Edit tour

Windows Analysis Report
ss.exe

Overview

General Information

Sample name:	ss.exe
Analysis ID:	1466692
MD5:	51db2f697d46b38417dc0ae45abaef28
SHA1:	c1df22fd6c29d26e2a6765f51554e333d200df4c
SHA256:	8e537ef5b6125fef6449de923808b92122edc8e2d6cc887d49c8ed5510760848
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

ss.exe (PID: 6188 cmdline: "C:\Users\user\Desktop\ss.exe" MD5: 51DB2F697D46B38417DC0AE45ABAEF28)

RegSvcs.exe (PID: 2920 cmdline: "C:\Users\user\Desktop\ss.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pgsu.co.id", "Username": "joko.wahyono@pgsu.co.id", "Password": "Vecls16@Vezs           "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33549:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33665:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33741:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33867:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.4453899182.0000000003119000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: ss.exe PID: 6188	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ss.exe PID: 6188	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 2920	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 2920	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33549:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33665:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33741:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33867:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ss.exe.3770000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ss.exe.3770000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ss.exe.3770000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31749:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31865:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31941:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a67:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.ss.exe.3770000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.ss.exe.3770000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.ss.exe.3770000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334d7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33549:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335d3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33665:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336cf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33741:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337d7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33867:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 107.178.108.39, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 2920, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.ss.exe.3770000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pgsu.co.id", "Username": "joko.wahyono@pgsu.co.id", "Password": "Vecls16@Vezs "}

Multi AV Scanner detection for submitted file

Source: ss.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ss.exe

Joe Sandbox ML: detected

Source: ss.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: ss.exe, 00000000.00000003.2000877442.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, ss.exe, 00000000.00000003.2001112982.0000000003B10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ss.exe, 00000000.00000003.2000877442.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, ss.exe, 00000000.00000003.2001112982.0000000003B10000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00684696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00684696
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068C93C FindFirstFileW,FindClose,	0_2_0068C93C
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0068C9C7
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0068F200
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0068F35D
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0068F65E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00683A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00683A2B
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00683D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00683D4E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0068BF27

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 107.178.108.39:587

Source: Joe Sandbox View

IP Address: 107.178.108.39 107.178.108.39

Source: Joe Sandbox View

ASN Name: IOFLOODUS IOFLOODUS

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 107.178.108.39:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006925E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_006925E2

Source: global traffic

DNS traffic detected: DNS query: mail.pgsu.co.id

Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.pgsu.co.id
Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pgsu.co.id
Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: ss.exe, 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.ss.exe.3770000.1.raw.unpack, cPKWk.cs

.Net Code: gdCwU6rsZ

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0069425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0069425A

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00694458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00694458

Source: C:\Users\user\Desktop\ss.exe

0_2_0069425A

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00680219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00680219

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006ACDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_006ACDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ss.exe.3770000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.ss.exe.3770000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\ss.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00623B4C
Source: ss.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: ss.exe, 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_00094a86-2
Source: ss.exe, 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_9a7ec6df-4
Source: ss.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2ca09c99-7
Source: ss.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_5121ae6e-2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00684021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00684021

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00678858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00678858

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0068545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0068545F

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0062E800	0_2_0062E800
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064DBB5	0_2_0064DBB5
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0062E060	0_2_0062E060
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006A804A	0_2_006A804A
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00634140	0_2_00634140
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00642405	0_2_00642405
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00656522	0_2_00656522
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006A0665	0_2_006A0665
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0065267E	0_2_0065267E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00636843	0_2_00636843
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064283A	0_2_0064283A
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006589DF	0_2_006589DF
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00638A0E	0_2_00638A0E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006A0AE2	0_2_006A0AE2
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00656A94	0_2_00656A94
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0067EB07	0_2_0067EB07
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00688B13	0_2_00688B13
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064CD61	0_2_0064CD61
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00657006	0_2_00657006
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0063710E	0_2_0063710E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00633190	0_2_00633190
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00621287	0_2_00621287
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006433C7	0_2_006433C7
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064F419	0_2_0064F419
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006416C4	0_2_006416C4
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00635680	0_2_00635680
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006358C0	0_2_006358C0
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006478D3	0_2_006478D3
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00641BB8	0_2_00641BB8
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00659D05	0_2_00659D05
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0062FE40	0_2_0062FE40
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064BFE6	0_2_0064BFE6
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00641FD0	0_2_00641FD0
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_01EC35F0	0_2_01EC35F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015F9380	2_2_015F9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015F9B48	2_2_015F9B48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015F4AA0	2_2_015F4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015FCDC8	2_2_015FCDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015F3E88	2_2_015F3E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015F41D0	2_2_015F41D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_015FF4C0	2_2_015FF4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_064856C8	2_2_064856C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06483F40	2_2_06483F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0648BCF8	2_2_0648BCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0648DCAD	2_2_0648DCAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06482AF0	2_2_06482AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06488B72	2_2_06488B72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06480040	2_2_06480040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06484FE8	2_2_06484FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06483238	2_2_06483238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_065714C0	2_2_065714C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06571528	2_2_06571528

