D68
SendMessageW.USER32(?,00000421,?,?), ref: 00FA4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00FA4D90
IsWindowVisible.USER32(?), ref: 00FA4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00FA4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00FA4DDF
GetWindowRect.USER32(?,?), ref: 00FA4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00FA4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00FA4E37
CopyRect.USER32(?,?), ref: 00FA4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00FA4EB9

Strings

(, xrefs: 00FA4E2A
tooltips_class32, xrefs: 00FA4D1D
0, xrefs: 00FA4BFC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 8b0035463fee4b1f2d767010131a425ce935367af170bff0fad2651528cec30d
Instruction ID: 394ce087a4e74a38dc39b5e820f638c849d7bf1e9822a9d031b013846d975579
Opcode Fuzzy Hash: 8b0035463fee4b1f2d767010131a425ce935367af170bff0fad2651528cec30d
Instruction Fuzzy Hash: 11B18FB1608351AFDB04DF64D885B6ABBE4FF85310F00891CF5999B2A1D7B5EC04EBA1

Function 00F227D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F228BC
GetSystemMetrics.USER32(00000007), ref: 00F228C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F228EF
GetSystemMetrics.USER32(00000008), ref: 00F228F7
GetSystemMetrics.USER32(00000004), ref: 00F2291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F22939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F22949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F2297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F22990
GetClientRect.USER32(00000000,000000FF), ref: 00F229AE
GetStockObject.GDI32(00000011), ref: 00F229CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F229D5

Part of subcall function 00F22344: GetCursorPos.USER32(?), ref: 00F22357
Part of subcall function 00F22344: ScreenToClient.USER32(00FE67B0,?), ref: 00F22374
Part of subcall function 00F22344: GetAsyncKeyState.USER32(00000001), ref: 00F22399
Part of subcall function 00F22344: GetAsyncKeyState.USER32(00000002), ref: 00F223A7

SetTimer.USER32(00000000,00000000,00000028,00F21256), ref: 00F229FC

Strings

AutoIt v3 GUI, xrefs: 00F22974

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5dc4f18c07553d2c01dbd3f802aa9829f098c049a01b829b4069422a379436f8
Instruction ID: 2cb821614c1bfa815df785e8ae6ded8e299d5894254ec6f107ca0ab1134d918a
Opcode Fuzzy Hash: 5dc4f18c07553d2c01dbd3f802aa9829f098c049a01b829b4069422a379436f8
Instruction Fuzzy Hash: 88B16F71A0021EAFDB14DFA8DC85BAD7BB4FB18311F104229FA15EA290DB74D945EB50

Function 00FA4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FA40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00FA41B6

Strings

GETITEMCOUNT, xrefs: 00FA4128
SELECTINVERT, xrefs: 00FA4286
ISSELECTED, xrefs: 00FA41C1
GETTEXT, xrefs: 00FA415F
FINDITEM, xrefs: 00FA4329
SELECT, xrefs: 00FA4250
SELECTALL, xrefs: 00FA421D
GETSELECTED, xrefs: 00FA42E4
DESELECT, xrefs: 00FA42A4
GETSUBITEMCOUNT, xrefs: 00FA4141
SELECTCLEAR, xrefs: 00FA4235
VIEWCHANGE, xrefs: 00FA4375
GETSELECTEDCOUNT, xrefs: 00FA4199

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: ca3ea43afe4821c7e20117f56de825fb151512072899f3da4f4bb31b91dbcbf4
Instruction ID: 9db929ff335fda9c2480de7eb82dce249a92a926e89ab8314553cc9fbbc4842b
Opcode Fuzzy Hash: ca3ea43afe4821c7e20117f56de825fb151512072899f3da4f4bb31b91dbcbf4
Instruction Fuzzy Hash: F8A1A0706183129BCB14EF10CC41B6AB7E5AF85314F14896DB8969B392DBB8FC09FB51

Function 00F952F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00F95309
LoadCursorW.USER32(00000000,00007F8A), ref: 00F95314
LoadCursorW.USER32(00000000,00007F00), ref: 00F9531F
LoadCursorW.USER32(00000000,00007F03), ref: 00F9532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00F95335
LoadCursorW.USER32(00000000,00007F01), ref: 00F95340
LoadCursorW.USER32(00000000,00007F81), ref: 00F9534B
LoadCursorW.USER32(00000000,00007F88), ref: 00F95356
LoadCursorW.USER32(00000000,00007F80), ref: 00F95361
LoadCursorW.USER32(00000000,00007F86), ref: 00F9536C
LoadCursorW.USER32(00000000,00007F83), ref: 00F95377
LoadCursorW.USER32(00000000,00007F85), ref: 00F95382
LoadCursorW.USER32(00000000,00007F82), ref: 00F9538D
LoadCursorW.USER32(00000000,00007F84), ref: 00F95398
LoadCursorW.USER32(00000000,00007F04), ref: 00F953A3
LoadCursorW.USER32(00000000,00007F02), ref: 00F953AE
GetCursorInfo.USER32(?), ref: 00F953BE
GetLastError.KERNEL32(00000001,00000000), ref: 00F953E9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 660578408da2475a090b40764a19b28de77e7d38e576303cefb03652719a5bf1
Instruction ID: afedff912cdf16d35963036d3c82530c3d02a74212973e5ffda1ca7402784a4c
Opcode Fuzzy Hash: 660578408da2475a090b40764a19b28de77e7d38e576303cefb03652719a5bf1
Instruction Fuzzy Hash: AA415370E083196ADF109FBA8C49D6EFFB8EF51B60B10452FA509E7290DAB894019F51

Function 00F7AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F7AAA5
__swprintf.LIBCMT ref: 00F7AB46
_wcscmp.LIBCMT ref: 00F7AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00F7ABAE
_wcscmp.LIBCMT ref: 00F7ABEA
GetClassNameW.USER32(?,?,00000400), ref: 00F7AC21
GetDlgCtrlID.USER32(?), ref: 00F7AC73
GetWindowRect.USER32(?,?), ref: 00F7ACA9
GetParent.USER32(?), ref: 00F7ACC7
ScreenToClient.USER32(00000000), ref: 00F7ACCE
GetClassNameW.USER32(?,?,00000100), ref: 00F7AD48
_wcscmp.LIBCMT ref: 00F7AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00F7AD82
_wcscmp.LIBCMT ref: 00F7AD96

Part of subcall function 00F4386C: _iswctype.LIBCMT ref: 00F43874

Strings

%s%u, xrefs: 00F7AB40

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 857b01497b66afc5f1a7cf04d8fc0b9dcfc368102a306b6c01f30f0fb8bec951
Instruction ID: 5db2b5da21e1902a176c0bcba629180ba99b06e9064478160605e63952a344f8
Opcode Fuzzy Hash: 857b01497b66afc5f1a7cf04d8fc0b9dcfc368102a306b6c01f30f0fb8bec951
Instruction Fuzzy Hash: 18A1D371604206AFD715DF64C884BAEB7E8FF84325F00862AF9ADD2150D734E945EB93

Function 00F7B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00F7B3DB
_wcscmp.LIBCMT ref: 00F7B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00F7B414
CharUpperBuffW.USER32(?,00000000), ref: 00F7B431
_wcscmp.LIBCMT ref: 00F7B44F
_wcsstr.LIBCMT ref: 00F7B460
GetClassNameW.USER32(00000018,?,00000400), ref: 00F7B498
_wcscmp.LIBCMT ref: 00F7B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00F7B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00F7B518
_wcscmp.LIBCMT ref: 00F7B528
GetClassNameW.USER32(00000010,?,00000400), ref: 00F7B550
GetWindowRect.USER32(00000004,?), ref: 00F7B5B9

Strings

ThumbnailClass, xrefs: 00F7B4A3, 00F7B523
@, xrefs: 00F7B3BC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 91b88fc990140be2ebbf33785b334b08c1a49a06c3c50324932f1c07f0355f92
Instruction ID: d18afd81f64a22d86bfdfe0c166214d13c4849ac50c593df26fc75119d8c4d0f
Opcode Fuzzy Hash: 91b88fc990140be2ebbf33785b334b08c1a49a06c3c50324932f1c07f0355f92
Instruction Fuzzy Hash: 9281B2714083099FDB04DF10C885FAA7BE8EF45724F08C56AFD899A096DB34DD49EB62

Function 00F7B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F7B23F

Strings

[CLASS:, xrefs: 00F7B28F
[LAST, xrefs: 00F7B2EC
CLASSNAME=, xrefs: 00F7B27C
ACTIVE, xrefs: 00F7B21A
[ALL, xrefs: 00F7B2E5
[HANDLE:, xrefs: 00F7B24B
HANDLE=, xrefs: 00F7B238
[REGEXPTITLE:, xrefs: 00F7B267
LAST, xrefs: 00F7B204
[ACTIVE, xrefs: 00F7B22C
REGEXP=, xrefs: 00F7B254
ALL, xrefs: 00F7B2D3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 977bea4104f84b904abefe0100e207a434e8b98710c8dfd17ce8cf980f675b9b
Instruction ID: fa4c52f5054d6a78348db9c900f7ea15083450fc84396c686a3292286ba751ce
Opcode Fuzzy Hash: 977bea4104f84b904abefe0100e207a434e8b98710c8dfd17ce8cf980f675b9b
Instruction Fuzzy Hash: EE310231A49305A6DB01FAA0DC43FEE77759F11750F64402BF804B11D2EFA9AE04F652

Function 00F7C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00F7C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F7C4E6
SetWindowTextW.USER32(?,?), ref: 00F7C4FD
GetDlgItem.USER32(?,000003EA), ref: 00F7C512
SetWindowTextW.USER32(00000000,?), ref: 00F7C518
GetDlgItem.USER32(?,000003E9), ref: 00F7C528
SetWindowTextW.USER32(00000000,?), ref: 00F7C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00F7C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00F7C569
GetWindowRect.USER32(?,?), ref: 00F7C572
SetWindowTextW.USER32(?,?), ref: 00F7C5DD
GetDesktopWindow.USER32 ref: 00F7C5E3
GetWindowRect.USER32(00000000), ref: 00F7C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00F7C636
GetClientRect.USER32(?,?), ref: 00F7C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00F7C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00F7C693

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: ef9d71cd4443d1dcb49fff4186439d0e666fd479f0db966cc25e90ddb2aa22de
Instruction ID: d92b2f71d3e30d64f17789184d1c7ca17336a8ad66fe62383aa9d1b7a8d55c1f
Opcode Fuzzy Hash: ef9d71cd4443d1dcb49fff4186439d0e666fd479f0db966cc25e90ddb2aa22de
Instruction Fuzzy Hash: 68516E71900709AFDB20DFA8DD85B6EBBF5FF04705F00492DE686A66A0C775E904EB90

Function 00FAA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FAA4C8
DestroyWindow.USER32(?,?), ref: 00FAA542

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00FAA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00FAA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FAA5F1
DestroyWindow.USER32(00000000), ref: 00FAA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F20000,00000000), ref: 00FAA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00FAA663
GetDesktopWindow.USER32 ref: 00FAA67C
GetWindowRect.USER32(00000000), ref: 00FAA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00FAA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00FAA6B3

Part of subcall function 00F225DB: GetWindowLongW.USER32(?,000000EB), ref: 00F225EC

Strings

0, xrefs: 00FAA4DE
tooltips_class32, xrefs: 00FAA5B5, 00FAA643

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 5736805f77f0d31d4acf79a540c3f1c23105bb1661c02157b42c51141efefb39
Instruction ID: 0f8d01f331ea7f7715616e0ae42c680465567d94ad828ea20195644b151df685
Opcode Fuzzy Hash: 5736805f77f0d31d4acf79a540c3f1c23105bb1661c02157b42c51141efefb39
Instruction Fuzzy Hash: CB71BCB1540249AFD720CF28CC45F667BE6EB9A314F08452DF9858B3A1C770E909EF52

Function 00FAC8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

DragQueryPoint.SHELL32(?,?), ref: 00FAC917

Part of subcall function 00FAADF1: ClientToScreen.USER32(?,?), ref: 00FAAE1A
Part of subcall function 00FAADF1: GetWindowRect.USER32(?,?), ref: 00FAAE90
Part of subcall function 00FAADF1: PtInRect.USER32(?,?,00FAC304), ref: 00FAAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00FAC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00FAC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00FAC9AE
_wcscat.LIBCMT ref: 00FAC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00FAC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00FACA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00FACA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00FACA47
DragFinish.SHELL32(?), ref: 00FACA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00FACB41

Strings

@GUI_DRAGID, xrefs: 00FACAB9
@GUI_DROPID, xrefs: 00FACA6E
@GUI_DRAGFILE, xrefs: 00FACAF0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 98bb6ae5a5ade8a988926cd796bea4e572ff04bcd7749965c6d96070b957a221
Instruction ID: 5cc917f5583424e745b4a7609d386934c162c12707dd168904cf05563ed18a15
Opcode Fuzzy Hash: 98bb6ae5a5ade8a988926cd796bea4e572ff04bcd7749965c6d96070b957a221
Instruction Fuzzy Hash: 02618CB1108314AFC711EF60DC85D9FBBE8EF89750F04092EF591972A1DB749A09EB92

Function 00FA4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FA46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00FA46F6

Strings

CHECK, xrefs: 00FA4716
COLLAPSE, xrefs: 00FA473C
SELECT, xrefs: 00FA48A7
GETSELECTED, xrefs: 00FA4806
GETITEMCOUNT, xrefs: 00FA47D8
ISCHECKED, xrefs: 00FA4879
EXPAND, xrefs: 00FA47A8
GETTOTALCOUNT, xrefs: 00FA46DD
GETTEXT, xrefs: 00FA4849
EXISTS, xrefs: 00FA475F
UNCHECK, xrefs: 00FA48D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: d26c3011f33f7d7f60c4cbaace873cd17d51ea2db7e5ffdc4c88507e902f6324
Instruction ID: 76306abb40901c148367ae7473de3ced4e3735d8f6f1558f1a7dcdf8033d1965
Opcode Fuzzy Hash: d26c3011f33f7d7f60c4cbaace873cd17d51ea2db7e5ffdc4c88507e902f6324
Instruction Fuzzy Hash: F09191746083118FCB14EF10D851A6EB7A1AF85314F04885DF8965B3A3CBB9FD4AEB42

Function 00FABAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00FABB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00FA6D80,?), ref: 00FABBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FABC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00FABC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00FABC7D
FreeLibrary.KERNEL32(?), ref: 00FABC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FABC99
DestroyIcon.USER32(?), ref: 00FABCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00FABCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00FABCD1

Part of subcall function 00F4313D: __wcsicmp_l.LIBCMT ref: 00F431C6

Strings

.dll, xrefs: 00FABB27
.exe, xrefs: 00FABB04
.icl, xrefs: 00FABAE4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 2aa19e866edd2ada089462065b8f5f87a320975eaf19587382f9a7f632ccebb0
Instruction ID: 78b39da667450fadc7fc8e80b81e9d9b49a7b88a2a0b4d8c8edccdeb6e42675a
Opcode Fuzzy Hash: 2aa19e866edd2ada089462065b8f5f87a320975eaf19587382f9a7f632ccebb0
Instruction Fuzzy Hash: 0861D2B1900219BBEB14DF64CC85FBE7BA8EF09721F104119FC15DA1D2DB74A994EBA0

Function 00F8A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

CharLowerBuffW.USER32(?,?), ref: 00F8A636
GetDriveTypeW.KERNEL32 ref: 00F8A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F8A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F8A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F8A730

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Strings

set cd door , xrefs: 00F8A6D1
open , xrefs: 00F8A692
wait, xrefs: 00F8A6ED
open, xrefs: 00F8A65D
close cd wait, xrefs: 00F8A71B
type cdaudio alias cd wait, xrefs: 00F8A6AE
close, xrefs: 00F8A63C
closed, xrefs: 00F8A64A, 00F8A653

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: a037bd2828c912cc9fc258b0791c4473adac73ff5f33159bf3d0fd5f5276a96a
Instruction ID: 2e895b14a097bf17a513046e66b17b2dd23c4b9e5a57302d3ef2302b9a7165f5
Opcode Fuzzy Hash: a037bd2828c912cc9fc258b0791c4473adac73ff5f33159bf3d0fd5f5276a96a
Instruction Fuzzy Hash: E35167715083159FC700EF20DC8196AB7F9EF84718F04496DF886572A1DB39EE0AEB92

Function 00F8A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00F8A47A
__swprintf.LIBCMT ref: 00F8A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00F8A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00F8A4FE
_memset.LIBCMT ref: 00F8A51D
_wcsncpy.LIBCMT ref: 00F8A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00F8A58E
CloseHandle.KERNEL32(00000000), ref: 00F8A599
RemoveDirectoryW.KERNEL32(?), ref: 00F8A5A2
CloseHandle.KERNEL32(00000000), ref: 00F8A5AC

Strings

\??\%s, xrefs: 00F8A496
\, xrefs: 00F8A4B2
:, xrefs: 00F8A4BD

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 88ee60aaa58da8ddf7f1c18142118a59d84d69af158ce187acf63ddd8cbd14fd
Instruction ID: 4fc316c6717a380885e5ecc9516c43a5bc56976b464b07d305e7a93f47bcd78f
Opcode Fuzzy Hash: 88ee60aaa58da8ddf7f1c18142118a59d84d69af158ce187acf63ddd8cbd14fd
Instruction Fuzzy Hash: A131E8B1900209ABEB20DFA0DC49FEB77BCEF89711F1441B6F908D6160E77497449B25

Function 00F5AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00F5AB7B
___wtomb_environ.LIBCMT ref: 00F5AB9D

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

__malloc_crt.LIBCMT ref: 00F5ABC5
__malloc_crt.LIBCMT ref: 00F5ABE2
_free.LIBCMT ref: 00F5AC19
__recalloc_crt.LIBCMT ref: 00F5AC52
__recalloc_crt.LIBCMT ref: 00F5AC97
_strlen.LIBCMT ref: 00F5ACC3
__calloc_crt.LIBCMT ref: 00F5ACCD
_strlen.LIBCMT ref: 00F5ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00F5AD0A
_free.LIBCMT ref: 00F5AD24
_free.LIBCMT ref: 00F5AD31
_free.LIBCMT ref: 00F5AD43
__invoke_watson.LIBCMT ref: 00F5AD5D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: c273c3926fa38e9c7fbf508ee7177b11756e8d20508ee6935b56d2b3093fc00f
Instruction ID: bd5340e3c585fdbb087c4b860b62388a6a16a448e86e0b2b9ba22fc26ed5381c
Opcode Fuzzy Hash: c273c3926fa38e9c7fbf508ee7177b11756e8d20508ee6935b56d2b3093fc00f
Instruction Fuzzy Hash: 9161F272D00209EFDB216F24DC41B697BA5EF51373F104329EE019B281DB7CD859A792

Function 00FAC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00FAC4EC
GetFocus.USER32 ref: 00FAC4FC
GetDlgCtrlID.USER32(00000000), ref: 00FAC507
_memset.LIBCMT ref: 00FAC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00FAC65D
GetMenuItemCount.USER32(?), ref: 00FAC67D
GetMenuItemID.USER32(?,00000000), ref: 00FAC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00FAC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00FAC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FAC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00FAC779

Strings

0, xrefs: 00FAC62A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3b3d1c8743c0c27e35ac56d60450a792ffea06962e4502b98ab921fae9947b25
Instruction ID: bb9a5398cde874abeac1f63e32190d402b88c1912dcb5bbe5ccabbfdd3577951
Opcode Fuzzy Hash: 3b3d1c8743c0c27e35ac56d60450a792ffea06962e4502b98ab921fae9947b25
Instruction Fuzzy Hash: 1F8190B19083059FD720CF14C984A6BBBE8FF8A364F04452DF99597291D730E905EFA2

Function 00F783F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F78766
Part of subcall function 00F7874A: GetLastError.KERNEL32(?,00F7822A,?,?,?), ref: 00F78770
Part of subcall function 00F7874A: GetProcessHeap.KERNEL32(00000008,?,?,00F7822A,?,?,?), ref: 00F7877F
Part of subcall function 00F7874A: HeapAlloc.KERNEL32(00000000,?,00F7822A,?,?,?), ref: 00F78786
Part of subcall function 00F7874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F7879D

Part of subcall function 00F787E7: GetProcessHeap.KERNEL32(00000008,00F78240,00000000,00000000,?,00F78240,?), ref: 00F787F3
Part of subcall function 00F787E7: HeapAlloc.KERNEL32(00000000,?,00F78240,?), ref: 00F787FA
Part of subcall function 00F787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00F78240,?), ref: 00F7880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00F78458
_memset.LIBCMT ref: 00F7846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00F7848C
GetLengthSid.ADVAPI32(?), ref: 00F7849D
GetAce.ADVAPI32(?,00000000,?), ref: 00F784DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00F784F6
GetLengthSid.ADVAPI32(?), ref: 00F78513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00F78522
HeapAlloc.KERNEL32(00000000), ref: 00F78529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00F7854A
CopySid.ADVAPI32(00000000), ref: 00F78551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00F78582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00F785A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00F785BC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: a73c75ab6bd8ecab1803352d9f3f42e2188e484a16ef5183f74a21cd306c1335
Instruction ID: e0456f79f80f9bec9f8aa6a45abae25a1b73cd8470438c9e5a2539ea424a20d2
Opcode Fuzzy Hash: a73c75ab6bd8ecab1803352d9f3f42e2188e484a16ef5183f74a21cd306c1335
Instruction Fuzzy Hash: 99615E7194010AABDF10DF94DC48AAEBB79FF05360F14C12AE819A7291DB349A06EF61

Function 00F9762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F976A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00F976AE
CreateCompatibleDC.GDI32(?), ref: 00F976BA
SelectObject.GDI32(00000000,?), ref: 00F976C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00F9771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00F97757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00F9777B
SelectObject.GDI32(00000006,?), ref: 00F97783
DeleteObject.GDI32(?), ref: 00F9778C
DeleteDC.GDI32(00000006), ref: 00F97793
ReleaseDC.USER32(00000000,?), ref: 00F9779E