Source: C:\Users\user\Desktop\ss.exe	Code function: String function: 00627F41 appears 35 times
Source: C:\Users\user\Desktop\ss.exe	Code function: String function: 00648B40 appears 42 times
Source: C:\Users\user\Desktop\ss.exe	Code function: String function: 00640D27 appears 70 times

Source: ss.exe, 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamef1a08a05-b195-4d04-8a01-a86b7545550f.exe4 vs ss.exe
Source: ss.exe, 00000000.00000003.2001112982.0000000003C33000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ss.exe
Source: ss.exe, 00000000.00000003.2002383444.0000000003E1D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs ss.exe

Source: ss.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ss.exe.3770000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.ss.exe.3770000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.ss.exe.3770000.1.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.ss.exe.3770000.1.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.ss.exe.3770000.1.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@2/1

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0068A2D5 GetLastError,FormatMessageW,

0_2_0068A2D5

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00678713 AdjustTokenPrivileges,CloseHandle,		0_2_00678713
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00678CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00678CC3

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0068B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0068B59E

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0069F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0069F121

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0068C602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_0068C602

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00624FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00624FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\ss.exe

File created: C:\Users\user\AppData\Local\Temp\autC4B.tmp

Jump to behavior

Source: ss.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ss.exe

ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\ss.exe "C:\Users\user\Desktop\ss.exe"
Source: C:\Users\user\Desktop\ss.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\ss.exe"
Source: C:\Users\user\Desktop\ss.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\ss.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ss.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: ss.exe

Static file information: File size 1103872 > 1048576

Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ss.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ss.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: ss.exe, 00000000.00000003.2000877442.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, ss.exe, 00000000.00000003.2001112982.0000000003B10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ss.exe, 00000000.00000003.2000877442.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, ss.exe, 00000000.00000003.2001112982.0000000003B10000.00000004.00001000.00020000.00000000.sdmp

Source: ss.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ss.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ss.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ss.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ss.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0069C304 LoadLibraryA,GetProcAddress,

0_2_0069C304

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0062C590 push eax; retn 0062h	0_2_0062C599
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00648B85 push ecx; ret	0_2_00648B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_06483AD7 push ebx; retf	2_2_06483ADA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0657845A push es; ret	2_2_06578474

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00624A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00624A35
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_006A55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_006A55FD

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006433C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_006433C7

Source: C:\Users\user\Desktop\ss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ss.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\ss.exe

API/Special instruction interceptor: Address: 1EC3214

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198406	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1088			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8773			Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

API coverage: 4.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00684696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00684696
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068C93C FindFirstFileW,FindClose,	0_2_0068C93C
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0068C9C7
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0068F200
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0068F35D
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0068F65E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00683A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00683A2B
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00683D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00683D4E
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0068BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0068BF27

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00624AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00624AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98248	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98019	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97752	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96202	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1199062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198733	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 1198406	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ss.exe	API call chain: ExitProcess graph end node			graph_0-98121
Source: C:\Users\user\Desktop\ss.exe	API call chain: ExitProcess graph end node			graph_0-98926

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006941FD BlockInput,

0_2_006941FD

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00623B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00623B4C

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00655CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00655CCC

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0069C304 LoadLibraryA,GetProcAddress,

0_2_0069C304

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_01EC34E0 mov eax, dword ptr fs:[00000030h]	0_2_01EC34E0
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_01EC3480 mov eax, dword ptr fs:[00000030h]	0_2_01EC3480
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_01EC1E70 mov eax, dword ptr fs:[00000030h]	0_2_01EC1E70

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006781F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_006781F7

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064A364 SetUnhandledExceptionFilter,		0_2_0064A364
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_0064A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0064A395

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\ss.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ss.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: FD9008

Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00678C93 LogonUserW,

0_2_00678C93

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00623B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00623B4C

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00624A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00624A35

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00684EF5 mouse_event,

0_2_00684EF5

Source: C:\Users\user\Desktop\ss.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\ss.exe"

Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

0_2_006781F7

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00684C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00684C03

Source: ss.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ss.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0064886B cpuid

0_2_0064886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_006550D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_006550D7

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00662230 GetUserNameW,

0_2_00662230

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_0065418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0065418A