Strings

(, xrefs: 00F97723

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 483dbf77b327dc01661f7f3e7b393e81c1f2885dfbd9c2bcc34cd8c373a8c0b6
Instruction ID: f925db36432cf0cd0e30b8a3219e839b89436f1b0ba60ae612534bfacf9d4cd8
Opcode Fuzzy Hash: 483dbf77b327dc01661f7f3e7b393e81c1f2885dfbd9c2bcc34cd8c373a8c0b6
Instruction Fuzzy Hash: DC515AB5904309EFDB15DFA8CC85EAEBBB9EF49310F14842DF94A97210D731A844DB60

Function 00F8A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00FAFB78), ref: 00F8A0FC

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00F8A11E
__swprintf.LIBCMT ref: 00F8A177
__swprintf.LIBCMT ref: 00F8A190
_wprintf.LIBCMT ref: 00F8A246
_wprintf.LIBCMT ref: 00F8A264

Strings

Error: , xrefs: 00F8A20E
^ ERROR, xrefs: 00F8A1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00F8A241
Line %d (File "%s"):, xrefs: 00F8A171, 00F8A18A
"%s" (%d) : ==> %s:, xrefs: 00F8A25F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: fa3497ab535af4cae3a5876c9ed6790ec6d441ca50279089146e93d39a5a0f86
Instruction ID: 2bf781677cd94cf6ea1bd7cb87d17386ac6f849a73b5332351881baba101763c
Opcode Fuzzy Hash: fa3497ab535af4cae3a5876c9ed6790ec6d441ca50279089146e93d39a5a0f86
Instruction Fuzzy Hash: B4518A32904219AADF15FBE0DD86EEEB779AF04300F140166B505721A1EB396F48FB61

Function 00F26BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00F40B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00F26C6C,?,00008000), ref: 00F40BB7

Part of subcall function 00F248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F248A1,?,?,00F237C0,?), ref: 00F248CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F26D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00F26E5A

Part of subcall function 00F259CD: _wcscpy.LIBCMT ref: 00F25A05

Part of subcall function 00F4387D: _iswctype.LIBCMT ref: 00F43885

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00F5E8BF
Error opening the file, xrefs: 00F5E866, 00F5E8E1
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F5E84A
AU3!, xrefs: 00F26CC1
Unterminated string, xrefs: 00F5EC0D
Bad directive syntax error, xrefs: 00F5EBC6
EA06, xrefs: 00F5E87B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: c151a9bc218528c2f45331422102faefe7e5f83c99ec1694f201b1846e153562
Instruction ID: 1d4e53a0a79c77d06d26888b4c1d4dfbdd1c70392b452792b2d3d36e5c35ef08
Opcode Fuzzy Hash: c151a9bc218528c2f45331422102faefe7e5f83c99ec1694f201b1846e153562
Instruction Fuzzy Hash: 3202BD315083519FC724EF24DC81AAFBBE5BF88714F04491DF986972A1DB38DA49EB42

Function 00F245DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F245F9
GetMenuItemCount.USER32(00FE6890), ref: 00F5D7CD
GetMenuItemCount.USER32(00FE6890), ref: 00F5D87D
GetCursorPos.USER32(?), ref: 00F5D8C1
SetForegroundWindow.USER32(00000000), ref: 00F5D8CA
TrackPopupMenuEx.USER32(00FE6890,00000000,?,00000000,00000000,00000000), ref: 00F5D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00F5D8E9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 09b91877edfcfbf3f50ab29ff9f22bf57c1454f84d82fd691ba50604c9498bee
Instruction ID: 075b11e654b8b833144092af12464a8e63239767a3afe40381870fda5e908bf4
Opcode Fuzzy Hash: 09b91877edfcfbf3f50ab29ff9f22bf57c1454f84d82fd691ba50604c9498bee
Instruction Fuzzy Hash: 6E712771A02219BFEB309F54EC85FAABF64FF05365F140216FA14AA1E1C7B56814FB90

Function 00FA10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FA0038,?,?), ref: 00FA10BC

Strings

HKEY_CURRENT_CONFIG, xrefs: 00FA1179
HKU, xrefs: 00FA11CE
HKEY_CLASSES_ROOT, xrefs: 00FA114F
HKEY_USERS, xrefs: 00FA11BD
HKCU, xrefs: 00FA11AC
HKLM, xrefs: 00FA113A
HKEY_CURRENT_USER, xrefs: 00FA119B
HKCC, xrefs: 00FA118A
HKCR, xrefs: 00FA1164
HKEY_LOCAL_MACHINE, xrefs: 00FA1125

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: facc33b3622631a4abe259c5c91cc9c1d3377972069fcf81597b538ad3d26156
Instruction ID: 916c6b3fe2197eadd22d07a89c32989e48478ac53592fba10ef4fcdfa76ffb69
Opcode Fuzzy Hash: facc33b3622631a4abe259c5c91cc9c1d3377972069fcf81597b538ad3d26156
Instruction Fuzzy Hash: 594179B190025FCBDF10EF90DC91AEA3765BF12310F164419ED915B292DB38AD1AEBA0

Function 00F85569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Part of subcall function 00F27A84: _memmove.LIBCMT ref: 00F27B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00F855D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00F855E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00F855F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00F8560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00F8561C

Strings

alias PlayMe, xrefs: 00F855AB
status PlayMe mode, xrefs: 00F855CD
close PlayMe, xrefs: 00F855E3, 00F85610
play PlayMe, xrefs: 00F85617
open , xrefs: 00F85581
play PlayMe wait, xrefs: 00F85606

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: d5d165b5d95eb4116a219803668230ca402ee13ebb6953884c1c9d38bb29ae59
Instruction ID: c1b168212bcec5673f592cd47ba4825fcd4eb9e3139533a02f2f3c52de0c50b3
Opcode Fuzzy Hash: d5d165b5d95eb4116a219803668230ca402ee13ebb6953884c1c9d38bb29ae59
Instruction Fuzzy Hash: C611C4209902697AD720B661DC4ADFFBB7EEF91F10F44042AB401A20D1EE655D05EAB6

Function 00F848F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F8490E
gethostname.WSOCK32(?,00000100), ref: 00F84928
gethostbyname.WSOCK32(?), ref: 00F84935
_wcscpy.LIBCMT ref: 00F8495D
_memmove.LIBCMT ref: 00F84970
inet_ntoa.WSOCK32(?), ref: 00F8497B
_strcat.LIBCMT ref: 00F84989
_wcscpy.LIBCMT ref: 00F849A0
WSACleanup.WSOCK32 ref: 00F849AE
_wcscpy.LIBCMT ref: 00F849BC

Strings

0.0.0.0, xrefs: 00F84957

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: ac72c07c68b408cf9bcee695517dc5817ba1185219a89362e38b8e1145c278c7
Instruction ID: 28b322ade719ced1abdb4a2509dac619977b9c4c7b0304cc0052af529f98f9be
Opcode Fuzzy Hash: ac72c07c68b408cf9bcee695517dc5817ba1185219a89362e38b8e1145c278c7
Instruction Fuzzy Hash: EB11C072D04119ABCB30FB649C0AEDB7BAC9F01720F4401B6F84996091FF79AA85B765

Function 00F85217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00F8521C

Part of subcall function 00F40719: timeGetTime.WINMM(?,75C0B400,00F30FF9), ref: 00F4071D

Sleep.KERNEL32(0000000A), ref: 00F85248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00F8526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00F8528E
SetActiveWindow.USER32 ref: 00F852AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00F852BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00F852DA
Sleep.KERNEL32(000000FA), ref: 00F852E5
IsWindow.USER32 ref: 00F852F1
EndDialog.USER32(00000000), ref: 00F85302

Strings

BUTTON, xrefs: 00F85280

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 0602fc49aceaa29b2f07c7c0de6b85c92e91935ac7c98ee7506dc6f49f46145e
Instruction ID: aa7d0076c23949056864d06d0c69b08d66772243714e40f89e5587b7f224dc1f
Opcode Fuzzy Hash: 0602fc49aceaa29b2f07c7c0de6b85c92e91935ac7c98ee7506dc6f49f46145e
Instruction Fuzzy Hash: E221A4B1104B4CAFEB007FA0EDC8B753B6AEB55B96F080425F10189271CB619C09BB62

Function 00F8D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

CoInitialize.OLE32(00000000), ref: 00F8D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00F8D8E8
SHGetDesktopFolder.SHELL32(?), ref: 00F8D8FC
CoCreateInstance.OLE32(00FB2D7C,00000000,00000001,00FDA89C,?), ref: 00F8D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00F8D9B7
CoTaskMemFree.OLE32(?,?), ref: 00F8DA0F
_memset.LIBCMT ref: 00F8DA4C
SHBrowseForFolderW.SHELL32(?), ref: 00F8DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00F8DAAB
CoTaskMemFree.OLE32(00000000), ref: 00F8DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00F8DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00F8DAEB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 6a3f012b62756b5110bedbbaacb6e41b418c5ee0d35cfb1119b276a755ae06ac
Instruction ID: d2c189aa3a17e85f8460aba7c62b46158669d0c8011d2778fabb4dbb93da1e8a
Opcode Fuzzy Hash: 6a3f012b62756b5110bedbbaacb6e41b418c5ee0d35cfb1119b276a755ae06ac
Instruction Fuzzy Hash: F7B10B75A00119AFDB04EFA4CC88DAEBBB9EF48314F148469F809EB251DB34ED45DB50

Function 00F8052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00F805A7
SetKeyboardState.USER32(?), ref: 00F80612
GetAsyncKeyState.USER32(000000A0), ref: 00F80632
GetKeyState.USER32(000000A0), ref: 00F80649
GetAsyncKeyState.USER32(000000A1), ref: 00F80678
GetKeyState.USER32(000000A1), ref: 00F80689
GetAsyncKeyState.USER32(00000011), ref: 00F806B5
GetKeyState.USER32(00000011), ref: 00F806C3
GetAsyncKeyState.USER32(00000012), ref: 00F806EC
GetKeyState.USER32(00000012), ref: 00F806FA
GetAsyncKeyState.USER32(0000005B), ref: 00F80723
GetKeyState.USER32(0000005B), ref: 00F80731

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4b2d1fc1c04607bf6c510b10124ee169458c035b0e7137864bc33c6f1780cde0
Instruction ID: 3f3a8951875ee9adb95dbaae38021bea78a6778d5458c18727029fbdcc0fd3ac
Opcode Fuzzy Hash: 4b2d1fc1c04607bf6c510b10124ee169458c035b0e7137864bc33c6f1780cde0
Instruction Fuzzy Hash: F451E970E0478829FB74FBA088557EABFB49F01390F4C4599D5C25A1C2EE649B4CDB61

Function 00F7C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00F7C746
GetWindowRect.USER32(00000000,?), ref: 00F7C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00F7C7B6
GetDlgItem.USER32(?,00000002), ref: 00F7C7C1
GetWindowRect.USER32(00000000,?), ref: 00F7C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00F7C827
GetDlgItem.USER32(?,000003E9), ref: 00F7C835
GetWindowRect.USER32(00000000,?), ref: 00F7C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00F7C889
GetDlgItem.USER32(?,000003EA), ref: 00F7C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00F7C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00F7C8C1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: d62a840b8a52bbb55c249faef55824f19376e8cc29a2b3b4a63904f9a3c860f4
Instruction ID: cb41f0caf69d51ae1630fce98fb9c575d2053a8488adee61441aa5a2d2da068e
Opcode Fuzzy Hash: d62a840b8a52bbb55c249faef55824f19376e8cc29a2b3b4a63904f9a3c860f4
Instruction Fuzzy Hash: C25132B1F00209AFDB18CFA9DD85AAEBBB6EB89310F14812DF51AD7290D7709D049B50

Function 00F2201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F21B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F22036,?,00000000,?,?,?,?,00F216CB,00000000,?), ref: 00F21B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00F220D3
KillTimer.USER32(-00000001,?,?,?,?,00F216CB,00000000,?,?,00F21AE2,?,?), ref: 00F2216E
DestroyAcceleratorTable.USER32(00000000), ref: 00F5BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F216CB,00000000,?,?,00F21AE2,?,?), ref: 00F5BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F216CB,00000000,?,?,00F21AE2,?,?), ref: 00F5BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F216CB,00000000,?,?,00F21AE2,?,?), ref: 00F5BF5A
DeleteObject.GDI32(00000000), ref: 00F5BF6C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 80ca6d42e63036055bce344dfae6e95965002cad82674e070e1001755fb2479a
Instruction ID: af0ae029c6e3cb73b866441afdbfdf0ad92d2da0e18bd958b579fd732ab4e53f
Opcode Fuzzy Hash: 80ca6d42e63036055bce344dfae6e95965002cad82674e070e1001755fb2479a
Instruction Fuzzy Hash: A161AE32900668EFCB35DF54ED88B2977F1FF51322F108529EA428A560C775A994FF80

Function 00F221A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00F225DB: GetWindowLongW.USER32(?,000000EB), ref: 00F225EC

GetSysColor.USER32(0000000F), ref: 00F221D3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 969f2c6f2bcfdf35846d45a14b6ee7305eca4cbc803b46649686d415968b147a
Instruction ID: 2e318fc6f5490641837dec986d086810a1ad82fcf3af83a3d2324e82ffa9f016
Opcode Fuzzy Hash: 969f2c6f2bcfdf35846d45a14b6ee7305eca4cbc803b46649686d415968b147a
Instruction Fuzzy Hash: 7641B031400654EEEB255F68EC88BB93B65EB06331F184365FE658E1E2C7328C46FB61

Function 00F8AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00FAF910), ref: 00F8AB76
GetDriveTypeW.KERNEL32(00000061,00FDA620,00000061), ref: 00F8AC40
_wcscpy.LIBCMT ref: 00F8AC6A

Strings

fixed, xrefs: 00F8ABBE
unknown, xrefs: 00F8AC01
network, xrefs: 00F8ABD4
removable, xrefs: 00F8ABA8
cdrom, xrefs: 00F8AB92
all, xrefs: 00F8AB7C
ramdisk, xrefs: 00F8ABEA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: d9c9597ca8ff781f1b2fdd05c58e996e0771b4a63f67d7b476cb12fc495b84c5
Instruction ID: 1e0e421fdfb4441bb31428a52d9cc43bfc3e3d3540ab54e6e387c977a6555222
Opcode Fuzzy Hash: d9c9597ca8ff781f1b2fdd05c58e996e0771b4a63f67d7b476cb12fc495b84c5
Instruction Fuzzy Hash: 2D51BF315083019BD710FF14DC91EAAB7A6EF81710F54482EF896972A2EB39DD09EB53

Function 00F29997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F299C2
__swprintf.LIBCMT ref: 00F29A0C
__i64tow.LIBCMT ref: 00F5FA0F

Strings

%.15g, xrefs: 00F29A06
False, xrefs: 00F5F9D7
True, xrefs: 00F5F9D0
0x%p, xrefs: 00F5F9F1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: fb8b05815193f3eadc21b1dd6f8d6ebf88d776ce30ef86f91e85477e36196dc6
Instruction ID: d20292735cdd6ae7c2ce6ca70e23ee96ed1ec91f3282cc8259ae0e00463317d6
Opcode Fuzzy Hash: fb8b05815193f3eadc21b1dd6f8d6ebf88d776ce30ef86f91e85477e36196dc6
Instruction Fuzzy Hash: C2412932908615ABDB24EB34EC42F7677F8EF04320F2044AFEA49D7291EA759945BB11

Function 00FA73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA73D9
CreateMenu.USER32 ref: 00FA73F4
SetMenu.USER32(?,00000000), ref: 00FA7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FA7490
IsMenu.USER32(?), ref: 00FA74A6
CreatePopupMenu.USER32 ref: 00FA74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FA74DD
DrawMenuBar.USER32 ref: 00FA74E5

Strings

F, xrefs: 00FA74D1
0, xrefs: 00FA73CF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: cb956c13148138ea85efa0a17c44db1b2dbfb733f9286cc0d376f15be3b3b8f7
Instruction ID: 187324a08000db65a9060a6807c89e6b89b1f242c0bf95fccc0e614b0dac970e
Opcode Fuzzy Hash: cb956c13148138ea85efa0a17c44db1b2dbfb733f9286cc0d376f15be3b3b8f7
Instruction Fuzzy Hash: A94167B5A00349EFDB20EFA4DC84E9ABBB5FF4A310F144028ED459B360D731A914EB60

Function 00FA772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00FA77CD
CreateCompatibleDC.GDI32(00000000), ref: 00FA77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00FA77E7
SelectObject.GDI32(00000000,00000000), ref: 00FA77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FA77FA
DeleteDC.GDI32(00000000), ref: 00FA7803
GetWindowLongW.USER32(?,000000EC), ref: 00FA780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00FA7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00FA782D

Strings

static, xrefs: 00FA7765

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 6054d2b28778b199c6ec60ab3111be6f743cabca882fe9e6ca72165846f37199
Instruction ID: 944736977f00fc5dc6943153eea29e183146c1575f51601d027ecceb9a633c70
Opcode Fuzzy Hash: 6054d2b28778b199c6ec60ab3111be6f743cabca882fe9e6ca72165846f37199
Instruction Fuzzy Hash: 1D316FB2505219ABDF116FA4DC08FDB3B69FF0A321F114224FA55AA1A0C735D815EBA4

Function 00F47040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4707B

Part of subcall function 00F48D68: __getptd_noexit.LIBCMT ref: 00F48D68

__gmtime64_s.LIBCMT ref: 00F47114
__gmtime64_s.LIBCMT ref: 00F4714A
__gmtime64_s.LIBCMT ref: 00F47167
__allrem.LIBCMT ref: 00F471BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F471D9
__allrem.LIBCMT ref: 00F471F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F4720E
__allrem.LIBCMT ref: 00F47225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F47243
__invoke_watson.LIBCMT ref: 00F472B4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: a721118d29ca54b0886b0e89f7dd6eb36f6da6306d36604a3d04757852562987
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: AB710771E04716ABD714AE7DCC41B5BBBA8AF10374F14422AFD14E6381E774EA44AB90

Function 00F82A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F82A31
GetMenuItemInfoW.USER32(00FE6890,000000FF,00000000,00000030), ref: 00F82A92
SetMenuItemInfoW.USER32(00FE6890,00000004,00000000,00000030), ref: 00F82AC8
Sleep.KERNEL32(000001F4), ref: 00F82ADA
GetMenuItemCount.USER32(?), ref: 00F82B1E
GetMenuItemID.USER32(?,00000000), ref: 00F82B3A
GetMenuItemID.USER32(?,-00000001), ref: 00F82B64
GetMenuItemID.USER32(?,?), ref: 00F82BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00F82BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F82C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F82C24

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 83e8305c387e98b5aa04a4dee87434c98850af57f3aec260c8981a97185eb54e
Instruction ID: 19d96fea2fd7071ed0b2ee5c73df59681e732022e440084d9a5de91d29eb8203
Opcode Fuzzy Hash: 83e8305c387e98b5aa04a4dee87434c98850af57f3aec260c8981a97185eb54e
Instruction Fuzzy Hash: 69618CB190124DAFDB61EFA4CC88EFEBBB8EB42364F140559E84197251D735BD05EB20

Function 00FA7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00FA7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00FA7217
GetWindowLongW.USER32(?,000000F0), ref: 00FA723B
_memset.LIBCMT ref: 00FA724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FA725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00FA72D6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: c1f085d815005704448566a56c0cdde2317bd598177405056b41ce929cae6f6d
Instruction ID: 30cf3a9f4c6404a447cc4473c702431222576baa933dd60dd5a49e601cd8dea3
Opcode Fuzzy Hash: c1f085d815005704448566a56c0cdde2317bd598177405056b41ce929cae6f6d
Instruction Fuzzy Hash: 85616AB5900348AFDB10DFA4CC81EEE77F8AF4A714F140159FA14EB2A1C774AA45EB60

Function 00F7710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00F77135
SafeArrayAllocData.OLEAUT32(?), ref: 00F7718E
VariantInit.OLEAUT32(?), ref: 00F771A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00F771C0
VariantCopy.OLEAUT32(?,?), ref: 00F77213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00F77227
VariantClear.OLEAUT32(?), ref: 00F7723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00F77249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F77252
VariantClear.OLEAUT32(?), ref: 00F77264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00F7726F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9eebc12f4128a8268ee6ac484e31a5e8769434f6a9514f63216bc30dccae53c4
Instruction ID: df05ee6a57928bc55ed9a6c3e895f343d885d27ecffb3ad902d93e73486653de
Opcode Fuzzy Hash: 9eebc12f4128a8268ee6ac484e31a5e8769434f6a9514f63216bc30dccae53c4
Instruction Fuzzy Hash: 86416071A04219AFCB00EFA4DC449AEBBB8FF09354F00C069F955EB261CB74A945DF91

Function 00F95A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00F95AA6
inet_addr.WSOCK32(?,?,?), ref: 00F95AEB
gethostbyname.WSOCK32(?), ref: 00F95AF7
IcmpCreateFile.IPHLPAPI ref: 00F95B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00F95B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00F95B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00F95C00
WSACleanup.WSOCK32 ref: 00F95C06

Strings

Ping, xrefs: 00F95B29

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 4f2a4a11f11a25114e24f415fa2571ae21ecd6d1e002ecf293a774a216d0663b
Instruction ID: 107d30418cb03048c9eef0cae232fa28832a2a6db5fb17e3d14117738adedc82
Opcode Fuzzy Hash: 4f2a4a11f11a25114e24f415fa2571ae21ecd6d1e002ecf293a774a216d0663b
Instruction Fuzzy Hash: DE51B6716047109FEB21EF24DC45B2AB7E4EF84B20F14892AF955DB2A1DB74EC04EB46

Function 00F8B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F8B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00F8B7B1
GetLastError.KERNEL32 ref: 00F8B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00F8B828

Strings

UNKNOWN, xrefs: 00F8B7E0
READONLY, xrefs: 00F8B7F3
INVALID, xrefs: 00F8B7FA
NOTREADY, xrefs: 00F8B7E7
READY, xrefs: 00F8B801

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0dc6e8da5f120b43baffcc73af07b367618378ee3f7429bbe38091c60c509839
Instruction ID: a5b98aafe602f59e5091bcfa4ecabaeb37445688860b3705aef4ecebd5945072
Opcode Fuzzy Hash: 0dc6e8da5f120b43baffcc73af07b367618378ee3f7429bbe38091c60c509839
Instruction Fuzzy Hash: D9318135A003099FDB10FF64DC85AEE7BB4EF85710F14402AE801DB291DB759946FB51

Function 00F79471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00F794F6
GetDlgCtrlID.USER32 ref: 00F79501
GetParent.USER32 ref: 00F7951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F79520
GetDlgCtrlID.USER32(?), ref: 00F79529
GetParent.USER32(?), ref: 00F79545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F79548

Strings

ListBox, xrefs: 00F794B3
ComboBox, xrefs: 00F7947E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ec684ab5c170d023b93f935c90b178ca411e4bdf60fd6e65874af200d4bc94e9
Instruction ID: 12954fc1130070ddfc37078809b716d8b816fd91f8fed790a7dc3ccd69dde45a
Opcode Fuzzy Hash: ec684ab5c170d023b93f935c90b178ca411e4bdf60fd6e65874af200d4bc94e9
Instruction Fuzzy Hash: 2B210674D04208BBCF00AFA0CC85EFEBBB5EF45310F144126B521972E1DB799919EB61

Function 00F7955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00F795DF
GetDlgCtrlID.USER32 ref: 00F795EA
GetParent.USER32 ref: 00F79606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00F79609
GetDlgCtrlID.USER32(?), ref: 00F79612
GetParent.USER32(?), ref: 00F7962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00F79631

Strings

ListBox, xrefs: 00F7959E
ComboBox, xrefs: 00F79569

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: e562d5df63e569fb33af949f5175a9856aefbcc454d71d791dc0768fff1d58d5
Instruction ID: 5997e8c01c9c20f18c1c9b86f856ecfd4fcebf715454586673ee56dd0b79dd90
Opcode Fuzzy Hash: e562d5df63e569fb33af949f5175a9856aefbcc454d71d791dc0768fff1d58d5
Instruction Fuzzy Hash: 0B21D670904208BBDF00ABA0CC85EFEBBB5EF45300F14411AB511972A1DB799519AB61

Function 00F79645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00F79651
GetClassNameW.USER32(00000000,?,00000100), ref: 00F79666
_wcscmp.LIBCMT ref: 00F79678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00F796F3

Strings

details, xrefs: 00F796A1
list, xrefs: 00F796D5
smallicons, xrefs: 00F796BB
largeicons, xrefs: 00F79687
SHELLDLL_DefView, xrefs: 00F79672

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 7c3ddeebe783ca23237f0fa8ac3c68d75f58a34813b11c4d9a7f12f5c9c0437d
Instruction ID: 1c09e9650b52287a76c940917e845d9d7dc0528406fb455e0548037ef8b404ab
Opcode Fuzzy Hash: 7c3ddeebe783ca23237f0fa8ac3c68d75f58a34813b11c4d9a7f12f5c9c0437d
Instruction Fuzzy Hash: E011067764C307BAFA012660EC06EA67B9D9B05370F244237FE04E51D1FEE1A9117A9A

Function 00F98BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F98BEC
CoInitialize.OLE32(00000000), ref: 00F98C19
CoUninitialize.OLE32 ref: 00F98C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00F98D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00F98E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00FB2C0C), ref: 00F98E84
CoGetObject.OLE32(?,00000000,00FB2C0C,?), ref: 00F98EA7
SetErrorMode.KERNEL32(00000000), ref: 00F98EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00F98F3A
VariantClear.OLEAUT32(?), ref: 00F98F4A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 550e6d5ad221268ace0c2d78d6be1c4aecc1b2c4ef4e5eb94b0cf3ad49963d1f
Instruction ID: 505aa74e92dd20a9430a4d2d57495481cdbf3203f1641ddd631bc56abcf2774c
Opcode Fuzzy Hash: 550e6d5ad221268ace0c2d78d6be1c4aecc1b2c4ef4e5eb94b0cf3ad49963d1f
Instruction Fuzzy Hash: B8C137B16083059FDB00EF64C88492BB7E9FF8A748F00491DF5899B251DB71ED06DB52

Function 00F84189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00F8419D
__swprintf.LIBCMT ref: 00F841AA

Part of subcall function 00F438D8: __woutput_l.LIBCMT ref: 00F43931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00F841D4
LoadResource.KERNEL32(?,00000000), ref: 00F841E0
LockResource.KERNEL32(00000000), ref: 00F841ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00F8420D
LoadResource.KERNEL32(?,00000000), ref: 00F8421F
SizeofResource.KERNEL32(?,00000000), ref: 00F8422E
LockResource.KERNEL32(?), ref: 00F8423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00F8429B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 89a537e5475978ae43af73080b44ccfee02f6a7f111d22dfc2ed0a0d19e964b3
Instruction ID: 842f503c7dd8dc6f1a2e94062010484c8e841f369752ca39237146376e444459
Opcode Fuzzy Hash: 89a537e5475978ae43af73080b44ccfee02f6a7f111d22dfc2ed0a0d19e964b3
Instruction Fuzzy Hash: 0631AEB1A0521AABDB11AFA0EC88AFB7BADEF09301F044565F801D6150D734EA51ABA0

Function 00F816DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F81700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00F80778,?,00000001), ref: 00F81714
GetWindowThreadProcessId.USER32(00000000), ref: 00F8171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F80778,?,00000001), ref: 00F8172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F8173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F80778,?,00000001), ref: 00F81755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00F80778,?,00000001), ref: 00F81767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00F80778,?,00000001), ref: 00F817AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F80778,?,00000001), ref: 00F817C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00F80778,?,00000001), ref: 00F817CC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: a09b75dfb592c1d769f24901ba00e5e4967f7db2f5e5dce6cface258e68da869
Instruction ID: f4df730d31f3da9fcb6d12cbb9db6c90d89b616f4012528cddc5fc102303b2f4
Opcode Fuzzy Hash: a09b75dfb592c1d769f24901ba00e5e4967f7db2f5e5dce6cface258e68da869
Instruction Fuzzy Hash: D73181B5A04348BBEB21BF54DC84FAD77EEBB56721F104119F804CA2A0D7B4AD45AF90

Function 00F2FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F2FC06
OleUninitialize.OLE32(?,00000000), ref: 00F2FCA5
UnregisterHotKey.USER32(?), ref: 00F2FDFC
DestroyWindow.USER32(?), ref: 00F64A00
FreeLibrary.KERNEL32(?), ref: 00F64A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F64A92

Strings

close all, xrefs: 00F2FC01

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: fde4835c3d28320e8e9b05875ab2219b3194001c11eacc73c7a20fd47404eb1b
Instruction ID: d21e462666d9c6e433b2f1e82f779f49a1cc2aad4bb93b3210debd1ef75a4e14
Opcode Fuzzy Hash: fde4835c3d28320e8e9b05875ab2219b3194001c11eacc73c7a20fd47404eb1b
Instruction Fuzzy Hash: CFA19C31B012229FCB29EF50D895B69F774AF04710F1442BDE80AAB251CB34AD16EF54

Function 00F7A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00F7AA64), ref: 00F7A9A2

Strings

TEXT, xrefs: 00F7A8D9
CLASSNN, xrefs: 00F7A744
CLASS, xrefs: 00F7A721
NAME, xrefs: 00F7A7D4
REGEXPCLASS, xrefs: 00F7A767
INSTANCE, xrefs: 00F7A8B0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: cf2da5d057c0abd18a26e0c3bc2e810a0f97631feb6d36cce82aa807d360374b
Instruction ID: 2b65d036c095a45e58f016e87ce35a49ac4825508a510d4253f19cb18030f329
Opcode Fuzzy Hash: cf2da5d057c0abd18a26e0c3bc2e810a0f97631feb6d36cce82aa807d360374b
Instruction Fuzzy Hash: 5A919431A042069ADB08DF60C881BEDFB75BF44314F15C11AE99DA7241DF34A96AFB92

Function 00F22E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F22EAE

Part of subcall function 00F21DB3: GetClientRect.USER32(?,?), ref: 00F21DDC
Part of subcall function 00F21DB3: GetWindowRect.USER32(?,?), ref: 00F21E1D
Part of subcall function 00F21DB3: ScreenToClient.USER32(?,?), ref: 00F21E45

GetDC.USER32 ref: 00F5CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00F5CF95
SelectObject.GDI32(00000000,00000000), ref: 00F5CFA3
SelectObject.GDI32(00000000,00000000), ref: 00F5CFB8
ReleaseDC.USER32(?,00000000), ref: 00F5CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00F5D04B

Strings

U, xrefs: 00F5CF20

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 970ec8529a5dcc44cb1dd893bf15d254ac7d988a1f601eb5d934289d3f81946f
Instruction ID: ef8fce94649ba871869821150fd209d7764d8bb2a1033d0b724472f128eae0dc
Opcode Fuzzy Hash: 970ec8529a5dcc44cb1dd893bf15d254ac7d988a1f601eb5d934289d3f81946f
Instruction Fuzzy Hash: 6F71D771800209EFCF31CF64DC84AAA7BB6FF49361F144269EE569A1A9C7318C45FB61

Function 00FAC27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

Part of subcall function 00F22344: GetCursorPos.USER32(?), ref: 00F22357
Part of subcall function 00F22344: ScreenToClient.USER32(00FE67B0,?), ref: 00F22374
Part of subcall function 00F22344: GetAsyncKeyState.USER32(00000001), ref: 00F22399
Part of subcall function 00F22344: GetAsyncKeyState.USER32(00000002), ref: 00F223A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00FAC2E4
ImageList_EndDrag.COMCTL32 ref: 00FAC2EA
ReleaseCapture.USER32 ref: 00FAC2F0
SetWindowTextW.USER32(?,00000000), ref: 00FAC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00FAC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00FAC48F

Strings

@GUI_DROPID, xrefs: 00FAC3E1
@GUI_DRAGFILE, xrefs: 00FAC424

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 21a37d1f3aea675ab62673db23c04158b0ea80e35ed186df60dece1cd7f9ab55
Instruction ID: 629698067e0027688e9548f8ebfda395a9b71d763990c8054bec50b0d0957f63
Opcode Fuzzy Hash: 21a37d1f3aea675ab62673db23c04158b0ea80e35ed186df60dece1cd7f9ab55
Instruction Fuzzy Hash: B551AFB1504308EFDB10EF24DC95F6A7BE5EF89310F04451DF9918B2A1CB74A949EB52

Function 00F98F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00FAF910), ref: 00F9903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00FAF910), ref: 00F99071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00F991EB
SysFreeString.OLEAUT32(?), ref: 00F99215

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 635b8eb2274a8079433772e6135f5f51c1c5af8afe309c1bb2752f6b6ebabe5d
Instruction ID: 475b53f5330d5cb677b7756fee804407c2204aa8997583afa4c81ad84a5ecbe9
Opcode Fuzzy Hash: 635b8eb2274a8079433772e6135f5f51c1c5af8afe309c1bb2752f6b6ebabe5d
Instruction Fuzzy Hash: 56F17E71A04109EFEF04DF98C888EAEB7B9FF89314F118059F915AB250CB71AE46DB50

Function 00F9F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F9FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00F9FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F9FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00F9FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F9FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00F9FD90
CloseHandle.KERNEL32(?), ref: 00F9FDBF
CloseHandle.KERNEL32(?), ref: 00F9FE36

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 85a04ee08d875b15337a12881cdd9783cd628d69c1ab8eb7da119f6ff7ff18c4
Instruction ID: 8e421ed9624033bfb8d515c858f0ed11d5db4b95ce8a5d779a12fc2cc2ae529b
Opcode Fuzzy Hash: 85a04ee08d875b15337a12881cdd9783cd628d69c1ab8eb7da119f6ff7ff18c4
Instruction Fuzzy Hash: 64E1C531604301DFDB14EF24D881B6ABBE0BF85324F14846DF8998B2A2CB75DD48EB52

Function 00F84F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F838D3,?), ref: 00F848C7

Part of subcall function 00F848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F838D3,?), ref: 00F848E0

Part of subcall function 00F84CD3: GetFileAttributesW.KERNEL32(?,00F83947), ref: 00F84CD4

lstrcmpiW.KERNEL32(?,?), ref: 00F84FE2
_wcscmp.LIBCMT ref: 00F84FFC
MoveFileW.KERNEL32(?,?), ref: 00F85017

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 9477fd579b2ff9c40fb521d90f43035ddf2591e75f7d994147d435d435c27ce0
Instruction ID: 1f5c1361ed67d66cb4787a42884da69bfe539c1f4af8fc05d71ff87e65757093
Opcode Fuzzy Hash: 9477fd579b2ff9c40fb521d90f43035ddf2591e75f7d994147d435d435c27ce0
Instruction Fuzzy Hash: 9F5195B240C7859BC724EB90DC819DFB7ECAF85710F40092EB689D3151EF78A58C9766

Function 00FA88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00FA896E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c2b1fe404795e232b30f9a99e2f2499fc22cf5fbb53c1f1a9288b8a358a8f1ef
Instruction ID: 96327561dfe0dc08bbd63ec2736fb611491b2873944304997fe0b41e88560b47
Opcode Fuzzy Hash: c2b1fe404795e232b30f9a99e2f2499fc22cf5fbb53c1f1a9288b8a358a8f1ef
Instruction Fuzzy Hash: 0D51B5B0A00208BFEF209F64CC85B6A7B65BF073A0F504112F511E61E1DFF9A986BB51

Function 00F22B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00F5C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00F5C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00F5C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00F5C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00F5C5C0
DestroyIcon.USER32(00000000), ref: 00F5C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00F5C5EC
DestroyIcon.USER32(?), ref: 00F5C5FB

Part of subcall function 00FAA71E: DeleteObject.GDI32(00000000), ref: 00FAA757

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 3d1ac62c35281a6791a41e3ffb396a9155094bcc5a36e7eb1d0b5a7290738f5b
Instruction ID: eb51a36ded3234ba537f390279b91f6d52a6d73607dbf8d1dcccf3d0e630687d
Opcode Fuzzy Hash: 3d1ac62c35281a6791a41e3ffb396a9155094bcc5a36e7eb1d0b5a7290738f5b
Instruction Fuzzy Hash: D0516971A00309AFDB20DF64DC45FAA3BB5EB58361F100528F902DB2A0DB74ED84EB90

Function 00F79B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F7AE77
Part of subcall function 00F7AE57: GetCurrentThreadId.KERNEL32 ref: 00F7AE7E
Part of subcall function 00F7AE57: AttachThreadInput.USER32(00000000,?,00F79B65,?,00000001), ref: 00F7AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00F79B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00F79B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00F79B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F79B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00F79BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F79BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00F79BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00F79BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00F79BDD

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 8185a5b53517f6e68b3e30ba966485842edd71957df14ca548f78fe4f8d46eb0
Instruction ID: af0d66cd32ed3a9caf89f397e94d5d9dba2afc1037fe3a70397fe52f95cf8e4d
Opcode Fuzzy Hash: 8185a5b53517f6e68b3e30ba966485842edd71957df14ca548f78fe4f8d46eb0
Instruction Fuzzy Hash: 291104B1550218BEF6106FA4DC89F6A3F2DEB4D751F110426F248AF1A1C9F36C10EEA5

Function 00F78E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00F78A84,00000B00,?,?), ref: 00F78E0C
HeapAlloc.KERNEL32(00000000,?,00F78A84,00000B00,?,?), ref: 00F78E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00F78A84,00000B00,?,?), ref: 00F78E28
GetCurrentProcess.KERNEL32(?,00000000,?,00F78A84,00000B00,?,?), ref: 00F78E30
DuplicateHandle.KERNEL32(00000000,?,00F78A84,00000B00,?,?), ref: 00F78E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00F78A84,00000B00,?,?), ref: 00F78E43
GetCurrentProcess.KERNEL32(00F78A84,00000000,?,00F78A84,00000B00,?,?), ref: 00F78E4B
DuplicateHandle.KERNEL32(00000000,?,00F78A84,00000B00,?,?), ref: 00F78E4E
CreateThread.KERNEL32(00000000,00000000,00F78E74,00000000,00000000,00000000), ref: 00F78E68

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: c79c23a4f106e38d7f54eccb36dc69e1127571958a9f5614657d2b3ec6d8dfd6
Instruction ID: f7da90541f1a80b2c368ed196849db7b3ad560e08ba6834a77c36d0ffb313b9f
Opcode Fuzzy Hash: c79c23a4f106e38d7f54eccb36dc69e1127571958a9f5614657d2b3ec6d8dfd6
Instruction Fuzzy Hash: D701BBB5240308FFE760ABA5DC4DF6B3BACEB89711F004421FA05DF1A1DA709804DB21

Function 00F99428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9947C
VariantInit.OLEAUT32(?), ref: 00F9954D
VariantInit.OLEAUT32(?), ref: 00F9964E
VariantClear.OLEAUT32(?), ref: 00F99658
VariantClear.OLEAUT32(?), ref: 00F996B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00F99631
Null Object assignment in FOR..IN loop, xrefs: 00F994DD, 00F9960B, 00F996C3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 26ddf5b53e2187f6a5a22b42e3b980d1292ef637ed4ecdbae48c9dd6aa2640fd
Instruction ID: a38d440c1bf3ef1b3d6791cb28ea57a8b15dcb050ee04ab461e6ca35680837c3
Opcode Fuzzy Hash: 26ddf5b53e2187f6a5a22b42e3b980d1292ef637ed4ecdbae48c9dd6aa2640fd
Instruction Fuzzy Hash: 2191A071E04215ABEF24DFA9C844FAEBBB8EF85320F15815DF505AB280D7B09905DFA0

Function 00F99A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00F77652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?,?,00F7799D), ref: 00F7766F
Part of subcall function 00F77652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?), ref: 00F7768A
Part of subcall function 00F77652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?), ref: 00F77698
Part of subcall function 00F77652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?), ref: 00F776A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00F99B1B
_memset.LIBCMT ref: 00F99B28
_memset.LIBCMT ref: 00F99C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00F99C97
CoTaskMemFree.OLE32(?), ref: 00F99CA2

Strings

NULL Pointer assignment, xrefs: 00F99CF0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 736a855920984b4aa4243717d86fbf344783b388830fa42d36060ad711ac50b0
Instruction ID: 8e06c45624477b45439155f4fcb2b1243016d61941042272ad0fa6c03149c55d
Opcode Fuzzy Hash: 736a855920984b4aa4243717d86fbf344783b388830fa42d36060ad711ac50b0
Instruction Fuzzy Hash: 61913A71D00229EBDF20DFA5DC85ADEBBB9EF08710F20415AF419A7281DB759A44DFA0

Function 00FA6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00FA7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 00FA70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00FA70C1
_wcscat.LIBCMT ref: 00FA711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00FA7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00FA7161

Strings

SysListView32, xrefs: 00FA7065

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 7c8ae7a942364b5c9d55b7a805d7244b672d485f3ba4bd63518fab9a1ac9fabe
Instruction ID: 75e3cf4be7b3bc74749d388dd604031fe6dc0ecbd17d1f32c2c718a32f967aac
Opcode Fuzzy Hash: 7c8ae7a942364b5c9d55b7a805d7244b672d485f3ba4bd63518fab9a1ac9fabe
Instruction Fuzzy Hash: CF41A5B1A04308AFDB219FA4CC85FEE77E8EF09360F10442AF944E7291D7759D84AB50

Function 00F9EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00F83E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00F83EB6
Part of subcall function 00F83E91: Process32FirstW.KERNEL32(00000000,?), ref: 00F83EC4
Part of subcall function 00F83E91: CloseHandle.KERNEL32(00000000), ref: 00F83F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F9ECB8
GetLastError.KERNEL32 ref: 00F9ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00F9ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00F9ED77
GetLastError.KERNEL32(00000000), ref: 00F9ED82
CloseHandle.KERNEL32(00000000), ref: 00F9EDB7

Strings

SeDebugPrivilege, xrefs: 00F9ECD6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 44da69d485df1d3be2dfd2cb3a3c505169cea3ad7be1468fe8ba3bba5a11e178
Instruction ID: 96e32b755f09d8a0ecffadef7c43e379fd38215624d2028f46a2de9b2588a2bf
Opcode Fuzzy Hash: 44da69d485df1d3be2dfd2cb3a3c505169cea3ad7be1468fe8ba3bba5a11e178
Instruction Fuzzy Hash: F941D2716042009FEB14EF24CC95F6DB7A5AF41714F08841AF8469F2D2DBB9A809EB92

Function 00F83226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00F832C5

Strings

warning, xrefs: 00F832AE
question, xrefs: 00F8327E
info, xrefs: 00F83266
stop, xrefs: 00F83296
blank, xrefs: 00F83247

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: a07ae16489b991649ba4f7d199d320b6a8a6e71d2ed454b44520cd53b06c2559
Instruction ID: 03644a0b5d58d8cd1cd6ded17f8c15cb9e073843b9943698406fe295270b4685
Opcode Fuzzy Hash: a07ae16489b991649ba4f7d199d320b6a8a6e71d2ed454b44520cd53b06c2559
Instruction Fuzzy Hash: 25113D32A083467BE7016B55DC43DEAB79CDF19B70F10002AF900962D2E6759B4177A5

Function 00F84534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00F8454E
LoadStringW.USER32(00000000), ref: 00F84555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F8456B
LoadStringW.USER32(00000000), ref: 00F84572
_wprintf.LIBCMT ref: 00F84598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F845B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F84593

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: f0ca1acd7b3d73b58d0347aca42cf5cd8452b8cc65fbc150250df6cdadb07110
Instruction ID: 4157518b61b5574d9dcb1595fba639b8ca0e2cac83d7be0e35895ed5b3a1cd0a
Opcode Fuzzy Hash: f0ca1acd7b3d73b58d0347aca42cf5cd8452b8cc65fbc150250df6cdadb07110
Instruction Fuzzy Hash: CA01A2F280020CBFE710E7E0DD89EEB776CDB08300F4004A5BB05DA111EA749E889B70