Source: C:\Users\user\Desktop\ss.exe

Code function: 0_2_00624AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00624AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4453899182.0000000003119000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ss.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2920, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: ss.exe	Binary or memory string: WIN_81
Source: ss.exe	Binary or memory string: WIN_XP
Source: ss.exe	Binary or memory string: WIN_XPe
Source: ss.exe	Binary or memory string: WIN_VISTA
Source: ss.exe	Binary or memory string: WIN_7
Source: ss.exe	Binary or memory string: WIN_8
Source: ss.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ss.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2920, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.ss.exe.3770000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4453899182.0000000003119000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ss.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 2920, type: MEMORYSTR

Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00696596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00696596
Source: C:\Users\user\Desktop\ss.exe	Code function: 0_2_00696A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00696A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	4 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ss.exe	42%	ReversingLabs	Win32.Trojan.Strab
ss.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://mail.pgsu.co.id	0%	Avira URL Cloud	safe
http://pgsu.co.id	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pgsu.co.id	107.178.108.39	true	true		unknown
mail.pgsu.co.id	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pgsu.co.id	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	ss.exe, 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.pgsu.co.id	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012BA000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065D7000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4455656305.00000000065EC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4453242211.00000000012C9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.178.108.39	pgsu.co.id	United States		53755	IOFLOODUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466692
Start date and time:	2024-07-03 09:38:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ss.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: ss.exe

Simulations

Behavior and APIs

Time	Type	Description
03:38:53	API Interceptor	12548749x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
107.178.108.39	ss.exe	Get hash	malicious	AgentTesla	Browse
	ss.exe	Get hash	malicious	AgentTesla	Browse
	ss.exe	Get hash	malicious	AgentTesla	Browse
	ss.exe	Get hash	malicious	AgentTesla	Browse
	DvDvqLgf5sEuVVU.exe	Get hash	malicious	AgentTesla	Browse
	sUNUVzTAxa5v2XX.exe	Get hash	malicious	AgentTesla	Browse
	x5gsmVkSF7JmGXd.exe	Get hash	malicious	AgentTesla	Browse
	001564355.exe	Get hash	malicious	AgentTesla	Browse
	Dr8MTWXE8WAgsB2.exe	Get hash	malicious	AgentTesla	Browse
	018062024.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IOFLOODUS	ss.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	ss.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	ss.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	ss.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	DvDvqLgf5sEuVVU.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	sUNUVzTAxa5v2XX.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	x5gsmVkSF7JmGXd.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	001564355.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	Dr8MTWXE8WAgsB2.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39
	018062024.exe	Get hash	malicious	AgentTesla	Browse	107.178.108.39

Process:	C:\Users\user\Desktop\ss.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.694322518663737
Encrypted:	false
SSDEEP:	6144:jimNz7e/FjwrL71+rSeMYA+aTwekjOIJhYmrewVHHlEcI6eb0He74JYB:jimJSMYWwekjnpnlkAYB
MD5:	04F7642E9583381C2064BBEDA40C5CDB
SHA1:	48E543333933DA5B4892F515F015AD4202B15039
SHA-256:	738E04F3F473D8D3AC3234C2F70C69D3ADDA53CFB01CB673274EBACFBE4EAB24
SHA-512:	4ED2CFFAB983F7C5F1F6C99576F28A74CD4C12B04DADA1B972F9598739FFFCCCB5170EA832636C7F6F76FB7ED5C1EA2885B5E1A529C9FF06809E5E0F3B5FF7AE
Malicious:	false
Reputation:	low
Preview:	u..ZA9KR2453..DE.8VJZB9K.6453XVDEO8VJZB9KR6453XVDEO8VJZB9KR6.53XX[.A8.C.c.J...a[1%d5=W18;/.(3XZZGx4!e=M8j3,...e.X\<3jHB2rJZB9KR6dp3X.EFO..k<B9KR6453.VFDD9]JZ.:KR>453XVD[.;VJzB9K.5453.VDeO8VHZB=KR6453XRDEO8VJZB9OR6653XVDEM8..ZB)KR&453XFDE_8VJZB9[R6453XVDEO8..YBvKR64.0X.AEO8VJZB9KR6453XVDEO.UJVB9KR6453XVDEO8VJZB9KR6453XVDEO8VJZB9KR6453XVDEO8VJZB.KR>453XVDEO8VJRb9K.6453XVDEO8Vd.'A?R64..[VDeO8V.YB9IR6453XVDEO8VJZb9K2.FFA;VDE.=VJZ.:KR0453.UDEO8VJZB9KR64u3X.j7T9)ZB5KR64.0XVFEO8.IZB9KR6453XVDE.8V.ZB9KR6453XVDEO8VJ.A9KR64}3XVFEJ8..XB.{S6753XWDEI8VJZB9KR6453XVDEO8VJZB9KR6453XVDEO8VJZB9KR6453XVY......\|q6l<V2.~.#.L..Y..@..9u .#B..~[...uC2.zX.Ku.C...'.<0JY...nQ37#.A.:R.K....kk..r.TX.O...:w.VPn.k........K1.`.....(=[.TC(:!k.Y0+(+.I.7453X........+A...7:-lD<...nPA.....MXVD!O8V8ZB9*R64r3XV+EO88JZBGKR6J53X.DEOxVJZu9KR.4535VDEk8VJ$B9K.K;:..-6..VJZB9~....^........tH.,mV.. ....O..6#.Awyt..J.S..M.RMqxl22^RAGH<UFgLr....77\SFBK;ZwT........o..I...C..6453XV.EO.VJZ.K.645.X.D..8VJ.9.R.4...V

C:\Users\user\AppData\Local\Temp\autC4B.tmp

Download File

Process:	C:\Users\user\Desktop\ss.exe
File Type:	data
Category:	dropped
Size (bytes):	148644
Entropy (8bit):	7.942052975506253
Encrypted:	false
SSDEEP:	3072:B88SGv4X1hZ3JSK6daTjTHypzNq/FAYHnzGxRLVz/4efhw:aH/16dWTyqtAYwup
MD5:	02122E1F0EC5305DF708E22CF5915196
SHA1:	2B2D51EE5F5D585C4B87D1F13907E20F5389CC81
SHA-256:	0D40251ED1E39E98EAE0719B6E3109D781647C60CDEFF91CB776C5332F227EB3
SHA-512:	9D6592462CEBB849060BA9185020285A90D4E51D084FF1D8123D523FFFF8EF6D6D7AA5038FB1DF04BEE2979578375F4E0712073CE042A0F7857C5F90EA253E32
Malicious:	false
Reputation:	low
Preview:	EA06......;U...R.M&.=>..E.....sK.M..J.Z.E.....#....J.o.A.x.y{......l5....5...3..3(..+U.=.i!..i..T.Y...l.J.ry3.R(S+..&l...b5E.S...\...[....D..iU...R..;...W..#%5..#.j%.. .V.S....&wO.M...X.."....SK.I...5.._.".l.3...f.v.D~...B....v.......#..@...#T.S.\h...It..?.3":...f=U.........(...A...........&..G....]fu...o.Ne5....E..+.j0.....L....Z..U.y@......"Q....+.X.rou9......(......Gu.O....D.....yV.{........V....;9..;.:.#A..V.}M.Yu.....u..t>.......Ugi...7..UFg7..h1..K]K.r.x.].].......?.......B...}.._....s...[.ku...n5T..'R.\r.0..%x.N.n.2...l.w...J.0.Dno:..(...Q.......M..S@3...a8..%@....0..n......R.....qx......L.T.......H..tis.......p......7..O.....y.....[j..6.. ..=p.\|'.6..(7{..C..q.u8....Sn7.d.e^.Ph..V.g.\....Vo7.T..\.w.Bx.,4_...g-.,.v...."4>......-?p..p.4.h....u..^x.....yu.L.k..U.2.uju/.M...N.Z..vHln...J..i....j5.}^....rM3.W-.y...J.o%.f..i.U.....N.P.4....5../.j<..V.T'..D.m..V..=7.P.V.S..m4...j%..&.Ld r..)6.S.`.-....P.v...k5.S..Z..s\|.\..]b-4.........R