Function 00FAD74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

GetSystemMetrics.USER32(0000000F), ref: 00FAD78A
GetSystemMetrics.USER32(0000000F), ref: 00FAD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00FAD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00FADA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00FADA24
ShowWindow.USER32(00000003,00000000), ref: 00FADA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00FADA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00FADA8B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: bf0151933e52a03ca0dd8a7b94224cf3081bcb631a733f6c87ee82b95df989c9
Instruction ID: c29bd51fdc7325b78a2878ed93976bdf37af0b998701704179547a63a790147c
Opcode Fuzzy Hash: bf0151933e52a03ca0dd8a7b94224cf3081bcb631a733f6c87ee82b95df989c9
Instruction Fuzzy Hash: 69B19BB1900219EFDF14CF68C9C57BE7BB1BF0A710F088069EC4A9E695D734A950EB90

Function 00F22A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F5C417,00000004,00000000,00000000,00000000), ref: 00F22ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00F5C417,00000004,00000000,00000000,00000000,000000FF), ref: 00F22B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00F5C417,00000004,00000000,00000000,00000000), ref: 00F5C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00F5C417,00000004,00000000,00000000,00000000), ref: 00F5C4D6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 2ddd961cafb7c3c964124703f13f542be048c070cf434c77f4ff7472ad6398a4
Instruction ID: 6c53ee175ae27566090071a36f5ca56ee4db9415bdf457649d09abf3f03cb7e1
Opcode Fuzzy Hash: 2ddd961cafb7c3c964124703f13f542be048c070cf434c77f4ff7472ad6398a4
Instruction Fuzzy Hash: 58417131A04394BEC7B59F28EC9CB7B3BD2AF86320F14842DE54786961C67D9845FB50

Function 00F87368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00F8737F

Part of subcall function 00F40FF6: std::exception::exception.LIBCMT ref: 00F4102C
Part of subcall function 00F40FF6: __CxxThrowException@8.LIBCMT ref: 00F41041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00F873B6
EnterCriticalSection.KERNEL32(?), ref: 00F873D2
_memmove.LIBCMT ref: 00F87420
_memmove.LIBCMT ref: 00F8743D
LeaveCriticalSection.KERNEL32(?), ref: 00F8744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00F87461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00F87480

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e7619d203b29268c616f1ffec302ba5786d3cce7cd9b2dafdb76ebfdb0e18020
Instruction ID: 568e876bc2ca5e898afc6cb77bc7bae4f6e09b0de6b89ac47ef7dedf31dcca1f
Opcode Fuzzy Hash: e7619d203b29268c616f1ffec302ba5786d3cce7cd9b2dafdb76ebfdb0e18020
Instruction Fuzzy Hash: 92317071904209EBCF10EFA4DC85AAE7BB8FF45710B1441B5FD049B246DB34DA54EBA0

Function 00FA6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FA645A
GetDC.USER32(00000000), ref: 00FA6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FA646D
ReleaseDC.USER32(00000000,00000000), ref: 00FA6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00FA64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00FA64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00FA9299,?,?,000000FF,00000000,?,000000FF,?), ref: 00FA6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00FA6520

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 91cdc86a7ff1e0b86009469c7f85503b14262ce16df7f69a231f6a4d98c23f21
Instruction ID: a4e8f4abeed379f2a3d7acbc9c6d534a576f5b31d828486079e89f1ee1f52b24
Opcode Fuzzy Hash: 91cdc86a7ff1e0b86009469c7f85503b14262ce16df7f69a231f6a4d98c23f21
Instruction Fuzzy Hash: F2316DB2601214BFEB118F50CC4AFEA3FA9EF0A765F084065FE08DE295D6759C41DB64

Function 00F7C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F7C087
_memcmp.LIBCMT ref: 00F7C0A9
_memcmp.LIBCMT ref: 00F7C0C1
_memcmp.LIBCMT ref: 00F7C0D4
_memcmp.LIBCMT ref: 00F7C0EE
_memcmp.LIBCMT ref: 00F7C101
_memcmp.LIBCMT ref: 00F7C119
_memcmp.LIBCMT ref: 00F7C134

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ffc551a2ec109cd21a755ec663862e044c63eb63475e61af21ad2e99667a958b
Instruction ID: fec122a561f444d01ba744b5efe9e71c9605c30cd175b6c5c3aac70c1dd2f387
Opcode Fuzzy Hash: ffc551a2ec109cd21a755ec663862e044c63eb63475e61af21ad2e99667a958b
Instruction Fuzzy Hash: A921D4A2A00205BBD250B5219C42FBF3B9CAF103B4B44802AFD0DD6293F755DE11B6E7

Function 00F8ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

Part of subcall function 00F3FEC6: _wcscpy.LIBCMT ref: 00F3FEE9

_wcstok.LIBCMT ref: 00F8EEFF
_wcscpy.LIBCMT ref: 00F8EF8E
_memset.LIBCMT ref: 00F8EFC1

Strings

X, xrefs: 00F8EFFE

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: c4dbe592c1b2c466eb602a49c1f0631a18f3d81e69f9ff214b27cc9159d97520
Instruction ID: 5de7797e11cf6559da0bdeb9e1cfa99d5b0eb848e598f20aa17995a110133281
Opcode Fuzzy Hash: c4dbe592c1b2c466eb602a49c1f0631a18f3d81e69f9ff214b27cc9159d97520
Instruction Fuzzy Hash: A4C17E715087119FC724FF24DC85A9AB7E0BF84310F04492DF8999B2A2DB74ED49EB82

Function 00F21424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae4a48dc78f6697ecb423e882749aca74a35ff94a9653432b6ce8c6116a3792
Instruction ID: c2503b6833ee30e6c5c2af6122f49c5d833901c3990b26be46397c5d6cef7144
Opcode Fuzzy Hash: eae4a48dc78f6697ecb423e882749aca74a35ff94a9653432b6ce8c6116a3792
Instruction Fuzzy Hash: 2571AF71900119EFCB14DF98DC49ABEBB79FF86320F248149F915AA251C734AA11EFA4

Function 00F96E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e4d35c1e264662bc55be3c97d21c6de9a16ffcc290217ad14d21eceb489284
Instruction ID: c8cd7584ff22a3c34181fe5267eb44cb91e19c0bdb0c0cc3906904f6efb0e65a
Opcode Fuzzy Hash: 76e4d35c1e264662bc55be3c97d21c6de9a16ffcc290217ad14d21eceb489284
Instruction Fuzzy Hash: B1610372508310ABEB10EB24DC82F6FB7E9EF84B10F10491DF5459B2A2DB789D05EB52

Function 00FAB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(011356B0), ref: 00FAB6A5
IsWindowEnabled.USER32(011356B0), ref: 00FAB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00FAB795
SendMessageW.USER32(011356B0,000000B0,?,?), ref: 00FAB7CC
IsDlgButtonChecked.USER32(?,?), ref: 00FAB809
GetWindowLongW.USER32(011356B0,000000EC), ref: 00FAB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00FAB843

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: ac14372f8a727a885785efbce4da8ab018220592c3326f85ad9541e97173c074
Instruction ID: 6004285ca478c5c7b5a7840e4c4f594a807f764f55e903e2b507aa8ed1dcb690
Opcode Fuzzy Hash: ac14372f8a727a885785efbce4da8ab018220592c3326f85ad9541e97173c074
Instruction Fuzzy Hash: 4F71B1B4A00208AFDB20DF64C8D4FAA7BB9FF5B360F144099E94597362C771A941FB50

Function 00F9F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9F75C
_memset.LIBCMT ref: 00F9F825
ShellExecuteExW.SHELL32(?), ref: 00F9F86A

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

Part of subcall function 00F3FEC6: _wcscpy.LIBCMT ref: 00F3FEE9

GetProcessId.KERNEL32(00000000), ref: 00F9F8E1
CloseHandle.KERNEL32(00000000), ref: 00F9F910

Strings

@, xrefs: 00F9F839

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: defa36012f2ea5b32bca67f030c6d07f85f46d557111af84a6ddbe1a75a1a07c
Instruction ID: 4b8c1570c7156a04360309e515dc8edbc3c6bb6b86361210ad14fbde474be061
Opcode Fuzzy Hash: defa36012f2ea5b32bca67f030c6d07f85f46d557111af84a6ddbe1a75a1a07c
Instruction Fuzzy Hash: 19619D75E006299FDF14DF94D8819AEBBB4FF48320F148469E846AB351CB34AD44EB90

Function 00F8145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F8149C
GetKeyboardState.USER32(?), ref: 00F814B1
SetKeyboardState.USER32(?), ref: 00F81512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00F81540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00F8155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00F815A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00F815C8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fbd363c0ddbd205bacf62204c2a5a3f2799ab869f489d9ab6e8ce899c2f0cf82
Instruction ID: 1b3fd52191e4903715a1520c1c11859a6fc42c90a4c95f4e2a324400991ad49e
Opcode Fuzzy Hash: fbd363c0ddbd205bacf62204c2a5a3f2799ab869f489d9ab6e8ce899c2f0cf82
Instruction Fuzzy Hash: F951F3A0A046D53DFB32A2248C45BFA7FAD7B46324F0C4689E1D5898C2D3989C96E750

Function 00F81276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00F812B5
GetKeyboardState.USER32(?), ref: 00F812CA
SetKeyboardState.USER32(?), ref: 00F8132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00F81357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00F81374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00F813B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00F813D9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: fc9165702bb4b5ac380ec80ca1a71c93b3a2a8e2f8bd49d1047306da1b191baa
Instruction ID: e9291ae906c6ae9c55c3109869a5a01be4cd1791d3b025de7c326199c14c8a05
Opcode Fuzzy Hash: fc9165702bb4b5ac380ec80ca1a71c93b3a2a8e2f8bd49d1047306da1b191baa
Instruction Fuzzy Hash: 0D51D5A09046D53DFB32A6248C45BFA7FAD7B07310F088689E1D49A8C2D795AC9AF750

Function 00F8589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00F858AC
_wcsncpy.LIBCMT ref: 00F858E1
_wcsncpy.LIBCMT ref: 00F85913
_wcsncpy.LIBCMT ref: 00F85946
_wcsncpy.LIBCMT ref: 00F85988
_wcsncpy.LIBCMT ref: 00F859C2
_wcsncpy.LIBCMT ref: 00F859F1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 487800110f1d9660fd42fa764520b1b874b8b9cb617391c128eebfae259447a8
Instruction ID: 2d1d2367e2509bb82dcfdd5fa08dbfaf1f28836ad4d8b71e2303bb10a49182ea
Opcode Fuzzy Hash: 487800110f1d9660fd42fa764520b1b874b8b9cb617391c128eebfae259447a8
Instruction Fuzzy Hash: 4941A365C2051876CB50FBB4CC86ACFBBA8AF04710F508566F918E3121F738E714E7A5

Function 00F838AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00F838D3,?), ref: 00F848C7

Part of subcall function 00F848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00F838D3,?), ref: 00F848E0

lstrcmpiW.KERNEL32(?,?), ref: 00F838F3
_wcscmp.LIBCMT ref: 00F8390F
MoveFileW.KERNEL32(?,?), ref: 00F83927
_wcscat.LIBCMT ref: 00F8396F
SHFileOperationW.SHELL32(?), ref: 00F839DB

Strings

\*.*, xrefs: 00F83969

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 12e6056c74f359ff3588984f12f82e161a891dbfe54fc1f5cf2bedb343df2e87
Instruction ID: 17a6e605e386d4c317166af4c4c508818c9c6765e34018fc8eb9a0d81a82e51b
Opcode Fuzzy Hash: 12e6056c74f359ff3588984f12f82e161a891dbfe54fc1f5cf2bedb343df2e87
Instruction Fuzzy Hash: 45418EB250C3459AC751FF64C881AEFB7ECAF89750F40192EF48AC3161EA78D688D752

Function 00FA7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FA75C0
IsMenu.USER32(?), ref: 00FA75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00FA7620
DrawMenuBar.USER32 ref: 00FA7633

Strings

0, xrefs: 00FA750D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: bb615ad9bb47443d17f38deea73b85bd0252330928d7ad622fd70a2c627f1a7b
Instruction ID: b10a754c15057ebc8e38d70e60b3e18c063bda526be7413af7845db649d5795b
Opcode Fuzzy Hash: bb615ad9bb47443d17f38deea73b85bd0252330928d7ad622fd70a2c627f1a7b
Instruction Fuzzy Hash: 664128B5A04708AFDB20EF54D884E9ABBF8FB0A364F048129E9159B350D730ED54EF90

Function 00FA122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00FA125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FA1286
FreeLibrary.KERNEL32(00000000), ref: 00FA133D

Part of subcall function 00FA122D: RegCloseKey.ADVAPI32(?), ref: 00FA12A3
Part of subcall function 00FA122D: FreeLibrary.KERNEL32(?), ref: 00FA12F5
Part of subcall function 00FA122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00FA1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 00FA12E0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d56649cad1e473d0e8e002a8939034e7a153586209643ed54e61bea7be1e080a
Instruction ID: c734707f90ee7005dce7868f5bf23035dfe86488e77129f3154bc18bdf3ec9c8
Opcode Fuzzy Hash: d56649cad1e473d0e8e002a8939034e7a153586209643ed54e61bea7be1e080a
Instruction Fuzzy Hash: CB311AB1D01209BFEB149FD0DC89AFFB7BCFF0A310F004169E501E6151EA749E49AAA4

Function 00FA653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00FA655B
GetWindowLongW.USER32(011356B0,000000F0), ref: 00FA658E
GetWindowLongW.USER32(011356B0,000000F0), ref: 00FA65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00FA65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00FA661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00FA6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00FA664A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c6e1d241f7e58d3100686e140859fa037eb1c7f9c96308e502e444b5ffef1bb4
Instruction ID: 1fd3a6e2713ceafc255ddbd9f62ec1af6a57c6f37db9126d9c0cfff1bdb883a1
Opcode Fuzzy Hash: c6e1d241f7e58d3100686e140859fa037eb1c7f9c96308e502e444b5ffef1bb4
Instruction Fuzzy Hash: 013102B0A04258AFDB20CF68DC88F553BE5FB5A364F1D01A8F511CF2B5CB61A844EB41

Function 00F96486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F980A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F980CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00F964D9
WSAGetLastError.WSOCK32(00000000), ref: 00F964E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F96521
connect.WSOCK32(00000000,?,00000010), ref: 00F9652A
WSAGetLastError.WSOCK32 ref: 00F96534
closesocket.WSOCK32(00000000), ref: 00F9655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00F96576

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: e44f0234102daabd9ac9716d349b603b9a0d4902c0fd7b2201e8deb147f330d1
Instruction ID: 60441fbfaeca11aeac56161cb7a38e3edad58e287e1a87a2ec1ed2713d8ed718
Opcode Fuzzy Hash: e44f0234102daabd9ac9716d349b603b9a0d4902c0fd7b2201e8deb147f330d1
Instruction Fuzzy Hash: 9731B571A00218AFEF109F54DC85BBE77A8EB45724F044029F905DB291DB78AD49EB61

Function 00F7E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F7E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00F7E120
SysAllocString.OLEAUT32(00000000), ref: 00F7E123
SysAllocString.OLEAUT32 ref: 00F7E144
SysFreeString.OLEAUT32 ref: 00F7E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00F7E167
SysAllocString.OLEAUT32(?), ref: 00F7E175

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 33ff1a377c75fb85f81fc8857ec466b35c3c547cf4bfccbb14114e2f85f5a770
Instruction ID: 6dab73ff857a22f2d8bd418f10659dfee21f222496fcf6a9dd095d0a23b2452f
Opcode Fuzzy Hash: 33ff1a377c75fb85f81fc8857ec466b35c3c547cf4bfccbb14114e2f85f5a770
Instruction Fuzzy Hash: 69219072600108AF9B10DFA8DC89DAB77ACEB0D760B408177F918CB261DAB09C45AB65

Function 00F7FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F7FB81
__wcsnicmp.LIBCMT ref: 00F7FBA2
__wcsnicmp.LIBCMT ref: 00F7FBBC

Strings

#OnAutoItStartRegister, xrefs: 00F7FBB6
#notrayicon, xrefs: 00F7FB79
#requireadmin, xrefs: 00F7FB9C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: ec32a09499135095751ab0782d23dba728a167abb92b3208d2d9cb30ac31dabb
Instruction ID: 6c9027e7999f5b8c9110af7d96601eb2261673eebed738adc41728c1bb373500
Opcode Fuzzy Hash: ec32a09499135095751ab0782d23dba728a167abb92b3208d2d9cb30ac31dabb
Instruction Fuzzy Hash: 8A213A72904252A6D231E628EC12FA77798EF51360F14C037FC8986141EB55AA89F297

Function 00FA783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F21D73
Part of subcall function 00F21D35: GetStockObject.GDI32(00000011), ref: 00F21D87
Part of subcall function 00F21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F21D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00FA78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00FA78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00FA78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00FA78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00FA78D4

Strings

Msctls_Progress32, xrefs: 00FA7872

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 03840f9aa71430c41880bc5c47aad9889728b00bb7be7b8e32df70e7f4fe7f9d
Instruction ID: 118a4d347c16fd8864bb67fafb1bc54f3291943bf5602f71a0fed4bff0131762
Opcode Fuzzy Hash: 03840f9aa71430c41880bc5c47aad9889728b00bb7be7b8e32df70e7f4fe7f9d
Instruction Fuzzy Hash: 4A1193B251021DBFEF159F60CC85EE77F5DEF097A8F114115B604A6090C775AC21EBA4

Function 00F441C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00F44292,?), ref: 00F441E3
GetProcAddress.KERNEL32(00000000), ref: 00F441EA
EncodePointer.KERNEL32(00000000), ref: 00F441F6
DecodePointer.KERNEL32(00000001,00F44292,?), ref: 00F44213

Strings

combase.dll, xrefs: 00F441DE
RoInitialize, xrefs: 00F441D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: b7c206a75ae6402fc662ad5a49c2a3b1037627bf8688e102ff3bedb7daa3758c
Instruction ID: 9f1d4f3e66322b6ece5c3ca5c2c60fc22a92cbb1761cd0e20268baef8716dd3b
Opcode Fuzzy Hash: b7c206a75ae6402fc662ad5a49c2a3b1037627bf8688e102ff3bedb7daa3758c
Instruction Fuzzy Hash: 5EE012F0A90348AFEF616BB1EC49B4439A4B756703F104428F511ED0E0DBB96095BF00

Function 00F4429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00F441B8), ref: 00F442B8
GetProcAddress.KERNEL32(00000000), ref: 00F442BF
EncodePointer.KERNEL32(00000000), ref: 00F442CA
DecodePointer.KERNEL32(00F441B8), ref: 00F442E5

Strings

combase.dll, xrefs: 00F442B3
RoUninitialize, xrefs: 00F442A7

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 5ea0fcf10cb1b4d7b5ecdb958615c59c52f07605ebf9aa9c4447c0258af9f764
Instruction ID: c891296d94206db43c3b6f3574330a14d7d8221944f5414efab57bee0f199661
Opcode Fuzzy Hash: 5ea0fcf10cb1b4d7b5ecdb958615c59c52f07605ebf9aa9c4447c0258af9f764
Instruction Fuzzy Hash: 33E0B6B8A91348AFEF51ABA1EC4DB453AA4B725742F10442DF401E90A0CBB8A648FA15

Function 00F8675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F868AD
_memmove.LIBCMT ref: 00F867E8

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

_memmove.LIBCMT ref: 00F8685B
_memmove.LIBCMT ref: 00F86942
_memmove.LIBCMT ref: 00F8695B
_memmove.LIBCMT ref: 00F86977

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction ID: 89f39013b2c20ccfb9621a820cbabdc2e1899d153ad2f6e8d36fc012ee8b4592
Opcode Fuzzy Hash: ab4eb5b95743a44d51d7fadd3155ba3afd48b97ef46ff4ca0970a978f0b83e01
Instruction Fuzzy Hash: E661DE3150426A9BDF11FF24DC82EFE3BA4AF44318F044519FC599B292DB78AD45EB90

Function 00FA046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00FA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FA0038,?,?), ref: 00FA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FA0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FA0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00FA05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00FA05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00FA0617
RegCloseKey.ADVAPI32(00000000), ref: 00FA0624

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 14e785e71b0ac9f344ab79b96bb52bd04588bf82ec516dab6e3270c84fdc9f0c
Instruction ID: 076a729c723f124f9229c0699298c73609a3141f194f2db589cbcc491d1a5833
Opcode Fuzzy Hash: 14e785e71b0ac9f344ab79b96bb52bd04588bf82ec516dab6e3270c84fdc9f0c
Instruction Fuzzy Hash: 4A515771908200AFDB10EB64DC85E6ABBE8FF89714F04891DF5858B2A1DB35E905EB52

Function 00FA5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00FA5A82
GetMenuItemCount.USER32(00000000), ref: 00FA5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00FA5AE1
GetMenuItemID.USER32(?,?), ref: 00FA5B50
GetSubMenu.USER32(?,?), ref: 00FA5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00FA5BAF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 1d189bcd962d645349779834f63ff921a4cc38a737fc208846914bef3e7d8807
Instruction ID: 3041b9c052ff7a79247b63db29b1f55d4611686f48f58c27a6a5011929fe971d
Opcode Fuzzy Hash: 1d189bcd962d645349779834f63ff921a4cc38a737fc208846914bef3e7d8807
Instruction Fuzzy Hash: 4C518275E00615EFCB11EFA4C845AAEB7B4EF49720F104459FC01BB351CB74AE41AB90

Function 00F7F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F7F3F7
VariantClear.OLEAUT32(00000013), ref: 00F7F469
VariantClear.OLEAUT32(00000000), ref: 00F7F4C4
_memmove.LIBCMT ref: 00F7F4EE
VariantClear.OLEAUT32(?), ref: 00F7F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00F7F569

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 9493e513b6eb9230f10c48c83be7abdd972af8e151f0ca3f4b557ba558386002
Instruction ID: 3d3156aa4385b41d4d70ec9bfa889f553ab07685277e6e9a7502577ec5289bff
Opcode Fuzzy Hash: 9493e513b6eb9230f10c48c83be7abdd972af8e151f0ca3f4b557ba558386002
Instruction Fuzzy Hash: 6E5167B5A00209EFCB10CF58D880AAABBF8FF4C354B15816AED59DB300D730E915CBA0