C:\Users\user\AppData\Local\Temp\autCAA.tmp

Download File

Process:	C:\Users\user\Desktop\ss.exe
File Type:	data
Category:	dropped
Size (bytes):	9826
Entropy (8bit):	7.603023350880296
Encrypted:	false
SSDEEP:	192:65jwEiqEH1WgUJuzJkecGgJo7xocBkJ+HA1wyY/U+kxiSA+2k5Cg:I6qEHYV0eecGGo7xocBxHoEGiW8g
MD5:	71CE211E0ABADA7A14F061A941AC0723
SHA1:	74EDA156A8F72E3F14F01A53BF128229D59EA3F9
SHA-256:	8BBCE996E66A50C347D4E142E5D9E2274520552620AF91D2C31347676872509B
SHA-512:	B2579055F5255C86E4F29D1EEE1E0174F46DDE513D49F6B0879D1A8F60FFC04D0F816A5176D598981C9FEA7496405C7A166410ED36FCFBB98389EC82D946A003
Malicious:	false
Reputation:	low
Preview:	EA06..pT.Q&...8.M.z,.D.Lf....y9......o3.N&T...5...j..m1..f.Y..cD.L'.....3.N(s...m9...s.5..8.L/.Y...e..&6[...0.L..I..k7.N&. ..a0.M.....q4.Nf.P.....K..d.%...p.lY@.......c.Xf.0.o..b.L.`...,@. ...3+..d....s4.l&..........\|....sa...`.........Y&.K0.....-vs5.M..2...N&.I...@.>..........$.0...fx. ..$l...I...#..$6...... ..... .Z...a.5..&.).....L.j.;$....M.j.;$....X@j.;%....Y@j.;,.....j.e.\|f #^...j......l.....l.5....>0..Xf....M.^....$zn.....G..I....C...M.\|........}S{....7...\| l..P..........0...`>;..c7.6..{......=..7..............6,......b...,S ...i5.M.4.b..i\|v)....b.h.,@..%........9....c...\|3Y..h......._......@.>K...,v[..q5.M,.@..i7.X......9....2.......,.`....3.,.i8........}.k(.f..@..M&V....7.,.x....&.......0.......Fh...Fb.....3.."a9...`....,vb.....cd.X..P.Fl.Y.$..c. ....I...d..f.!...,vd......8..P.......0.....2...y...D.......c.0.......b.<NA...NM..;4.X.q1..&@Q..B.Y.ah......Yl.i..."..Bvj.........ic..'3Y..'f.....,j.1........C.`....7b.., .p..T.......Y,Vi......@

C:\Users\user\AppData\Local\Temp\cacostomia

Download File

Process:	C:\Users\user\Desktop\ss.exe
File Type:	ASCII text, with very long lines (28756), with no line terminators
Category:	dropped
Size (bytes):	28756
Entropy (8bit):	3.58736219945205
Encrypted:	false
SSDEEP:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbd+IH6B34vfF3if6gyCf:miTZ+2QoioGRk6ZklputwjpjBkCiw2R8
MD5:	D4469FCD7DA460174E4CA97F5F281CA7
SHA1:	1D3253DC36C414C405B5462C7CC08668463D6551
SHA-256:	68177E8210193803025C6F9B24BF461F471F083E336F5FC42278D9BB00593DB3
SHA-512:	C81B8B8D93E0EF24D8249FD89A7318476439060D27D84A437EC9BDCC424A1D3080AE1A9D8C7CCFA8BCA818E0B090237D6C680205E77D3491F44F0C22EE17FEF8
Malicious:	false
Reputation:	low
Preview:	8D6804F867D7E3ED21599F86932DA5673082A29A59B06B261C54E6F1DF089BBB368C973697738FDC880x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffff

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.864476410113246
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ss.exe
File size:	1'103'872 bytes
MD5:	51db2f697d46b38417dc0ae45abaef28
SHA1:	c1df22fd6c29d26e2a6765f51554e333d200df4c
SHA256:	8e537ef5b6125fef6449de923808b92122edc8e2d6cc887d49c8ed5510760848
SHA512:	45ec4bea2af43ba3d17029621a6c018af294d0b9135c19321a617a2dc65b1975ac3340e7fea0b5a4035f209cd9adcfd2866855b5d8eac386485039c3f6412a9d
SSDEEP:	24576:7AHnh+eWsN3skA4RV1Hom2KXMmHa+9hu1DbLtHhj5:Wh+ZkldoPK8Ya+j6Df97
TLSH:	61358C02B39180E5FFAA91735B55B20156FD693431338D2F12982D78BDFF1A12E2DE62
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	01449a1a796c95a9

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66849719 [Wed Jul 3 00:11:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F44508DB65Dh
jmp 00007F44508CE414h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F44508CE59Ah
cmp edi, eax
jc 00007F44508CE8FEh
bt dword ptr [004C41FCh], 01h
jnc 00007F44508CE599h
rep movsb
jmp 00007F44508CE8ACh
cmp ecx, 00000080h
jc 00007F44508CE764h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F44508CE5A0h
bt dword ptr [004BF324h], 01h
jc 00007F44508CEA70h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F44508CE73Dh
test edi, 00000003h
jne 00007F44508CE74Eh
test esi, 00000003h
jne 00007F44508CE72Dh
bt edi, 02h
jnc 00007F44508CE59Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F44508CE5A3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F44508CE5F5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x43080	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10c000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x43080	0x43200	ba0738fefd41cd7190ead946496ec5fa	False	0.7396160672718808	data	7.228883139089099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10c000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc8458	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc8580	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc86a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc87d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 30236 x 30236 px/m	English	Great Britain	0.06435584999408495
RT_MENU	0xd8ff8	0x50	data	English	Great Britain	0.9
RT_STRING	0xd9048	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xd95dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xd9c68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xda0f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xda6f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xdad50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xdb1b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xdb310	0x2f852	data			1.0003390840620217
RT_GROUP_ICON	0x10ab64	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ab78	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10ab8c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10aba0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10abb4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x10ac90	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:38:55.565256119 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:55.570075989 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:55.570171118 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.163805962 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.164694071 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.169663906 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.316797972 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.317003965 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.321883917 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.471527100 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.481626987 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.486459017 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.642673969 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.642707109 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.642718077 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.642797947 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.775814056 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.780596018 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.928258896 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:56.942024946 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:56.946805000 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.103068113 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.104075909 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:57.108855963 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.262403011 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.263571024 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:57.268405914 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.428920031 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.429203987 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:57.434189081 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.582240105 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.585104942 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:57.589925051 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.953248978 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:57.953423977 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:57.958328009 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.105669975 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.106256008 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:58.106307030 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:58.106338024 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:58.108386993 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:38:58.111196041 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.111206055 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.111216068 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.113133907 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.270136118 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:38:58.321481943 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:40:34.509236097 CEST	49704	587	192.168.2.5	107.178.108.39
Jul 3, 2024 09:40:34.514426947 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:40:34.665724993 CEST	587	49704	107.178.108.39	192.168.2.5
Jul 3, 2024 09:40:34.671854973 CEST	49704	587	192.168.2.5	107.178.108.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 09:38:54.484894991 CEST	64221	53	192.168.2.5	1.1.1.1
Jul 3, 2024 09:38:55.477924109 CEST	64221	53	192.168.2.5	1.1.1.1
Jul 3, 2024 09:38:55.557874918 CEST	53	64221	1.1.1.1	192.168.2.5
Jul 3, 2024 09:38:55.557934046 CEST	53	64221	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 09:38:54.484894991 CEST	192.168.2.5	1.1.1.1	0xd72b	Standard query (0)	mail.pgsu.co.id	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:38:55.477924109 CEST	192.168.2.5	1.1.1.1	0xd72b	Standard query (0)	mail.pgsu.co.id	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 09:38:55.557874918 CEST	1.1.1.1	192.168.2.5	0xd72b	No error (0)	mail.pgsu.co.id	pgsu.co.id		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 09:38:55.557874918 CEST	1.1.1.1	192.168.2.5	0xd72b	No error (0)	pgsu.co.id		107.178.108.39	A (IP address)	IN (0x0001)	false
Jul 3, 2024 09:38:55.557934046 CEST	1.1.1.1	192.168.2.5	0xd72b	No error (0)	mail.pgsu.co.id	pgsu.co.id		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 09:38:55.557934046 CEST	1.1.1.1	192.168.2.5	0xd72b	No error (0)	pgsu.co.id		107.178.108.39	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 09:38:56.163805962 CEST	587	49704	107.178.108.39	192.168.2.5	220-grogolsarana.padinet.com ESMTP Exim 4.96.2 #2 Wed, 03 Jul 2024 14:38:54 +0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jul 3, 2024 09:38:56.164694071 CEST	49704	587	192.168.2.5	107.178.108.39	EHLO 899552
Jul 3, 2024 09:38:56.316797972 CEST	587	49704	107.178.108.39	192.168.2.5	250-grogolsarana.padinet.com Hello 899552 [8.46.123.33] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Jul 3, 2024 09:38:56.317003965 CEST	49704	587	192.168.2.5	107.178.108.39	STARTTLS
Jul 3, 2024 09:38:56.471527100 CEST	587	49704	107.178.108.39	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	03:38:51
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\ss.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ss.exe"
Imagebase:	0x620000
File size:	1'103'872 bytes
MD5 hash:	51DB2F697D46B38417DC0AE45ABAEF28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2003264166.0000000003770000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:38:51
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ss.exe"
Imagebase:	0xd80000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4453899182.00000000030EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4453899182.0000000003119000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4452947585.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4453899182.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 00623B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00623B7A
IsDebuggerPresent.KERNEL32 ref: 00623B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,006E62F8,006E62E0,?,?), ref: 00623BFD

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Part of subcall function 00630A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00623C26,006E62F8,?,?,?), ref: 00630ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00623C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,006D93F0,00000010), ref: 0065D4BC
SetCurrentDirectoryW.KERNEL32(?,006E62F8,?,?,?), ref: 0065D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,006D5D40,006E62F8,?,?,?), ref: 0065D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0065D581

Part of subcall function 00623A58: GetSysColorBrush.USER32(0000000F), ref: 00623A62
Part of subcall function 00623A58: LoadCursorW.USER32(00000000,00007F00), ref: 00623A71
Part of subcall function 00623A58: LoadIconW.USER32(00000063), ref: 00623A88
Part of subcall function 00623A58: LoadIconW.USER32(000000A4), ref: 00623A9A
Part of subcall function 00623A58: LoadIconW.USER32(000000A2), ref: 00623AAC
Part of subcall function 00623A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00623AD2
Part of subcall function 00623A58: RegisterClassExW.USER32(?), ref: 00623B28