Function 00F826F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F82747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00F82792
IsMenu.USER32(00000000), ref: 00F827B2
CreatePopupMenu.USER32 ref: 00F827E6
GetMenuItemCount.USER32(000000FF), ref: 00F82844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00F82875

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: b7d3a44687aeffb1c101d95c234cb5e20dac210b7040fe0ecd6910ff4ef2eb6c
Instruction ID: 9bde64160600dc5045298843ceb5c91a759f23b54e84922d59386d1b527f7e2c
Opcode Fuzzy Hash: b7d3a44687aeffb1c101d95c234cb5e20dac210b7040fe0ecd6910ff4ef2eb6c
Instruction Fuzzy Hash: D1518E70E00209EFDF64EF68D888BEEBBF5BF45324F14416AE8119B291D770A944EB51

Function 00F21765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00F2179A
GetWindowRect.USER32(?,?), ref: 00F217FE
ScreenToClient.USER32(?,?), ref: 00F2181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F2182C
EndPaint.USER32(?,?), ref: 00F21876

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 822a2237a2effd027047100084c2e4c9bbc4c41274be96093d0032bf5bfbc6bd
Instruction ID: 60e6fa006154bd23cd8633564b8648b17adbb556b20cc3aa32bb74e18872a679
Opcode Fuzzy Hash: 822a2237a2effd027047100084c2e4c9bbc4c41274be96093d0032bf5bfbc6bd
Instruction Fuzzy Hash: 8841BC71500358AFC710DF24DCC4BBA7BE8FB6A724F140628FA94CA2A1C7349909EB61

Function 00FAB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00FE67B0,00000000,011356B0,?,?,00FE67B0,?,00FAB862,?,?), ref: 00FAB9CC
EnableWindow.USER32(00000000,00000000), ref: 00FAB9F0
ShowWindow.USER32(00FE67B0,00000000,011356B0,?,?,00FE67B0,?,00FAB862,?,?), ref: 00FABA50
ShowWindow.USER32(00000000,00000004,?,00FAB862,?,?), ref: 00FABA62
EnableWindow.USER32(00000000,00000001), ref: 00FABA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00FABAA9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 769722182a8e160464e1b358ac2f685b7119b5c79c3a0ebe76915a025927d38e
Instruction ID: 007a1c7f9a630cb14e1e11ac4acf5aefc4815c470d213321099d9924aa0823a2
Opcode Fuzzy Hash: 769722182a8e160464e1b358ac2f685b7119b5c79c3a0ebe76915a025927d38e
Instruction Fuzzy Hash: C74165B5A00145AFDB21CF64C489B957BE0FF0B321F1841B9EE488F6A3C735A845EB51

Function 00F973B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00F95134,?,?,00000000,00000001), ref: 00F973BF

Part of subcall function 00F93C94: GetWindowRect.USER32(?,?), ref: 00F93CA7

GetDesktopWindow.USER32 ref: 00F973E9
GetWindowRect.USER32(00000000), ref: 00F973F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00F97422

Part of subcall function 00F854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F8555E

GetCursorPos.USER32(?), ref: 00F9744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00F974AC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 10f36ba2b4017f2aa9972750b3f40457adb8209a2007bae4669c6759f4b4ec8c
Instruction ID: 169ba367b9d74e5210d8c5372450557d2d725d5499c9068af44b53d9acd6a8bd
Opcode Fuzzy Hash: 10f36ba2b4017f2aa9972750b3f40457adb8209a2007bae4669c6759f4b4ec8c
Instruction Fuzzy Hash: 5131A372508319AFDB24EF54DC49F9BBBE9FB89314F000919F58997191D730E9089B92

Function 00F78D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F785F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F78608
Part of subcall function 00F785F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F78612
Part of subcall function 00F785F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F78621
Part of subcall function 00F785F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F78628
Part of subcall function 00F785F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F7863E

GetLengthSid.ADVAPI32(?,00000000,00F78977), ref: 00F78DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00F78DB8
HeapAlloc.KERNEL32(00000000), ref: 00F78DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00F78DD8
GetProcessHeap.KERNEL32(00000000,00000000,00F78977), ref: 00F78DEC
HeapFree.KERNEL32(00000000), ref: 00F78DF3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 0133fc60be006dc084fbe48a9bfec6717ddcfd8d27b9387612cfc6891688b54a
Instruction ID: a3193344af3a17521d276e9eda327846fb2746ad81a62cc218c03b4f325fad3a
Opcode Fuzzy Hash: 0133fc60be006dc084fbe48a9bfec6717ddcfd8d27b9387612cfc6891688b54a
Instruction Fuzzy Hash: E811B171A40609FFDB209FA4CC0DBAE7779EF553A5F10802AE84997251CB319905EB61

Function 00F78AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00F78B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00F78B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00F78B40
CloseHandle.KERNEL32(00000004), ref: 00F78B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00F78B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00F78B8E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5e92ef9a7aa6f2538549d200ed50054c6cf530aa03adc82d1b174d0df934c670
Instruction ID: cca3b345352e094536ef69a263331b1da558ce4c29a6e65671910fa80bb101f9
Opcode Fuzzy Hash: 5e92ef9a7aa6f2538549d200ed50054c6cf530aa03adc82d1b174d0df934c670
Instruction Fuzzy Hash: 55115CB294020DABDF018FA8ED49FDA7BA9EF49358F048065FE04A6160C7718D65AB61

Function 00FAC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F2134D
Part of subcall function 00F212F3: SelectObject.GDI32(?,00000000), ref: 00F2135C
Part of subcall function 00F212F3: BeginPath.GDI32(?), ref: 00F21373
Part of subcall function 00F212F3: SelectObject.GDI32(?,00000000), ref: 00F2139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00FAC1C4
LineTo.GDI32(00000000,00000003,?), ref: 00FAC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00FAC1E6
LineTo.GDI32(00000000,00000000,?), ref: 00FAC1F6
EndPath.GDI32(00000000), ref: 00FAC206
StrokePath.GDI32(00000000), ref: 00FAC216

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 13bca1b924b0fb0e1d60f38fb2d2d406a7c9a1581b6ea677771d2848169fb0f0
Instruction ID: f20a2cce921f6d70c950a9504fb60bcf9385f78a3714163994a6acd0369d161e
Opcode Fuzzy Hash: 13bca1b924b0fb0e1d60f38fb2d2d406a7c9a1581b6ea677771d2848169fb0f0
Instruction Fuzzy Hash: 43111EB640014CBFDF119F94DC88F9A7FADEF053A4F048021B9198A161C7719E59EBA0

Function 00F403A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00F403D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00F403DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00F403E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00F403F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00F403F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00F40401

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 996521e29cd677699d667c631696cb72d7e3cac99f57e89b717177d821fc993f
Instruction ID: 28ef2a0a41ba0148394e45b6955c62ba314cf17218137ec9a8af94a574f62da4
Opcode Fuzzy Hash: 996521e29cd677699d667c631696cb72d7e3cac99f57e89b717177d821fc993f
Instruction Fuzzy Hash: 97016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C4BA41C7F5A868CBE5

Function 00F8568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00F8569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00F856B1
GetWindowThreadProcessId.USER32(?,?), ref: 00F856C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F856CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F856D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00F856E0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 94e9b7f4633f5b8b6ef529872522a2308157e2e84d49d09f29cef41ca0d7d7ba
Instruction ID: afbdbd6a2b820aa71ad6c9dba8851730f8aee41b564a62cb756ab064a8a12535
Opcode Fuzzy Hash: 94e9b7f4633f5b8b6ef529872522a2308157e2e84d49d09f29cef41ca0d7d7ba
Instruction Fuzzy Hash: A8F06D7224111CBBE7205BE2DC0DEEB7A7CEBC7B11F000169FA00D515096A01A05A6B5

Function 00F874D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F874E5
EnterCriticalSection.KERNEL32(?,?,00F31044,?,?), ref: 00F874F6
TerminateThread.KERNEL32(00000000,000001F6,?,00F31044,?,?), ref: 00F87503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00F31044,?,?), ref: 00F87510

Part of subcall function 00F86ED7: CloseHandle.KERNEL32(00000000,?,00F8751D,?,00F31044,?,?), ref: 00F86EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F87523
LeaveCriticalSection.KERNEL32(?,?,00F31044,?,?), ref: 00F8752A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: da01b751f37bb04e5c15574ab9556e29442dd65b8003d8a72aefe519212ef921
Instruction ID: eab7333076e41c18ecf1d2a2925491bf3d3d3b7b6e72c158c747d687f3421603
Opcode Fuzzy Hash: da01b751f37bb04e5c15574ab9556e29442dd65b8003d8a72aefe519212ef921
Instruction Fuzzy Hash: 5BF05EBA540716EBDB612BA4FC8CBEB777AEF47312B140531F202990B0DB755805EB50

Function 00F78E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00F78E7F
UnloadUserProfile.USERENV(?,?), ref: 00F78E8B
CloseHandle.KERNEL32(?), ref: 00F78E94
CloseHandle.KERNEL32(?), ref: 00F78E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00F78EA5
HeapFree.KERNEL32(00000000), ref: 00F78EAC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 659e19df5a668a31bacc5a39fe346846e8a1ab5c2b68204ea6682954ca900e88
Instruction ID: 3a459874c8f4af6e345412489f6ba03243f9bbbd058d3ef11f056233ef82a429
Opcode Fuzzy Hash: 659e19df5a668a31bacc5a39fe346846e8a1ab5c2b68204ea6682954ca900e88
Instruction Fuzzy Hash: CFE052B6104509FFDB011FE5EC0C95ABB79FB8A762B508631F21989470CB329469EB50

Function 00F98902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F98928
CharUpperBuffW.USER32(?,?), ref: 00F98A37
VariantClear.OLEAUT32(?), ref: 00F98BAF

Part of subcall function 00F87804: VariantInit.OLEAUT32(00000000), ref: 00F87844
Part of subcall function 00F87804: VariantCopy.OLEAUT32(00000000,?), ref: 00F8784D
Part of subcall function 00F87804: VariantClear.OLEAUT32(00000000), ref: 00F87859

Strings

AUTOIT.ERROR, xrefs: 00F98A3D
Incorrect Parameter format, xrefs: 00F98960, 00F98B22

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 41aedaa49b58092dbe02544e09affca22af23054d2559bfc0735c22ae8b8baba
Instruction ID: 3a1c971c18ccf15664851e6bd1f6d508fbd3c98179617721b2873acd72e23abc
Opcode Fuzzy Hash: 41aedaa49b58092dbe02544e09affca22af23054d2559bfc0735c22ae8b8baba
Instruction Fuzzy Hash: 68919D716083019FCB10DF24C88195ABBE4EFCA754F04896EF89A8B361DB35E906DB52

Function 00F82F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3FEC6: _wcscpy.LIBCMT ref: 00F3FEE9

_memset.LIBCMT ref: 00F83077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F830A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00F83159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00F83187

Strings

0, xrefs: 00F83063

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: dbbf743dd8282f5480a58993c8e902fd933d6303bee0c430f43eb3860b77a39e
Instruction ID: 68fd601322298431c8c26cddb1c65498bab89ade0f034003e112a321a24353d4
Opcode Fuzzy Hash: dbbf743dd8282f5480a58993c8e902fd933d6303bee0c430f43eb3860b77a39e
Instruction Fuzzy Hash: 4251D131E083009AD725BF28DC49AABBBE4EF55F64F040A2DF885D71A1DB74CE44A752

Function 00F7DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F7DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00F7DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00F7DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00F7DB8E

Strings

DllGetClassObject, xrefs: 00F7DB01

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 31c1dcb50be7cf537d5584fd13b3f2c60f69e647a28d0cd137c8351e3559832a
Instruction ID: e1a7fddaf3a1d4265ffc8bb6e19b8aa8fa4c0c1a349821e97896483585a88875
Opcode Fuzzy Hash: 31c1dcb50be7cf537d5584fd13b3f2c60f69e647a28d0cd137c8351e3559832a
Instruction Fuzzy Hash: 2441C3B1600208DFDB15CF58C884B9A7BB9EF88320F55C0ABAD099F245D7B0DD44EBA1

Function 00F82C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F82CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00F82CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00F82D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00FE6890,00000000), ref: 00F82D5A

Strings

0, xrefs: 00F82CA4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 279647daec9e0b894273fb2f269a29551fa43ff09bc448a69d1205944ec1e3e6
Instruction ID: 4583d60258bbbd5d0bb334957fad7273f3dce3ed1a1eb2ebe7e121281b5cb498
Opcode Fuzzy Hash: 279647daec9e0b894273fb2f269a29551fa43ff09bc448a69d1205944ec1e3e6
Instruction Fuzzy Hash: 01419F726053019FD720EF24CC45B9ABBE8AF85320F144A1EF965972A1D774E904DBA2

Function 00F9DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F9DAD9

Part of subcall function 00F279AB: _memmove.LIBCMT ref: 00F279F9

Strings

cdecl, xrefs: 00F9DB30
winapi, xrefs: 00F9DB4A
stdcall, xrefs: 00F9DB5B
none, xrefs: 00F9DBB4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: ea45c81f54f4c5443c7d93eb109dfd8e7cdb9a5da1ec0162e95bb06d7ba5ccce
Instruction ID: 5f4f87110da6cb8efacfd0ae679cd6f904468e75bfc1ec87ee6538cefff6459b
Opcode Fuzzy Hash: ea45c81f54f4c5443c7d93eb109dfd8e7cdb9a5da1ec0162e95bb06d7ba5ccce
Instruction Fuzzy Hash: 9B31E57190421AEFDF00EF94CC819EEB7B4FF45720B10862AE865A77D1CB35A905EB80

Function 00F79372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00F793F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00F79409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00F79439

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Strings

ListBox, xrefs: 00F793B5
ComboBox, xrefs: 00F79380

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 6eba74369d61b8094963474776ebdbc1e8958b67777135a9f9c5ad9b35e13580
Instruction ID: 9ae458badb81bf7efdc0994ea69e42568151ea58d10301e4477829249cf77a03
Opcode Fuzzy Hash: 6eba74369d61b8094963474776ebdbc1e8958b67777135a9f9c5ad9b35e13580
Instruction Fuzzy Hash: 042104B1908108BBDB14ABB0DC869FFB779DF05320B14812AF929972E1DB78490AB651

Function 00F91B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F91B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00F91B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00F91B96
InternetCloseHandle.WININET(00000000), ref: 00F91BDD

Part of subcall function 00F92777: GetLastError.KERNEL32(?,?,00F91B0B,00000000,00000000,00000001), ref: 00F9278C
Part of subcall function 00F92777: SetEvent.KERNEL32(?,?,00F91B0B,00000000,00000000,00000001), ref: 00F927A1

Strings

, xrefs: 00F91B87

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: a1a3230f45aae17bc4862634dd0382734dfab6341182bcb284f6297f2b329031
Instruction ID: d533415eea965c493720d6189093c5e46c7101c255f58a9acd594659e950ded8
Opcode Fuzzy Hash: a1a3230f45aae17bc4862634dd0382734dfab6341182bcb284f6297f2b329031
Instruction Fuzzy Hash: 6C21CFB660020DBFFF119FA49CC5EBF76EDFB89754F10012AF405A6240EA349D08A7A1

Function 00FA6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F21D73
Part of subcall function 00F21D35: GetStockObject.GDI32(00000011), ref: 00F21D87
Part of subcall function 00F21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F21D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00FA66D0
LoadLibraryW.KERNEL32(?), ref: 00FA66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00FA66EC
DestroyWindow.USER32(?), ref: 00FA66F4

Strings

SysAnimate32, xrefs: 00FA66AB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 189d64dc56233a939dcaa1e9efafcf913c3737867076bab8cabc2d493f5685bf
Instruction ID: b6c45ec4ec019c6f3ffe77e8ee6cadd6592188e3aa404f68929382b71eb58bbf
Opcode Fuzzy Hash: 189d64dc56233a939dcaa1e9efafcf913c3737867076bab8cabc2d493f5685bf
Instruction Fuzzy Hash: 16219FB1510209ABEF104F64EC80EBB77ADEF5A378F184629F910DA290DB71DC51B760

Function 00F8703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00F8705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F87091
GetStdHandle.KERNEL32(0000000C), ref: 00F870A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00F870DD

Strings

nul, xrefs: 00F870D8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d7642818be0edcf368091837ac4ca1bec4ecd1b87036731150f9b5d64b61e6e0
Instruction ID: 1784cc9fc0e4fdf820776adbb06bf31d41393c23c60d67979ee705e74c42352f
Opcode Fuzzy Hash: d7642818be0edcf368091837ac4ca1bec4ecd1b87036731150f9b5d64b61e6e0
Instruction Fuzzy Hash: C1216B75A04309ABDF20BF68DC05BDA77E8AF95720F304A19F9A1D72D0E771D840AB60

Function 00F8710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F8712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00F8715D
GetStdHandle.KERNEL32(000000F6), ref: 00F8716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00F871A8

Strings

nul, xrefs: 00F871A3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b2d299bf5c5190eebe4405e705456896451d957be7fe288451e1d5b676599a4d
Instruction ID: d5b68bc35fbc185ca9b2deeb9eb804d96c2678e34e29be2720997c00dc40ad92
Opcode Fuzzy Hash: b2d299bf5c5190eebe4405e705456896451d957be7fe288451e1d5b676599a4d
Instruction Fuzzy Hash: C4216075A087099BDB20BF689C08BDAB7E8AF55734F300619F9A1D72D0D770D841EB51

Function 00F8AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00F8AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00F8AF13
__swprintf.LIBCMT ref: 00F8AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,00FAF910), ref: 00F8AF6A

Strings

%lu, xrefs: 00F8AF26

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 1fc425b9ddf7f91f95a8c515d9586f21bf2f07765352e1f131e5f68dcb6122f4
Instruction ID: 8d02fa6f9f633fc417baa0c25f73b3b7afb856001f218169d4e8dcd5fa337752
Opcode Fuzzy Hash: 1fc425b9ddf7f91f95a8c515d9586f21bf2f07765352e1f131e5f68dcb6122f4
Instruction Fuzzy Hash: F6218671A0010DAFDB10EF94DC85EEE7BB8EF89704B104069F909DB251DB75EA45EB21

Function 00F7A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

Part of subcall function 00F7A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00F7A399
Part of subcall function 00F7A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00F7A3AC
Part of subcall function 00F7A37C: GetCurrentThreadId.KERNEL32 ref: 00F7A3B3
Part of subcall function 00F7A37C: AttachThreadInput.USER32(00000000), ref: 00F7A3BA

GetFocus.USER32 ref: 00F7A554

Part of subcall function 00F7A3C5: GetParent.USER32(?), ref: 00F7A3D3

GetClassNameW.USER32(?,?,00000100), ref: 00F7A59D
EnumChildWindows.USER32(?,00F7A615), ref: 00F7A5C5
__swprintf.LIBCMT ref: 00F7A5DF

Strings

%s%d, xrefs: 00F7A5D9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: bf3e09c2b162ef944b508c6c84ee4ef2b16970098d8e333f3364840c5315e562
Instruction ID: 1095731ef05e1d2e78a5f2d5ecf362c12cebe710d2a688d02741e92069b8a7a2
Opcode Fuzzy Hash: bf3e09c2b162ef944b508c6c84ee4ef2b16970098d8e333f3364840c5315e562
Instruction Fuzzy Hash: 4F11B4716002087BDF117FA4EC85FEE37789F89710F048076BD0CAA192CA759945AB76

Function 00F82017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00F82048

Strings

REMOVE, xrefs: 00F8204E
KEYS, xrefs: 00F8205F
EXISTS, xrefs: 00F82070
APPEND, xrefs: 00F82081

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: ab2465320765ba2351c1e558709c2593d756b8fad19fc9ca63117d50c99bafb3
Instruction ID: b6508ac8c103779cd98de3cd32ce6c2050ca4378acf2f5640c03698cac796ef3
Opcode Fuzzy Hash: ab2465320765ba2351c1e558709c2593d756b8fad19fc9ca63117d50c99bafb3
Instruction Fuzzy Hash: 58115B30D0011A8FCF40EFA4D9518EEB7B5FF16304F108469D855A7352EB36690AEF50

Function 00F9EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00F9EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00F9EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00F9F07E
CloseHandle.KERNEL32(?), ref: 00F9F0FF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: d8d1f50654b5831f1233f977e3bd2ab6b54995307bd2eef064955ed141947d6c
Instruction ID: 9c0ab2fbc046a39297c7a43917c0c79d8ead44fe190eedf1a184fbe51ea92cec
Opcode Fuzzy Hash: d8d1f50654b5831f1233f977e3bd2ab6b54995307bd2eef064955ed141947d6c
Instruction Fuzzy Hash: 9281A471A047109FEB20EF24DC46F2AB7E5AF48720F04881DF599DB392DBB4AC459B91

Function 00FA02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00FA10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00FA0038,?,?), ref: 00FA10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00FA0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00FA03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00FA040E
RegCloseKey.ADVAPI32(?,?), ref: 00FA043A
RegCloseKey.ADVAPI32(00000000), ref: 00FA0447

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 35ebca4cc0785ae2d6742b71c158bd77afe5a79a3324162621db2a86c587795f
Instruction ID: 9eb7fc46a7cecf924bf014b7a0bb75bbae024ad82ae8bb1b14286672ae306dfc
Opcode Fuzzy Hash: 35ebca4cc0785ae2d6742b71c158bd77afe5a79a3324162621db2a86c587795f
Instruction Fuzzy Hash: 71516971608304AFDB00EF64EC81F6AB7E8FF89714F04892DB5958B291DB35E904EB52

Function 00F9DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F9DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00F9DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00F9DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00F9DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00F9DD35

Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F87B20,?,?,00000000), ref: 00F25B8C
Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F87B20,?,?,00000000,?,?), ref: 00F25BB0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: d886a86a04d95a810120e5888bae141cd2054ff4ecb6ffc738625380293857e7
Instruction ID: dfca5bae628a48200581d31903dbeb9531b70a4ca3bcc63d75c0910c61958c10
Opcode Fuzzy Hash: d886a86a04d95a810120e5888bae141cd2054ff4ecb6ffc738625380293857e7
Instruction Fuzzy Hash: 45515975A00219DFDB00EFA8D8849ADB7F4FF49320B14806AE815AB321DB74AD45EF91