Part of subcall function 006239E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00623A15
Part of subcall function 006239E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00623A36
Part of subcall function 006239E7: ShowWindow.USER32(00000000,?,?), ref: 00623A4A
Part of subcall function 006239E7: ShowWindow.USER32(00000000,?,?), ref: 00623A53

Part of subcall function 006243DB: _memset.LIBCMT ref: 00624401
Part of subcall function 006243DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 006244A6

Strings

This is a third-party compiled AutoIt script., xrefs: 0065D4B4
runas, xrefs: 0065D575
%k, xrefs: 00623C56

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%k
API String ID: 529118366-1914796069
Opcode ID: 1272567ae39ffedfdc1833c9fb47935fab78942844c00f387c08107f30a2a139
Instruction ID: b68db007986ceca37184697c6e6ed0f113986d525b6cef67b9281caa7c270131
Opcode Fuzzy Hash: 1272567ae39ffedfdc1833c9fb47935fab78942844c00f387c08107f30a2a139
Instruction Fuzzy Hash: 9A511530E047A8AECF11ABB4EC45EED7B7BAB15340F004169F551AA2A1DB345706CF25

Function 00624FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00624EEE,?,?,00000000,00000000), ref: 00624FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00624EEE,?,?,00000000,00000000), ref: 00625010
LoadResource.KERNEL32(?,00000000,?,?,00624EEE,?,?,00000000,00000000,?,?,?,?,?,?,00624F8F), ref: 0065DD60
SizeofResource.KERNEL32(?,00000000,?,?,00624EEE,?,?,00000000,00000000,?,?,?,?,?,?,00624F8F), ref: 0065DD75
LockResource.KERNEL32(Nb,?,?,00624EEE,?,?,00000000,00000000,?,?,?,?,?,?,00624F8F,00000000), ref: 0065DD88

Strings

Nb, xrefs: 0065DD85
SCRIPT, xrefs: 00625006

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$Nb
API String ID: 3051347437-1100917352
Opcode ID: 550bb2abbf84832286b1ef024f3be3d6b3062e772c37ec8ccc7d3cb302f3fc4f
Instruction ID: dd3115b2b64bf8cdf0e5313344a0894b2e8f516a523734da64d3b58fd54baca7
Opcode Fuzzy Hash: 550bb2abbf84832286b1ef024f3be3d6b3062e772c37ec8ccc7d3cb302f3fc4f
Instruction Fuzzy Hash: B5115E75240B00AFD7319BA5EC58FA77BBAEBCAB11F104168F406C6660DB71EC008A61

Function 00624AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00624B2B

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

GetCurrentProcess.KERNEL32(?,006AFAEC,00000000,00000000,?), ref: 00624BF8
IsWow64Process.KERNEL32(00000000), ref: 00624BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00624C45
FreeLibrary.KERNEL32(00000000), ref: 00624C50
GetSystemInfo.KERNEL32(00000000), ref: 00624C81
GetSystemInfo.KERNEL32(00000000), ref: 00624C8D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 09d7f70fa35ec6513d2ae153e50661cf9532761e9130d27f12a75a79f777972c
Instruction ID: e5049e17281d8778882b1e6d22f6ed2b6c057879d1bbba80602b085e1213955c
Opcode Fuzzy Hash: 09d7f70fa35ec6513d2ae153e50661cf9532761e9130d27f12a75a79f777972c
Instruction Fuzzy Hash: 7191F43154ABD0DEC732DB6894511EABFE6AF2A301F444D9DE4CB93B41D620F908CB1A

Function 0062E800 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Dtn, xrefs: 00663F58
Dtn, xrefs: 0062EC21
Variable must be of type 'Object'., xrefs: 0066428C
Dtn, xrefs: 00663F1F
Dtn, xrefs: 0062EC1A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: Dtn$Dtn$Dtn$Dtn$Variable must be of type 'Object'.
API String ID: 0-3728122387
Opcode ID: 85ca9a3231751b2275d20b2a0a0ec05caadad9efeee7912db141bc2ab269005f
Instruction ID: 79f7924cc3ed7fc6fd1ba28dfddb6d43f0cb0784a01b0f6db9b5a5acf622c091
Opcode Fuzzy Hash: 85ca9a3231751b2275d20b2a0a0ec05caadad9efeee7912db141bc2ab269005f
Instruction Fuzzy Hash: 2CA28F74A04A25CFCB14CF98E580AA9B7B3FF58300F648169E916AB351D736ED42CF91

Function 00684696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0065E7C1), ref: 006846A6
FindFirstFileW.KERNELBASE(?,?), ref: 006846B7
FindClose.KERNEL32(00000000), ref: 006846C7

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: a0cfda598c16333944a6fc1b9fb10070f9918db2a6fdaf88a124be736d6f11d4
Instruction ID: 814e33d68dd44e054eb52020e84d5bb4b8648a742abe7b09ce91ada108990838
Opcode Fuzzy Hash: a0cfda598c16333944a6fc1b9fb10070f9918db2a6fdaf88a124be736d6f11d4
Instruction Fuzzy Hash: 2CE0D8314104015B471077B8EC4D4EA779E9F07335F100715F835C11E0FBB06D908AD6

Function 00630B30 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00630BBB
timeGetTime.WINMM ref: 00630E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00630FB3
TranslateMessage.USER32(?), ref: 00630FC7
DispatchMessageW.USER32(?), ref: 00630FD5
Sleep.KERNEL32(0000000A), ref: 00630FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0063105A
DestroyWindow.USER32 ref: 00631066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00631080
Sleep.KERNEL32(0000000A,?,?), ref: 006652AD
TranslateMessage.USER32(?), ref: 0066608A
DispatchMessageW.USER32(?), ref: 00666098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 006660AC

Strings

@TRAY_ID, xrefs: 00665BB9
prn, xrefs: 006653D8
prn, xrefs: 0066542D
@GUI_CTRLHANDLE, xrefs: 0066540E
prn, xrefs: 00665383
prn, xrefs: 00665BDE
@GUI_CTRLID, xrefs: 00665364
@GUI_WINHANDLE, xrefs: 006653B9
@COM_EVENTOBJ, xrefs: 0066591A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$prn$prn$prn$prn
API String ID: 4003667617-1506231113
Opcode ID: 9648d23c55d3b5aa0cadc4c23e001c28c5ae199eb9b4404a37f4f5048a5af209
Instruction ID: 004021c08a25bd527ace40fde2ad04792c66cf87f8a6ac4716573893a5913a43
Opcode Fuzzy Hash: 9648d23c55d3b5aa0cadc4c23e001c28c5ae199eb9b4404a37f4f5048a5af209
Instruction Fuzzy Hash: F6B2AF70608741DFD724DF24C895BAAB7E7BF85304F14491DF48A8B2A1DB71E889CB86

Function 006893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006891E9: __time64.LIBCMT ref: 006891F3

Part of subcall function 00625045: _fseek.LIBCMT ref: 0062505D

__wsplitpath.LIBCMT ref: 006894BE

Part of subcall function 0064432E: __wsplitpath_helper.LIBCMT ref: 0064436E

_wcscpy.LIBCMT ref: 006894D1
_wcscat.LIBCMT ref: 006894E4
__wsplitpath.LIBCMT ref: 00689509
_wcscat.LIBCMT ref: 0068951F
_wcscat.LIBCMT ref: 00689532

Part of subcall function 0068922F: _memmove.LIBCMT ref: 00689268
Part of subcall function 0068922F: _memmove.LIBCMT ref: 00689277

_wcscmp.LIBCMT ref: 00689479

Part of subcall function 006899BE: _wcscmp.LIBCMT ref: 00689AAE
Part of subcall function 006899BE: _wcscmp.LIBCMT ref: 00689AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006896DC
_wcsncpy.LIBCMT ref: 0068974F
DeleteFileW.KERNEL32(?,?), ref: 00689785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0068979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006897AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006897BE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 09267ad5f789189ebe159552521b54a84d42b5eb977da99761c18b8c8f06d217
Instruction ID: 53c90532a11b6d24742a36a6a3f85f7324d7cbf47e8535353ba215f6096f003e
Opcode Fuzzy Hash: 09267ad5f789189ebe159552521b54a84d42b5eb977da99761c18b8c8f06d217
Instruction Fuzzy Hash: BFC131B1D00229AEDF61EF95CC85AEEB7BEEF45300F0441AAF509E7151DB309A848F65

Function 00623015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 74
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00623074
RegisterClassExW.USER32(00000030), ref: 0062309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006230AF
InitCommonControlsEx.COMCTL32(?), ref: 006230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006230DC
LoadIconW.USER32(000000A9), ref: 006230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00623101

Strings

+, xrefs: 0062305D
AutoIt v3 GUI, xrefs: 00623090
0, xrefs: 00623056
TaskbarCreated, xrefs: 006230A4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: fde4c662ebad99fdb413ee843d8191cd53277fb8c0e8adca846a38aae10abe19
Instruction ID: 1884f0fc51d965ca7a8a3c86e50f7f385a713eca82baf24f82d80944093c2fe7
Opcode Fuzzy Hash: fde4c662ebad99fdb