Function 00F8E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00F8E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00F8E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00F8E8F2

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00F8E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00F8E91F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 12937c1eaa6d2cf01c86704cc9ea129722d0fffd59bf038716c68474eede966e
Instruction ID: 4c90c9b1614a849699111df96518a051865a9a6915657b375335127349fad6b9
Opcode Fuzzy Hash: 12937c1eaa6d2cf01c86704cc9ea129722d0fffd59bf038716c68474eede966e
Instruction Fuzzy Hash: 3B513935A00219DFDF00EF64C981AAEBBF5EF09310F1480A9E849AB361CB75ED41EB50

Function 00FAA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e8d2de30a268b32c710882a26e10111a153e5688c08ca76f4ac98aed0158d9b
Instruction ID: 1e4f76045fed53e58e339ed4df1fc748b2495d43cae71c1dd0731d7d04c05797
Opcode Fuzzy Hash: 9e8d2de30a268b32c710882a26e10111a153e5688c08ca76f4ac98aed0158d9b
Instruction Fuzzy Hash: 1541D4B5D00208AFDB20DF68CC44FB9BBA8EB0A320F140165F855E72E1D771AD49FA51

Function 00F22344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F22357
ScreenToClient.USER32(00FE67B0,?), ref: 00F22374
GetAsyncKeyState.USER32(00000001), ref: 00F22399
GetAsyncKeyState.USER32(00000002), ref: 00F223A7

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 60f81437e48698b632494bf41418b8ba278ad70f4fabf70aee8b6ba86a0b1e52
Instruction ID: 140c649873414f84ec49d014045f6e2464ad0e9174a49e773606cb7263e2e3d8
Opcode Fuzzy Hash: 60f81437e48698b632494bf41418b8ba278ad70f4fabf70aee8b6ba86a0b1e52
Instruction Fuzzy Hash: 7E417D71904229FFDF159FA8DC44AEDBBB4FB06320F20431AF92996290C7345D94EB91

Function 00F76920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F7695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00F769A9
TranslateMessage.USER32(?), ref: 00F769D2
DispatchMessageW.USER32(?), ref: 00F769DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F769EB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 50d9f0bbc722d645f6b1b74af90883a615b6d200202ed3d9458d461fb4631f54
Instruction ID: a7d742338254bfa489153e52c6e314771b509c6de77abb4a07b6572fab1c813e
Opcode Fuzzy Hash: 50d9f0bbc722d645f6b1b74af90883a615b6d200202ed3d9458d461fb4631f54
Instruction Fuzzy Hash: 0931F871D00A4EAEDB20CF74CC84FB67BBCAB16364F14816BE529C6161D7349849F752

Function 00F78F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F78F12
PostMessageW.USER32(?,00000201,00000001), ref: 00F78FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00F78FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00F78FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00F78FDA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3163225f899aaa3a7829e8befefa82c1f0bc60b35e5b68233ba2d9a05e963b2a
Instruction ID: e1418f0d19aa78933e9a9cce81fe894c79f7d310c0e8ba7e6e49ba98f14dd06f
Opcode Fuzzy Hash: 3163225f899aaa3a7829e8befefa82c1f0bc60b35e5b68233ba2d9a05e963b2a
Instruction Fuzzy Hash: 7931E471900219EFDB10CFA8DD4CADE7BB6EB05325F10822AF928DB1D0C7709915EB51

Function 00F7B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00F7B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00F7B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00F7B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00F7B742
_wcsstr.LIBCMT ref: 00F7B74C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: cdf6887e65308a266232dcc7b622200b3be38185ec779e263c81dabe38d76ca5
Instruction ID: b03cb3cf05d249b2051c5005a26a886263c70a8f09d60818a63ff6ad118317b9
Opcode Fuzzy Hash: cdf6887e65308a266232dcc7b622200b3be38185ec779e263c81dabe38d76ca5
Instruction Fuzzy Hash: 2E210A72604204BAEB155B799C49F7B7B98DF4A720F00807AFD09CA261EF65DC41B291

Function 00FAB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

GetWindowLongW.USER32(?,000000F0), ref: 00FAB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00FAB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00FAB489
GetSystemMetrics.USER32(00000004), ref: 00FAB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00F91184,00000000), ref: 00FAB4D0

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 05f7794eb2232ce06c54a2002e540862d9118ee17ad0e80d0cf3a5ec0dc81bc2
Instruction ID: 9007f1e86604240ace48aef0ce530cecc90adf3f1054d2ec117c8c0320bee0ca
Opcode Fuzzy Hash: 05f7794eb2232ce06c54a2002e540862d9118ee17ad0e80d0cf3a5ec0dc81bc2
Instruction Fuzzy Hash: E72162B1910269AFCB10DF78DC44B653BA4EB0A770F144725FD25D61E2E7309910FB50

Function 00F797E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00F79802

Part of subcall function 00F27D2C: _memmove.LIBCMT ref: 00F27D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F79834
__itow.LIBCMT ref: 00F7984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00F79874
__itow.LIBCMT ref: 00F79885

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: bb6f9f5a0bc6c531098d60e74600147e491db42fefdcc0361c3597a7785af979
Instruction ID: b47b2a8bd66b6ba80ec9fb6f2a131e7a471af09226484f1054e407bc868c695e
Opcode Fuzzy Hash: bb6f9f5a0bc6c531098d60e74600147e491db42fefdcc0361c3597a7785af979
Instruction Fuzzy Hash: 7E210071B053046BDB10AB619C86EEE3BA9DF4A720F484036FD04DB251D6B09D45B7D3

Function 00F212F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F2134D
SelectObject.GDI32(?,00000000), ref: 00F2135C
BeginPath.GDI32(?), ref: 00F21373
SelectObject.GDI32(?,00000000), ref: 00F2139C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d489267988a6cc6c05ed1e66dbe9d261bae5968501239b746082e1bb717b82e6
Instruction ID: c62221bca0f4e83913d36b611a208aca8037509ce96960880b799a93200495be
Opcode Fuzzy Hash: d489267988a6cc6c05ed1e66dbe9d261bae5968501239b746082e1bb717b82e6
Instruction Fuzzy Hash: 40215C71C0125CEBDB10CF65EC447697BB9FB213A2F148226E810DA1A0D7719E95FB94

Function 00F7C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00F7C176
_memcmp.LIBCMT ref: 00F7C194
_memcmp.LIBCMT ref: 00F7C1A7
_memcmp.LIBCMT ref: 00F7C1BF
_memcmp.LIBCMT ref: 00F7C1D7

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: aa3b8d69029f4cbbf2bfad6383cb709c076c51bffe3eb5f23592d75d9c09f669
Instruction ID: 7a268987318f0ac824d8d9aad7403b9e78683e08d323f8092ad1ba471260ca76
Opcode Fuzzy Hash: aa3b8d69029f4cbbf2bfad6383cb709c076c51bffe3eb5f23592d75d9c09f669
Instruction Fuzzy Hash: 3E01B9B2A041057BD204A6219C42FAB7B9CAB513B4F84813AFD0896283F794DE11B6E3

Function 00F84D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F84D5C
__beginthreadex.LIBCMT ref: 00F84D7A
MessageBoxW.USER32(?,?,?,?), ref: 00F84D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00F84DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00F84DAC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 1b4c9eb54bcb16d45b95745301bc8b8b86f2bc8de9cdefc9bb582973c8d1f6e5
Instruction ID: 7e7773d81b887edf89e62ac0f035abc5e7e151b30bc60d9918262f2daef05454
Opcode Fuzzy Hash: 1b4c9eb54bcb16d45b95745301bc8b8b86f2bc8de9cdefc9bb582973c8d1f6e5
Instruction Fuzzy Hash: A01104B390424DBBCB01AFA8DC48ADA7FACEB49320F144265FA14DB350D6759D04A7A0

Function 00F7874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00F78766
GetLastError.KERNEL32(?,00F7822A,?,?,?), ref: 00F78770
GetProcessHeap.KERNEL32(00000008,?,?,00F7822A,?,?,?), ref: 00F7877F
HeapAlloc.KERNEL32(00000000,?,00F7822A,?,?,?), ref: 00F78786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00F7879D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 8b4e3990f89a73a339dc6c737763b58cbe673c4b6eb6e67f3aa8b60a09dda2e9
Instruction ID: 829c9d676dcb34770c0e97967c30e9c3baf7ca5f84340cdb91362e03d73c6dfd
Opcode Fuzzy Hash: 8b4e3990f89a73a339dc6c737763b58cbe673c4b6eb6e67f3aa8b60a09dda2e9
Instruction Fuzzy Hash: 9A0162B1640208FFDB244FAADC4CD677B6CFF863A57204439F84AC6260DA318C05EA61

Function 00F854E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F85502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F85510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F85518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00F85522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F8555E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d82483d5f7bf5ef3facb1d2c31681ee99c94bb540c68b1a9dcd7f451bb505e39
Instruction ID: 5096266d5a97c9392b14a00bde3c28b78eb4d31feee607eda58b20690f110fb4
Opcode Fuzzy Hash: d82483d5f7bf5ef3facb1d2c31681ee99c94bb540c68b1a9dcd7f451bb505e39
Instruction Fuzzy Hash: BC016D76C00A1DDBCF00EFE8EC49AEDBB79FB09B15F440096E941BA140DB309654EBA1

Function 00F77652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?,?,00F7799D), ref: 00F7766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?), ref: 00F7768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?), ref: 00F77698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?), ref: 00F776A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00F7758C,80070057,?,?), ref: 00F776B4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 520a1965b1df729776388e2a7dee7350d80f229835d3edbd76a1e6193645c0ae
Instruction ID: 3b023243a4c7f9136bc3204a30039b93e4c770dce3a855443b7928d5acbe9763
Opcode Fuzzy Hash: 520a1965b1df729776388e2a7dee7350d80f229835d3edbd76a1e6193645c0ae
Instruction Fuzzy Hash: F501D4B6610708BBDB106F58DC04BAA7BADEB45761F244129FD08D6225E735DD00ABA0

Function 00F785F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00F78608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00F78612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00F78621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00F78628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00F7863E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 888de06b6de3beb5a78099284189a681d4a63a740281d7e0d33d0714531bb119
Instruction ID: e7a23e29da16b63b04afbf3082bcf0b0fd5b5a3c5b69effa028faeedcc247816
Opcode Fuzzy Hash: 888de06b6de3beb5a78099284189a681d4a63a740281d7e0d33d0714531bb119
Instruction Fuzzy Hash: F7F04471241208BFDB100FE5DC8DE6B3BACEF467A5B004426F54DC7150CB619D45EA61

Function 00F78652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F78669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F78673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F78682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F78689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F7869F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 51b754d05d1aca093e0de4318965bd144396a8c2d5b5ddcbd408bfc2a6265ffe
Instruction ID: fb97751c223d28791447b2765992105a98091d1702f465df97aafa591c23b07d
Opcode Fuzzy Hash: 51b754d05d1aca093e0de4318965bd144396a8c2d5b5ddcbd408bfc2a6265ffe
Instruction Fuzzy Hash: 78F068B1240308BFDB111FA5DC8CE673BACEF467A5B104026F549C6150DB71DD45EA61

Function 00F7C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00F7C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00F7C6D1
MessageBeep.USER32(00000000), ref: 00F7C6E9
KillTimer.USER32(?,0000040A), ref: 00F7C705
EndDialog.USER32(?,00000001), ref: 00F7C71F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 460f05b988c635a38fbfc4916c909e558125a519a6dec80ad767d4c39dfc2999
Instruction ID: 7c417684ca61dff618b1adb1d09441e47a8100bf58a50f7383297aec7c6e297b
Opcode Fuzzy Hash: 460f05b988c635a38fbfc4916c909e558125a519a6dec80ad767d4c39dfc2999
Instruction Fuzzy Hash: 2D01D670800708ABEB245F60DC8EF9677B8FF01701F00466EF58AA51E1DBF0A959AF81

Function 00F213B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F213BF
StrokeAndFillPath.GDI32(?,?,00F5BAD8,00000000,?), ref: 00F213DB
SelectObject.GDI32(?,00000000), ref: 00F213EE
DeleteObject.GDI32 ref: 00F21401
StrokePath.GDI32(?), ref: 00F2141C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: c88baf46a4b922e5f8c54f7f0858f5374212ff1f13805a91b54024596ed8c620
Instruction ID: ab9575170ae8ae7435908c3793363b974ba95525d3d8acf8321269f94241ca1a
Opcode Fuzzy Hash: c88baf46a4b922e5f8c54f7f0858f5374212ff1f13805a91b54024596ed8c620
Instruction Fuzzy Hash: 63F0B67000424CABDB159F66EC887593BA5BF22366F04C224E4698D0B1C7314A99FF54

Function 00F8C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F8C69D
CoCreateInstance.OLE32(00FB2D6C,00000000,00000001,00FB2BDC,?), ref: 00F8C6B5

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

CoUninitialize.OLE32 ref: 00F8C922

Strings

.lnk, xrefs: 00F8C631, 00F8C659, 00F8C663

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 15b33aa3cf72889f3fdbc8fc3b68b08d49b595cdf14b20b57eefa35e7ade72a1
Instruction ID: ba348d896b04206a195f6ba61540995cf209633a34bdfcbfeced94b4d53caaf4
Opcode Fuzzy Hash: 15b33aa3cf72889f3fdbc8fc3b68b08d49b595cdf14b20b57eefa35e7ade72a1
Instruction Fuzzy Hash: A9A13C71108315AFD700EF64DC91EABB7E8EF84704F00495DF19697192DB74EA09DB92

Function 00F32E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00F40FF6: std::exception::exception.LIBCMT ref: 00F4102C
Part of subcall function 00F40FF6: __CxxThrowException@8.LIBCMT ref: 00F41041

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F27BB1: _memmove.LIBCMT ref: 00F27C0B

__swprintf.LIBCMT ref: 00F3302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00F32EC6

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 45f776cf5cca605c5839a8bc498ee8e9c63914bf35da0c63f5e1c120a78e7fe1
Instruction ID: f64512f48f4ddce65d0bde147ce1da58ccec78b3dd509e550c2e045ffe3b6bcf
Opcode Fuzzy Hash: 45f776cf5cca605c5839a8bc498ee8e9c63914bf35da0c63f5e1c120a78e7fe1
Instruction Fuzzy Hash: 1A916C715083119FC718EF24EC85C6EB7A4EF85764F00491DF8429B2A1EB74EE44EB52

Function 00F8BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F248A1,?,?,00F237C0,?), ref: 00F248CE

CoInitialize.OLE32(00000000), ref: 00F8BC26
CoCreateInstance.OLE32(00FB2D6C,00000000,00000001,00FB2BDC,?), ref: 00F8BC3F
CoUninitialize.OLE32 ref: 00F8BC5C

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

Strings

.lnk, xrefs: 00F8BC08, 00F8BC16

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 7538ef8431a26aba3762b96a782d2df11a1594d9dcfeaa862964e37178d2592c
Instruction ID: a814b8c2a297a6df50344797ff75d5af99a57268e01fc861c9d0a6ab96775d3b
Opcode Fuzzy Hash: 7538ef8431a26aba3762b96a782d2df11a1594d9dcfeaa862964e37178d2592c
Instruction Fuzzy Hash: 00A168756043119FCB10EF14C884DAABBE5FF89324F148988F8999B3A1CB35ED45DB91

Function 00F4524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F452DD

Part of subcall function 00F50340: __87except.LIBCMT ref: 00F5037B

Strings

pow, xrefs: 00F452B5, 00F452D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: f90b7f5cafedf0c4ec2852ef41aa16007dd3bc7c57cde1af824674601dc70076
Instruction ID: f8acc6dc29b59c7430baf0c69ea5b9cd12ae43370a351e02d6fb876bf9258494
Opcode Fuzzy Hash: f90b7f5cafedf0c4ec2852ef41aa16007dd3bc7c57cde1af824674601dc70076
Instruction Fuzzy Hash: B1517C62E0D60597CB11BB24CD4137E3F909B40B61F208D59EE85862E7EF788DCCBA41

Function 00F4023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00F40280
+, xrefs: 00F40277

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 7bc586c7d3a313e39e9796059eb20682c4de66190aca05cf59f80d5761938491
Instruction ID: 273fdaf49fa21113fee5967bc329b00da503a0b354103b9c97c43178711241b5
Opcode Fuzzy Hash: 7bc586c7d3a313e39e9796059eb20682c4de66190aca05cf59f80d5761938491
Instruction Fuzzy Hash: 15517875808245CFCF21DF28C888AF97FA4EF5A720F148056FC959B2A0CB749D42E722

Function 00F362F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F363A8
_memmove.LIBCMT ref: 00F36446
_memset.LIBCMT ref: 00F3646A

Strings

ERCP, xrefs: 00F36313

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 5b7b4ded2460f41137abfd9fd8a9fe588bbc94118adefabd5d8292d71682e394
Instruction ID: 27a9ca7d7ceb00b94737b97001062eeb628175619ac1a3fce29ff605798fa06d
Opcode Fuzzy Hash: 5b7b4ded2460f41137abfd9fd8a9fe588bbc94118adefabd5d8292d71682e394
Instruction Fuzzy Hash: 8151B071D00309EBCB24CF65C881BAABBF9FF04724F20856EEA4ACB241E7759584DB51

Function 00FA7BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00FAF910,00000000,?,?,?,?), ref: 00FA7C4E
GetWindowLongW.USER32 ref: 00FA7C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00FA7C7B

Strings

SysTreeView32, xrefs: 00FA7C20

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: fe3e5ac8e2d588d884cd62d171e4da94f118d4c5599c450858a07f1b163f9ae2
Instruction ID: e67ea510444c55f21958c013bfc0a1dae911c2212ff4d8c9dbc0d4d6aedf55d3
Opcode Fuzzy Hash: fe3e5ac8e2d588d884cd62d171e4da94f118d4c5599c450858a07f1b163f9ae2
Instruction Fuzzy Hash: CB31E0B1604209AADB119F34DC41FEA77A9EF4A334F204325F875922E0C734EC51AB60

Function 00FA7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00FA76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00FA76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00FA7708

Strings

SysMonthCal32, xrefs: 00FA769B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 510a2c320c30699a18c27d9750985f2908e586081ec05a78de23896ca700bf09
Instruction ID: e8f1cef56b16768fb830461f6e1c66a59f06f1253860263ded1c7078186a9d19
Opcode Fuzzy Hash: 510a2c320c30699a18c27d9750985f2908e586081ec05a78de23896ca700bf09
Instruction Fuzzy Hash: AB21E272600218BBDF11DFA4CC46FEA3B79EF49724F110214FE156B2D0DAB5A850ABA0

Function 00FA6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00FA6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00FA6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00FA6FDF

Strings

Listbox, xrefs: 00FA6F77

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9327ea4359ccf7d11d602a4344151d39f6edfaa4746cbdb4fe416a91be5f3cf8
Instruction ID: 1407d0c7a59ec1ef5e95704ac13ff3ec6dd18d330a39dc1ed3164fcfbb20143c
Opcode Fuzzy Hash: 9327ea4359ccf7d11d602a4344151d39f6edfaa4746cbdb4fe416a91be5f3cf8
Instruction Fuzzy Hash: 7321D772A10118BFDF118F54DC85FBB37AAEF8A764F058124F914DB190D671AC51EBA0

Function 00FA797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00FA79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00FA79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00FA7A03

Strings

msctls_trackbar32, xrefs: 00FA79B8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 93e3c26fd872f0fa4098c38651bb351e009420eaf947bf8485b14f170150ee47
Instruction ID: 419308c607c24c07cb780855948f7da51b786dd01b9f23b3093c726cce8abb28
Opcode Fuzzy Hash: 93e3c26fd872f0fa4098c38651bb351e009420eaf947bf8485b14f170150ee47
Instruction Fuzzy Hash: 24110A72654308BBDF10AF74CC05FDB77ADEF8A764F020519F641A60A1D675E811EB60

Function 00F24C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F24C2E), ref: 00F24CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F24CB5

Strings

kernel32.dll, xrefs: 00F24C9E
GetNativeSystemInfo, xrefs: 00F24CAF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6b46dc9997c96479b77d2b7f429eb5a79c0663bd5c5497dd076d8dcfabe631a3
Instruction ID: 7e8cc4d0650bf80bda3f5620b3b38c584cecdc8022da2d0f96611ebdf7eae56e
Opcode Fuzzy Hash: 6b46dc9997c96479b77d2b7f429eb5a79c0663bd5c5497dd076d8dcfabe631a3
Instruction Fuzzy Hash: 36D02BF0910337CFC7205FB4DD18602B2E4AF02790B10C83ED8C2CA550D7B0D484E620

Function 00F24D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F24CE1,?), ref: 00F24DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F24DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00F24DAE
kernel32.dll, xrefs: 00F24D9D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 4785f17da91de11549993dbb8d3a91c3f9ccc26a207c93b073e6cf0754ae5a23
Instruction ID: 60349e40ad26ca51d0ffdf95659174dec1af67e3d7a2538baa36cb5723ef278b
Opcode Fuzzy Hash: 4785f17da91de11549993dbb8d3a91c3f9ccc26a207c93b073e6cf0754ae5a23
Instruction Fuzzy Hash: 5BD02B70910323CFC7305F70D80874676E4AF06354B00C83ED8C1CA550E7B0D480E610

Function 00F24D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F24D2E,?,00F24F4F,?,00FE62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F24D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F24D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F24D7B
kernel32.dll, xrefs: 00F24D6A

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 9950ec31d58dc7f4f6afd095fa287918feb8ce1470d9e7389778a4b7f4cae1f2
Instruction ID: aba63a662ce91a362618015f3ef4eee3f039fbf1fee70f08db9447e057b9ff36
Opcode Fuzzy Hash: 9950ec31d58dc7f4f6afd095fa287918feb8ce1470d9e7389778a4b7f4cae1f2
Instruction Fuzzy Hash: 61D01270910723CFD7205F71D84865676E8AF16365B55C83AD486DA350E7B0E484EA51

Function 00FA1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00FA12C1), ref: 00FA1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00FA1092

Strings

advapi32.dll, xrefs: 00FA107B
RegDeleteKeyExW, xrefs: 00FA108C

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 0a86d6c7209a176691bb2d758e13c4dc8659ecaea82a1bff95aae6fa0ea186aa
Instruction ID: 8b5fded805dd31b18d942e9e0660bdd8cac9f387cb96e7c1381610c05d6b8845
Opcode Fuzzy Hash: 0a86d6c7209a176691bb2d758e13c4dc8659ecaea82a1bff95aae6fa0ea186aa
Instruction Fuzzy Hash: 5CD017B5910712CFD720AFB5D958A1A76E5AF06362F16CC3EE4CADA250E770C8C0EB51

Function 00F993F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00F99009,?,00FAF910), ref: 00F99403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00F99415

Strings

kernel32.dll, xrefs: 00F993FE
GetModuleHandleExW, xrefs: 00F9940F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: cd62a74360c6b54ba7fb2737a98f515287c08f86df6c1985cdaf4d1dac057195
Instruction ID: 90e2d416d380f054f6e026b1b7db70db49d5c94945103c2cb9c4b1d1dd7cd846
Opcode Fuzzy Hash: cd62a74360c6b54ba7fb2737a98f515287c08f86df6c1985cdaf4d1dac057195
Instruction Fuzzy Hash: 9AD02B74914317CFDB309F78C90810372E5AF22361B01C83ED4C1CA550D7B0C484E711

Function 00F61B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00F61B42
__swprintf.LIBCMT ref: 00F61B73

Strings

%.3d, xrefs: 00F61B4D
WIN_XPe, xrefs: 00F61BB2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: c3f2e062c32df5372b324d8a937bb33f49d3d68efe8136ff6b58430f1411c9ba
Instruction ID: 17f97e0bb9b16a8f8cff4b76dfdb771d1200dad921f10a0ed4e304252ab0855e
Opcode Fuzzy Hash: c3f2e062c32df5372b324d8a937bb33f49d3d68efe8136ff6b58430f1411c9ba
Instruction Fuzzy Hash: 8FD012B3C0411CEACB149BA09C44AF9777CB749301F1805D2B90291000F2349B84FB65

Function 00F776C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a2e53310905a1db7fc60f55070bd2f2cf4e16dde5e4426d3587a42eb2f9107
Instruction ID: 6dee78faf9a4f5b4cf26b5564da90f01103d850ef8ad810bbf2da0c3c3f50481
Opcode Fuzzy Hash: a6a2e53310905a1db7fc60f55070bd2f2cf4e16dde5e4426d3587a42eb2f9107
Instruction Fuzzy Hash: 99C19E75E14216EFDB14DF94C884EAEB7B5FF48310B21859AE809EB250D730ED41EB91

Function 00F9E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00F9E3D2
CharLowerBuffW.USER32(?,?), ref: 00F9E415

Part of subcall function 00F9DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00F9DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00F9E615
_memmove.LIBCMT ref: 00F9E628

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 5092e5f923251542c6a5d072bcd064256802c9482fe16acbf77104681a919434
Instruction ID: fd582390d4d18ebebe2c951c72fec6246d9d2e88e6416c7dfef88eb05f645638
Opcode Fuzzy Hash: 5092e5f923251542c6a5d072bcd064256802c9482fe16acbf77104681a919434
Instruction Fuzzy Hash: 52C16A71A083118FDB14DF28C880A5ABBE4FF88724F14896DF8999B351D735E945DF82

Function 00F983A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00F983D8
CoUninitialize.OLE32 ref: 00F983E3

Part of subcall function 00F7DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00F7DAC5

VariantInit.OLEAUT32(?), ref: 00F983EE
VariantClear.OLEAUT32(?), ref: 00F986BF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 7e5fa06d04f483b21e92d603cc8d7a1a723a327fd4eeec81c992b29cbf480f34
Instruction ID: 7339c387ac1ee95f4b34f7603a73e672c98e7a6ff09232e9c3b386f7673b90b3
Opcode Fuzzy Hash: 7e5fa06d04f483b21e92d603cc8d7a1a723a327fd4eeec81c992b29cbf480f34
Instruction Fuzzy Hash: 0BA17C756087119FEB10DF24C881B1AB7E4BF89364F04484DF99A9B3A2CB74EC45EB42

Function 00F77A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00FB2C7C,?), ref: 00F77C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00FB2C7C,?), ref: 00F77C4A
CLSIDFromProgID.OLE32(?,?,00000000,00FAFB80,000000FF,?,00000000,00000800,00000000,?,00FB2C7C,?), ref: 00F77C6F
_memcmp.LIBCMT ref: 00F77C90

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 53b8323adf136309a74cdebeb850136378934b24f2298fbadac2f7715a20abd2
Instruction ID: caeb79e057d6a29bf9d9e0c718b28e2605198be460035483f39c6df24d2e829d
Opcode Fuzzy Hash: 53b8323adf136309a74cdebeb850136378934b24f2298fbadac2f7715a20abd2
Instruction Fuzzy Hash: CB814C71A10209EFCB04DF94C884EEEB7B9FF89315F208199E505AB254DB71AE05DB61

Function 00F76DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F76E04
SysAllocString.OLEAUT32(00000000), ref: 00F76EAD
VariantCopy.OLEAUT32 ref: 00F76EDC
VariantClear.OLEAUT32(?), ref: 00F76F03

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: af1604490ff7e6fbfc72c69e562d5078c8f8953c07174262b88a0808759a3de5
Instruction ID: 804383954cce69ce992c9cdaccf1806335f560d79e2afddab180f4efbadb43f4
Opcode Fuzzy Hash: af1604490ff7e6fbfc72c69e562d5078c8f8953c07174262b88a0808759a3de5
Instruction Fuzzy Hash: CC51CB316187019ADB20BF75E891B6DB3E5AF48320F20C81FE55ECB291EB749844FB12

Function 00FA9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0113DC58,?), ref: 00FA9AD2
ScreenToClient.USER32(00000002,00000002), ref: 00FA9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00FA9B72

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 57c24fea84e2d56db6e9706438f5f28b6fea17d16967473e86d8e665feb2e3c6
Instruction ID: 7e2ef088f1c1e52c51e17b6a91eaa659d1a4711e9b0ae0107483ac5a68d04b6a
Opcode Fuzzy Hash: 57c24fea84e2d56db6e9706438f5f28b6fea17d16967473e86d8e665feb2e3c6
Instruction Fuzzy Hash: B6516374A04209EFCF14DF58D8809AE7BB6FF96360F148169F815DB290D770AE41EBA0

Function 00F96CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00F96CE4
WSAGetLastError.WSOCK32(00000000), ref: 00F96CF4

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00F96D58
WSAGetLastError.WSOCK32(00000000), ref: 00F96D64

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: e00b948dcb1c4c1e6f855d9cda8338c41f79e297acf2c824b19bf869292b38ec
Instruction ID: 6d5fcf73d60a64f78d2bb0e4c72893e32b9e23dc5675dbe19311a5e54b57b8d8
Opcode Fuzzy Hash: e00b948dcb1c4c1e6f855d9cda8338c41f79e297acf2c824b19bf869292b38ec
Instruction Fuzzy Hash: 4241D774B40210AFFB20AF64DC87F3A77E59B08B10F448019FA59DF2C2DAB99D01AB51

Function 00F9672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00FAF910), ref: 00F967BA
_strlen.LIBCMT ref: 00F967EC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: a35e33fe4e599b901c234125f0f5be6e6fe72d9733d7f2095897778bbd83a7f5
Instruction ID: 1c37ea0c36b3b1d5c0298275ccfd919b120117cd4c500c8ffd03eed1a5959413
Opcode Fuzzy Hash: a35e33fe4e599b901c234125f0f5be6e6fe72d9733d7f2095897778bbd83a7f5
Instruction Fuzzy Hash: 3041D331E00114ABDF14EBA4DCC5FAEB7A9AF48710F148165F819DB292DF38AD04EB51

Function 00F8BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00F8BB09
GetLastError.KERNEL32(?,00000000), ref: 00F8BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00F8BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00F8BB80

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: a8c7d0e9872db00f55edd1d94ee6de908052a0405bc8c5689f2c19ca5124fa85
Instruction ID: 51925fe22f1b13a080dde84b43eafe7554108678dbf6a38d6e40e2aee5fd30be
Opcode Fuzzy Hash: a8c7d0e9872db00f55edd1d94ee6de908052a0405bc8c5689f2c19ca5124fa85
Instruction Fuzzy Hash: E3413C35600621DFDB10EF14D985A5DBBE1EF89320F098488EC4A9B362CB79FD41EB91

Function 00FA8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00FA8B4D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 4358ec799159a914abeec3ea0bf65e82738c845d0323b27a47bdafb881a73aae
Instruction ID: 4c4e645bb7b659775f02d4cbebf25bb3a14fa19f0e1fe4b4e5905a9c2339511e
Opcode Fuzzy Hash: 4358ec799159a914abeec3ea0bf65e82738c845d0323b27a47bdafb881a73aae
Instruction Fuzzy Hash: B531D6F4A00218BFEF249E58CC85FA93764FB473E0F144512FA51D62E1DFB4A942B661

Function 00FAADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00FAAE1A
GetWindowRect.USER32(?,?), ref: 00FAAE90
PtInRect.USER32(?,?,00FAC304), ref: 00FAAEA0
MessageBeep.USER32(00000000), ref: 00FAAF11

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: ff9b0840eaf8e0ae2b6b9bdbefae589f94bf64c128d861a2d192dfa38c4cd9d7
Instruction ID: 7451a309f859041f3884a31f488c206f4c79d275dd8b9647e7cc127518b52d76
Opcode Fuzzy Hash: ff9b0840eaf8e0ae2b6b9bdbefae589f94bf64c128d861a2d192dfa38c4cd9d7
Instruction Fuzzy Hash: 8D418DB0A00219DFCB12CF59C8C4B69BBF5FF4A350F1881A9E815CF251D731A909EB92

Function 00F80FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00F81037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00F81053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00F810B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00F8110B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: b5dccc8fe248206e0ccf583ed53f5fba49504e3dbefef8ed1363653549dd3656
Instruction ID: 6a76f4d488e55aec42c3194d7d2818332026a68de3284fbcc10d4b7d4e4f78dc
Opcode Fuzzy Hash: b5dccc8fe248206e0ccf583ed53f5fba49504e3dbefef8ed1363653549dd3656
Instruction Fuzzy Hash: 2D316871E4068CAEFB30AB658C09BFABBADBF45330F08431AE585561D1C37589C6B761

Function 00F81121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00F81176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00F81192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00F811F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00F81243

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 73db30d4206c98d72443f7561eab55f157a5af2fa449382a6b8263240097ade6
Instruction ID: b171cfc2459f31ba2bdfb78636bae0d6d6af1e8cc7a897f345f3b9954b3d85de
Opcode Fuzzy Hash: 73db30d4206c98d72443f7561eab55f157a5af2fa449382a6b8263240097ade6
Instruction Fuzzy Hash: 1F312870D40A1C5EFF30AAA58C087FA7BAEBB49330F08431AE585921D1C3394956F751

Function 00F56415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F5644B
__isleadbyte_l.LIBCMT ref: 00F56479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F564A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00F564DD

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a9cc178725554355b814234e67a037e966840ab7e17cf8b725e25ce55fcec2e5
Instruction ID: 53b16da04c25c599c0f8e2857723a0f6f21674b127b59df7681cd8b07d2fc801
Opcode Fuzzy Hash: a9cc178725554355b814234e67a037e966840ab7e17cf8b725e25ce55fcec2e5
Instruction Fuzzy Hash: 7A31D231A00246AFDB21CF74CC44BAA7BA5FF41322F554129FD64C71A1E731D898EB90

Function 00FA5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00FA5189

Part of subcall function 00F8387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00F83897
Part of subcall function 00F8387D: GetCurrentThreadId.KERNEL32 ref: 00F8389E
Part of subcall function 00F8387D: AttachThreadInput.USER32(00000000,?,00F852A7), ref: 00F838A5

GetCaretPos.USER32(?), ref: 00FA519A
ClientToScreen.USER32(00000000,?), ref: 00FA51D5
GetForegroundWindow.USER32 ref: 00FA51DB

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 5b6ec6bd0e8cb1e8c4f09e346e3a0245ae3958a4a2eedd36916a3c4e2d0de8e6
Instruction ID: 9d1674d3345363b4022744a05b73d8a0e526017924d05c6e393571152ff3c045
Opcode Fuzzy Hash: 5b6ec6bd0e8cb1e8c4f09e346e3a0245ae3958a4a2eedd36916a3c4e2d0de8e6
Instruction Fuzzy Hash: 6031FC72D00118AFDB00EFA5DC459EFB7F9EF99300F10406AE415E7251DA799A05DBA0

Function 00FAC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

GetCursorPos.USER32(?), ref: 00FAC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00F5BBFB,?,?,?,?,?), ref: 00FAC7D7
GetCursorPos.USER32(?), ref: 00FAC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00F5BBFB,?,?,?), ref: 00FAC85E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8855658ee73daf653b5db5a923612ea3f2ab4a78b711193c74a3afc00f7cf35e
Instruction ID: be74e7a2bb6f5d57011bf6cb16ecc8757b937653a24a6364684ab658bc99345e
Opcode Fuzzy Hash: 8855658ee73daf653b5db5a923612ea3f2ab4a78b711193c74a3afc00f7cf35e
Instruction Fuzzy Hash: A5317179A00018AFCB15CF98C898EEA7BB6FF4A720F444169F9058B261D7359D50FFA0

Function 00F40BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00F40BF2

Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F87B20,?,?,00000000), ref: 00F25B8C
Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F87B20,?,?,00000000,?,?), ref: 00F25BB0

_fprintf.LIBCMT ref: 00F40C29
OutputDebugStringW.KERNEL32(?), ref: 00F76331

Part of subcall function 00F44CDA: _flsall.LIBCMT ref: 00F44CF3

__setmode.LIBCMT ref: 00F40C5E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b64f95f54760c1e2fde90d443431379fb214d024b0488d4fcc0298e1c0b4feb4
Instruction ID: 380f147565f54f0b984bae341fc1fa34cfce80c290b7d6a436e095ebe591c1de
Opcode Fuzzy Hash: b64f95f54760c1e2fde90d443431379fb214d024b0488d4fcc0298e1c0b4feb4
Instruction Fuzzy Hash: 3B113632A04218BADB04B7B4AC83ABE7F699F41320F14411AF604A7192DE796D86B791

Function 00F78B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F78652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00F78669
Part of subcall function 00F78652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00F78673
Part of subcall function 00F78652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F78682
Part of subcall function 00F78652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00F78689
Part of subcall function 00F78652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00F7869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00F78BEB
_memcmp.LIBCMT ref: 00F78C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F78C44
HeapFree.KERNEL32(00000000), ref: 00F78C4B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4348aee2ff05f589ceafee1e19d7665d6abac7531b31957449bbd1a855dafa8a
Instruction ID: 51c579ddbcc104c0673f8a57ce6839faab35fcd4c0fa5e7ef9816d5fc9d919f5
Opcode Fuzzy Hash: 4348aee2ff05f589ceafee1e19d7665d6abac7531b31957449bbd1a855dafa8a
Instruction Fuzzy Hash: 5D21B571D41108EFCB10CF94C949BEEB7B4FF40390F15805AE458A7240DB30AE06EB62

Function 00F91A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00F91A97

Part of subcall function 00F91B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00F91B40
Part of subcall function 00F91B21: InternetCloseHandle.WININET(00000000), ref: 00F91BDD

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 81a90a63797da56b0a4aca514d55d8f46a3114f232f53a666ebca6a40415eb6f
Instruction ID: 0f65aa5f4936de3e87b62c49942c544e8e0b1dc8d276102abb6cef9d932ce298
Opcode Fuzzy Hash: 81a90a63797da56b0a4aca514d55d8f46a3114f232f53a666ebca6a40415eb6f
Instruction Fuzzy Hash: 51219276600606BFFF229FA0CC01FBAB7AEFF85711F10402AF91196550E7759815BB90

Function 00F7E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00F7E1C4,?,?,?,00F7EFB7,00000000,000000EF,00000119,?,?), ref: 00F7F5BC
Part of subcall function 00F7F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00F7F5E2
Part of subcall function 00F7F5AD: lstrcmpiW.KERNEL32(00000000,?,00F7E1C4,?,?,?,00F7EFB7,00000000,000000EF,00000119,?,?), ref: 00F7F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00F7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00F7E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00F7E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00F7EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00F7E237

Strings

cdecl, xrefs: 00F7E22E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: a851a494abeb0ccd997be3648c3966ca6eab9089a535178aef106091141e54a3
Instruction ID: 55624de6282ed341e5d80bca138a0f8dad36ce05548434e23a539eeeffe9aa20
Opcode Fuzzy Hash: a851a494abeb0ccd997be3648c3966ca6eab9089a535178aef106091141e54a3
Instruction Fuzzy Hash: 1611B136600305EFCB25AF64DC45D7A77A9FF49320B44806BE80ACB250EB719855E792

Function 00F55332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F55351

Part of subcall function 00F4594C: __FF_MSGBANNER.LIBCMT ref: 00F45963
Part of subcall function 00F4594C: __NMSG_WRITE.LIBCMT ref: 00F4596A
Part of subcall function 00F4594C: RtlAllocateHeap.NTDLL(01120000,00000000,00000001,00000000,?,?,?,00F41013,?), ref: 00F4598F

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 02183ed242e814f093d495571a373c158e39a0c80edd9226449c5f3cca1074c1
Instruction ID: 2338087ff953e7620065147ad94b6621a9be31728de522a3ec0c22575d26132c
Opcode Fuzzy Hash: 02183ed242e814f093d495571a373c158e39a0c80edd9226449c5f3cca1074c1
Instruction Fuzzy Hash: 16112732D05A05AFCB303FB0EC5561D3FA65F01BF2B100439FE089A191DE798945B350

Function 00F24531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F24560

Part of subcall function 00F2410D: _memset.LIBCMT ref: 00F2418D
Part of subcall function 00F2410D: _wcscpy.LIBCMT ref: 00F241E1
Part of subcall function 00F2410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F241F1

KillTimer.USER32(?,00000001,?,?), ref: 00F245B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F245C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F5D6CE

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 8010f6b3acc9435f9966ac3747d290eeed08fa20ff916e356812fa50fa5eec7f
Instruction ID: 9ac015b62821303bf86a0103577da0c2efe80dc3d940233b10e48db587dd7e4b
Opcode Fuzzy Hash: 8010f6b3acc9435f9966ac3747d290eeed08fa20ff916e356812fa50fa5eec7f
Instruction Fuzzy Hash: 0F210A719053989FEB328B24DC55BE7BFEC9F01315F04009DE7DE56141C7B42A89AB51

Function 00F9667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00F87B20,?,?,00000000), ref: 00F25B8C
Part of subcall function 00F25B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00F87B20,?,?,00000000,?,?), ref: 00F25BB0

gethostbyname.WSOCK32(?,?,?), ref: 00F966AC
WSAGetLastError.WSOCK32(00000000), ref: 00F966B7
_memmove.LIBCMT ref: 00F966E4
inet_ntoa.WSOCK32(?), ref: 00F966EF

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 5553219146844afadbad5da6cbab1e345c27702f10eccf7c4f369e4fd910669f
Instruction ID: 9c35668dfb3a0d0b25f6146f3fc8c334fc6f0d0dc565b841fba7321880302c39
Opcode Fuzzy Hash: 5553219146844afadbad5da6cbab1e345c27702f10eccf7c4f369e4fd910669f
Instruction Fuzzy Hash: EE116076900508AFCF00EBA4ED86DEEB7B8AF45710B144065F506AB1A1DF38AE04EB61

Function 00F79023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00F79043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F79055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F7906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00F79086

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f92b88ef397250a14e0de973af31e0b75ab628d08162cf6d167c9361c9bc5ded
Instruction ID: 05391d8c15dc7361767f6d69dfe6f8c09b3a51ff4857eee8efdaf8d4ad04e830
Opcode Fuzzy Hash: f92b88ef397250a14e0de973af31e0b75ab628d08162cf6d167c9361c9bc5ded
Instruction Fuzzy Hash: A4112E7A901218FFDB11DFA5CD85F9DBB78FB48710F204096E904B7250D6716E50EB94

Function 00F21290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F22612: GetWindowLongW.USER32(?,000000EB), ref: 00F22623

DefDlgProcW.USER32(?,00000020,?), ref: 00F212D8
GetClientRect.USER32(?,?), ref: 00F5B84B
GetCursorPos.USER32(?), ref: 00F5B855
ScreenToClient.USER32(?,?), ref: 00F5B860

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 992ddec2e9e6e571ae320f7cfdb74d6c04e6f43a33b2b0217f17736dc1afefbc
Instruction ID: c9de89d201bf0c91b19d2b097bac0d4432b6cc3e03ec2c4543219e0aa3c3b299
Opcode Fuzzy Hash: 992ddec2e9e6e571ae320f7cfdb74d6c04e6f43a33b2b0217f17736dc1afefbc
Instruction Fuzzy Hash: 5F113A7690102DEFCB10DFA4E8859EE77B8FB16301F100456F901E7291C734BA55ABA9

Function 00F81652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F801FD,?,00F81250,?,00008000), ref: 00F8166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00F801FD,?,00F81250,?,00008000), ref: 00F81694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00F801FD,?,00F81250,?,00008000), ref: 00F8169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00F801FD,?,00F81250,?,00008000), ref: 00F816D1

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 2dc47b2c205dcfcf5e758956d97881fe53b918dc1ee2022d8f817223f0c981cd
Instruction ID: f69107ba2b80773567e0e4294b337974e109249228b65ac1fd53eb5203648471
Opcode Fuzzy Hash: 2dc47b2c205dcfcf5e758956d97881fe53b918dc1ee2022d8f817223f0c981cd
Instruction Fuzzy Hash: 1C117C71C0051CD7CF00AFE5D848AEEBB78FF09711F054165E980B6240EB315562AB96

Function 00F57207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00F5722B

Part of subcall function 00F57912: __fltout2.LIBCMT ref: 00F5793B

__cftog_l.LIBCMT ref: 00F57251
__cftoe_l.LIBCMT ref: 00F57283

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: a95422d9554d8c74da706163bb386bab599ceaff48627f3865380da06cc45e0c
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: AC014E3644824ABBCF126E84EC018EE3F62BF59352F598515FF1858431D236C9B9BF81

Function 00FAB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FAB59E
ScreenToClient.USER32(?,?), ref: 00FAB5B6
ScreenToClient.USER32(?,?), ref: 00FAB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00FAB5F5

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: cb7cc85f93ebab761a245c1df11c88b8be15a49d3035d3eec7b36f3c2700bced
Instruction ID: 20b7590fc1bdfb041f17afadc910206d250fcaa618bb3a77d3bf9656153c4bd4
Opcode Fuzzy Hash: cb7cc85f93ebab761a245c1df11c88b8be15a49d3035d3eec7b36f3c2700bced
Instruction Fuzzy Hash: DA1143B9D0020DEFDB41CFA9C8849EEFBB9FB09311F108166E914E3220D735AA559F90

Function 00FAB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FAB8FE
_memset.LIBCMT ref: 00FAB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00FE7F20,00FE7F64), ref: 00FAB93C
CloseHandle.KERNEL32 ref: 00FAB94E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 5083a921d3430179b8b9711578b8922e185bbf8386df112678ba4cdfeeaba614
Instruction ID: ba884af584a23d654332df4fb8fcd9b6b5a9a98a6b6bf74724d4680054a11247
Opcode Fuzzy Hash: 5083a921d3430179b8b9711578b8922e185bbf8386df112678ba4cdfeeaba614
Instruction Fuzzy Hash: 39F0FEF25443D87BE71037A5AC45FBB7A5CEB09758F004021BA08D9192D7755D14A7E8

Function 00F86E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00F86E88

Part of subcall function 00F8794E: _memset.LIBCMT ref: 00F87983

_memmove.LIBCMT ref: 00F86EAB
_memset.LIBCMT ref: 00F86EB8
LeaveCriticalSection.KERNEL32(?), ref: 00F86EC8

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 670bae58ebf71507423336a3afd6bc7d3ef40ffe5186225e6d72d5fd20a3189a
Instruction ID: 2b31325339f35d6da3e2b412db1a1b5f7e42f1861d6fc2b17ffd9007ae4a4af1
Opcode Fuzzy Hash: 670bae58ebf71507423336a3afd6bc7d3ef40ffe5186225e6d72d5fd20a3189a
Instruction Fuzzy Hash: F4F05E7A200204ABCF416F95DC85B8ABF6AEF45360B048061FE085E22AC735E951EBB4

Function 00FAC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F2134D
Part of subcall function 00F212F3: SelectObject.GDI32(?,00000000), ref: 00F2135C
Part of subcall function 00F212F3: BeginPath.GDI32(?), ref: 00F21373
Part of subcall function 00F212F3: SelectObject.GDI32(?,00000000), ref: 00F2139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00FAC030
LineTo.GDI32(00000000,?,?), ref: 00FAC03D
EndPath.GDI32(00000000), ref: 00FAC04D
StrokePath.GDI32(00000000), ref: 00FAC05B

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: aa2d378ff2cc8ec91e84d40de870adf2e0087760aaaa0d765130dba594284da5
Instruction ID: 971d33c646c906d73d688394b89c39d983a299224e5b48c5298657d28f59d451
Opcode Fuzzy Hash: aa2d378ff2cc8ec91e84d40de870adf2e0087760aaaa0d765130dba594284da5
Instruction Fuzzy Hash: C1F0827100525DFBDB226F94AC09FCE3F59AF17321F048000FA11A90E287B95655EFE5

Function 00F7A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00F7A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00F7A3AC
GetCurrentThreadId.KERNEL32 ref: 00F7A3B3
AttachThreadInput.USER32(00000000), ref: 00F7A3BA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 6d398addbec3973a75437a7d473b7000634aa21a0ca430ac78043dfaf42b8b9b
Instruction ID: 4240d353011103decbf043ad25c9b8ede20421b68193a838e8fc43678f11e9fa
Opcode Fuzzy Hash: 6d398addbec3973a75437a7d473b7000634aa21a0ca430ac78043dfaf42b8b9b
Instruction Fuzzy Hash: 9DE0C97154522CBADB605FA2DC0DEDB7F5CEF167A2F008025F509990A0D6729544EBA1

Function 00F22218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F22231
SetTextColor.GDI32(?,000000FF), ref: 00F2223B
SetBkMode.GDI32(?,00000001), ref: 00F22250
GetStockObject.GDI32(00000005), ref: 00F22258
GetWindowDC.USER32(?,00000000), ref: 00F5C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00F5C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00F5C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00F5C112
GetPixel.GDI32(00000000,?,?), ref: 00F5C132
ReleaseDC.USER32(?,00000000), ref: 00F5C13D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 1d4997a8ba7cf5c2bce1829348fa30ff759455818e6e8129af0f018b9a822647
Instruction ID: d2443affc13bc5131e5274a60b40eb1954fa3876fbc4f71b61dc9e59b71225a3
Opcode Fuzzy Hash: 1d4997a8ba7cf5c2bce1829348fa30ff759455818e6e8129af0f018b9a822647
Instruction Fuzzy Hash: B6E03071900248EEDB215FA4FC097D83B10EB06332F048366FA69880E187714588EB51

Function 00F78C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00F78C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00F7882E), ref: 00F78C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00F7882E), ref: 00F78C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00F7882E), ref: 00F78C7E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9e98b6379647f1937d9472a8b3fd499182d564380d60e70d100f5b377e3e4634
Instruction ID: 42ae1ac2a67c6afe79e2954764b3383329ef77639defefb69ccdef7596e8be3e
Opcode Fuzzy Hash: 9e98b6379647f1937d9472a8b3fd499182d564380d60e70d100f5b377e3e4634
Instruction Fuzzy Hash: A0E086B6A42315DBD7205FF16D0CB973BACEF527E2F088828B245CD040DA34844AEB61

Function 00F62187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F62187
GetDC.USER32(00000000), ref: 00F62191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F621B1
ReleaseDC.USER32(?), ref: 00F621D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8c9c0c51374939ffbbe5930d29c6e5af02d1a499619f8944b30ba492fc469106
Instruction ID: 3cb0c4f2f75fad51ae74e7a425986ae67da2321451cd74829e29d5d3307e14bf
Opcode Fuzzy Hash: 8c9c0c51374939ffbbe5930d29c6e5af02d1a499619f8944b30ba492fc469106
Instruction Fuzzy Hash: 4EE0E5B5800618EFDB119FA0D808A9D7BB1EB4D351F108425FD5ADB320CB788145BF40

Function 00F6219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00F6219B
GetDC.USER32(00000000), ref: 00F621A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00F621B1
ReleaseDC.USER32(?), ref: 00F621D2

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 73b3358e57f588e194b560e105ac5b806f5ce9d05c25c17ffd9fd6a5814294ea
Instruction ID: 2de38c2f1a09d06f58e119ddde6f223dc7a3bd32ec8bbcfcb60b34b99b81c03c
Opcode Fuzzy Hash: 73b3358e57f588e194b560e105ac5b806f5ce9d05c25c17ffd9fd6a5814294ea
Instruction Fuzzy Hash: 00E012B5C00218AFCB219FB0D80869D7BF1EB4D311F108029F95AEB320CB789145AF40

Function 00F7B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00F7B981

Strings

Container, xrefs: 00F7B8FE
AutoIt3GUI, xrefs: 00F7B8F9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: d6dcf09eb667b7c06e4f4aa924faee8cee1e456ff94efce3d8797aca700a1c75
Instruction ID: e5e262614e6126781806c65a9c606dc0c909aff2c159bdbe7110df1515c4a596
Opcode Fuzzy Hash: d6dcf09eb667b7c06e4f4aa924faee8cee1e456ff94efce3d8797aca700a1c75
Instruction Fuzzy Hash: 309159716002019FDB24DF68C884B6ABBF9FF49710F24856EF94ACB291DB70E841DB51

Function 00F8B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3FEC6: _wcscpy.LIBCMT ref: 00F3FEE9

Part of subcall function 00F29997: __itow.LIBCMT ref: 00F299C2
Part of subcall function 00F29997: __swprintf.LIBCMT ref: 00F29A0C

__wcsnicmp.LIBCMT ref: 00F8B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00F8B361

Strings

LPT, xrefs: 00F8B292

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 438145fd1526d42eecf4af333ec0d3db6ea8c4c57fe5fab39bba0c63456b628d
Instruction ID: 0506d1a5bce9bf622cf62e1ee69319149a8a0e98c4961789ef4918e43e126f90
Opcode Fuzzy Hash: 438145fd1526d42eecf4af333ec0d3db6ea8c4c57fe5fab39bba0c63456b628d
Instruction Fuzzy Hash: 82619276E00215AFDB14EF94C885EEEB7B4AF08320F15405AF946AB251DB74AE84EB50

Function 00F32AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F32AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F32AE1

Strings

@, xrefs: 00F32AD5

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a79d9192e20e81e901cf31baf115a7667dee9c3a1aed657875604d786df0def2
Instruction ID: 33d9f317ea57327e992a611039cbe103be2bc24e3b746968d1f104044c2aa77b
Opcode Fuzzy Hash: a79d9192e20e81e901cf31baf115a7667dee9c3a1aed657875604d786df0def2
Instruction Fuzzy Hash: F6516B714187589BD320AF10EC86BAFB7F8FF84310F42485DF1D9421A5DB749929DB16

Function 00F899BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F2506B: __fread_nolock.LIBCMT ref: 00F25089

_wcscmp.LIBCMT ref: 00F89AAE
_wcscmp.LIBCMT ref: 00F89AC1

Strings

FILE, xrefs: 00F899FA

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: cb3c72e864dc5942dbfc81adb2e6906481075265965662424ff66b307456c271
Instruction ID: cfce2f32c9180c08023512b54645bba87192a6d2ed3f9b3ae8b8098178ba139e
Opcode Fuzzy Hash: cb3c72e864dc5942dbfc81adb2e6906481075265965662424ff66b307456c271
Instruction Fuzzy Hash: 2F41D971A0461ABADF20EAA4DC45FEFBBBDDF45710F040079F900B7181DAB99A0497A1

Function 00F92882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F92892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00F928C8

Strings

|, xrefs: 00F92899

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: c63c1c61ebc1751d2c0dce8a9f9cabfc255e024fe00085f743b51aeb166b5aa9
Instruction ID: 1ea3eb8e9ad37c8912d731c9cd8329a98f94114a0a50d035f2310d419911bcfb
Opcode Fuzzy Hash: c63c1c61ebc1751d2c0dce8a9f9cabfc255e024fe00085f743b51aeb166b5aa9
Instruction Fuzzy Hash: 0F315E71801219AFDF01EFA1DC85EEEBFB8FF08350F104025F814AA165EB355956EB60

Function 00FA6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00FA6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00FA6DC2

Strings

static, xrefs: 00FA6D22

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: aba51533016daa6c280175d00b8ebf9d039902ebd233f3e06d8d8d214523f53c
Instruction ID: 9676b2fbec5fff0236554e79012c17b6d72e35f2751115e5bcf5835d01cd58a4
Opcode Fuzzy Hash: aba51533016daa6c280175d00b8ebf9d039902ebd233f3e06d8d8d214523f53c
Instruction Fuzzy Hash: 6131AFB1600204AEDB109F78CC80BFB77B9FF49760F148619F9A6D7190CA35AC91EB60

Function 00F82D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F82E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00F82E3B

Strings

0, xrefs: 00F82DF9

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 8a9dedd8b70fcbb4462297ba59f3b0f074be4256ce45a240d3b651a935be242a
Instruction ID: 18fb880a83228cc871c021410ba267fb3d9e9ae62c423eb0ae74d2acb84b7cd9
Opcode Fuzzy Hash: 8a9dedd8b70fcbb4462297ba59f3b0f074be4256ce45a240d3b651a935be242a
Instruction Fuzzy Hash: 2A31E971E00309AFEB64EF58C8457DEBBB5FF05360F140029ED85D61A0D770A944EB54

Function 00FA6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00FA69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00FA69DB

Strings

Combobox, xrefs: 00FA699D

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 36407702a6dc0ee71cb358d96e5833b5bd52b0ba71338c1866e8d995fcbfcadd
Instruction ID: adecf4a26bfe739d6006ad6d8d4036f4202e10064880d9edc5e3b485f2540132
Opcode Fuzzy Hash: 36407702a6dc0ee71cb358d96e5833b5bd52b0ba71338c1866e8d995fcbfcadd
Instruction Fuzzy Hash: A211B2B1A00208AFEF119F14CC80EAB376EEB9E3A4F190125F958DB290D6759C51A7A0

Function 00FA6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F21D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F21D73
Part of subcall function 00F21D35: GetStockObject.GDI32(00000011), ref: 00F21D87
Part of subcall function 00F21D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F21D91

GetWindowRect.USER32(00000000,?), ref: 00FA6EE0
GetSysColor.USER32(00000012), ref: 00FA6EFA

Strings

static, xrefs: 00FA6EBD

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: e29b9deadd6961b0a51dd83b666d7771c9255670ab588e57b2be45339f8be277
Instruction ID: dcc501310b209969be2e451803b12fc277978bba253962eae81a36179e02318c
Opcode Fuzzy Hash: e29b9deadd6961b0a51dd83b666d7771c9255670ab588e57b2be45339f8be277
Instruction Fuzzy Hash: AA212CB2910209AFDB04DFA8DD45AEA7BB8FB09314F044529F955D3250E734E851AB50

Function 00FA6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00FA6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00FA6C20

Strings

edit, xrefs: 00FA6BF5

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: ca52e8f56cdb4df13650335854118cdb852133061daaa6c56e4dcc1272186337
Instruction ID: b5567478c122a02aea7f9cac7587cc4f8408f90000cf74fecea9e29e67844094
Opcode Fuzzy Hash: ca52e8f56cdb4df13650335854118cdb852133061daaa6c56e4dcc1272186337
Instruction Fuzzy Hash: 5111BCB1900208ABEB108E64DC41EEB376AEB563B8F244724F961D71E0C739DC91BB60

Function 00F82E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F82F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00F82F30

Strings

0, xrefs: 00F82F07

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 2030dce0ef706c23b3cb5d4c1b78a112f2dbb0463563b08e06d344b69fdc77df
Instruction ID: 898dc17dab7630f3b0de2a1bf6521df6ae1e8f77f5cb001d5d507b6576168cc7
Opcode Fuzzy Hash: 2030dce0ef706c23b3cb5d4c1b78a112f2dbb0463563b08e06d344b69fdc77df
Instruction Fuzzy Hash: 6D11B232E01118ABDB60FB58DC44BD977B9EB15360F1800B6ED54EB2A0D7B0BE04E795

Function 00F924CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00F92520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00F92549

Strings

<local>, xrefs: 00F92511

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 1616f5cde8f94bf7273a77a7827aa052a7dfbeda90414a2668895b13065fa396
Instruction ID: 9372cb726f87a4fe7e382c5174a0911311967416d92bb709f302d7209cfb9005
Opcode Fuzzy Hash: 1616f5cde8f94bf7273a77a7827aa052a7dfbeda90414a2668895b13065fa396
Instruction Fuzzy Hash: 3511C6B1501225BAEF648F558C95FFBFF68FF06761F10812AF90546141D270A985FAF0

Function 00F980A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00F980C8,?,00000000,?,?), ref: 00F98322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00F980CB
htons.WSOCK32(00000000,?,00000000), ref: 00F98108

Strings

255.255.255.255, xrefs: 00F980E3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 9c8e716ae552c9f7f3ab61facb1b892e6ae47167552eed6a1bf43bb2bc9b4868
Instruction ID: 4f8ad0a69e34236c19e073d50ea19afcaf43f84c37802d6de8b6222a712bde3b
Opcode Fuzzy Hash: 9c8e716ae552c9f7f3ab61facb1b892e6ae47167552eed6a1bf43bb2bc9b4868
Instruction Fuzzy Hash: 09112130600209ABEF20AFA4CC42FBDB324FF01360F108527E9129B291DA36A806E691

Function 00F792E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00F79355

Strings

ListBox, xrefs: 00F7931F
ComboBox, xrefs: 00F792F4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ce6920faa31605fc1130aabd7cd8ba079f0900f0d1c6bc36e06b001e30228135
Instruction ID: 55485a401039e4e2b3062c8328a26801aaef025faad3c7d1d3507022475d6bc1
Opcode Fuzzy Hash: ce6920faa31605fc1130aabd7cd8ba079f0900f0d1c6bc36e06b001e30228135
Instruction Fuzzy Hash: C101F571A09224ABCB04FBA0DC929FE736EBF06320B14461AF936573D1DB75580CA651

Function 00F791DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00F7924D

Strings

ListBox, xrefs: 00F79217
ComboBox, xrefs: 00F791EC

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 6d70c56e7d80df7abb1543c358f1bfdf0280ce1105b1f1acd12badd0b03fb7f9
Instruction ID: 91e4b0e28cc79750d4d19c16e79ee5584ad1cc8aee7242ba070f80d3c8b4a086
Opcode Fuzzy Hash: 6d70c56e7d80df7abb1543c358f1bfdf0280ce1105b1f1acd12badd0b03fb7f9
Instruction Fuzzy Hash: 4501D871A4920477CB04FBA0DD92EFF73A99F05700F144056B51667292DA685E0CF6B2

Function 00F79264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F27F41: _memmove.LIBCMT ref: 00F27F82

Part of subcall function 00F7B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00F7B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00F792D0

Strings

ListBox, xrefs: 00F7929C
ComboBox, xrefs: 00F79271

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 8dae94842cc32784841df37c457ae6004e77e76e20dfe1f390b07ff8017a1a12
Instruction ID: e12acd0fadffcbe9d30be8ea75880e11298816b1b36834636a8a80a39f7feecb
Opcode Fuzzy Hash: 8dae94842cc32784841df37c457ae6004e77e76e20dfe1f390b07ff8017a1a12
Instruction Fuzzy Hash: 0301F771A4921877CF00F6A0DD82FFF73AC9F01710F184026791673282DA695E0CB6B2

Function 00F851CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00F851E8
_wcscmp.LIBCMT ref: 00F851FA

Strings

#32770, xrefs: 00F851F4

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 86550b59e4bb12d3b27e5d9f09cec7d7c717fe42780d509b7e3a599ce1189d26
Instruction ID: 9ac270e5dda52bd0f14d481f59a7a502ad87850abe677373325135c585c14907
Opcode Fuzzy Hash: 86550b59e4bb12d3b27e5d9f09cec7d7c717fe42780d509b7e3a599ce1189d26
Instruction Fuzzy Hash: F7E0617290432C17D710AA959C45FA7FBACEB41731F000157FD10D7040D560990987D1

Function 00F781BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00F781CA

Part of subcall function 00F43598: _doexit.LIBCMT ref: 00F435A2

Strings

AutoIt, xrefs: 00F781BE
Error allocating memory., xrefs: 00F781C3

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: ad48e28262f4478d4ea7092da30bfc48a8aab2345e7f367392911bc8bc576fab
Instruction ID: f198b289a41eb6d600c850aad8e3eb30ad0b01ddc36c349eee6fa2d8ec271da4
Opcode Fuzzy Hash: ad48e28262f4478d4ea7092da30bfc48a8aab2345e7f367392911bc8bc576fab
Instruction Fuzzy Hash: 51D05B323C531C32D21472E96C0BFC57E484F05B51F444016BF08556D38ED595C272DA

Function 00F5B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00F5B564: _memset.LIBCMT ref: 00F5B571

Part of subcall function 00F40B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00F5B540,?,?,?,00F2100A), ref: 00F40B89

IsDebuggerPresent.KERNEL32(?,?,?,00F2100A), ref: 00F5B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F2100A), ref: 00F5B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F5B54E

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: d857ccea651fc212a29efe83a310bedf4f0120ba0c9fcc48c76908c1d1939141
Instruction ID: 46b10b8ca5240059ddd977a18b1a253f7a3cef2629a21ac1d72e2e672c883667
Opcode Fuzzy Hash: d857ccea651fc212a29efe83a310bedf4f0120ba0c9fcc48c76908c1d1939141
Instruction Fuzzy Hash: 2FE092B06003158FD765DF68E904B427BE0EF00755F04892CE946CB252EBB8D408EB61

Function 00FA5BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FA5BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00FA5C08

Part of subcall function 00F854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F8555E

Strings

Shell_TrayWnd, xrefs: 00FA5BEE

Memory Dump Source

Source File: 00000000.00000002.1632556409.0000000000F21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F20000, based on PE: true

Associated: 00000000.00000002.1632544094.0000000000F20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632596922.0000000000FD5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632632256.0000000000FDF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1632649726.0000000000FE8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f20000_42.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4b995a8097f8d35b4500c2ee95ee34ce9d409a62a3a18b3821e7323ed1abad9c
Instruction ID: f09bf0d8f9b851d5f61938a2d9e2bca5ea709c910ebb3abb4131e79e01a0a2bb
Opcode Fuzzy Hash: 4b995a8097f8d35b4500c2ee95ee34ce9d409a62a3a18b3821e7323ed1abad9c
Instruction Fuzzy Hash: 31D0A931388320BBE324BBB0AC0BFD33A10AB01B10F040825B206AA2D0C8E4A800D600

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 42.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\acceptancy

C:\Users\user\AppData\Local\Temp\acrorrheuma

C:\Users\user\AppData\Local\Temp\aut2C63.tmp

C:\Users\user\AppData\Local\Temp\aut2CC2.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
42.exe

Function 00F23B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00F24AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00F24FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00F893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00F23015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Function 00F23041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00F271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00F23A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00F23633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00F23778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01DA2610 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00F239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01DA23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157
fileCOMMON

Function 00F2410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00F4564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre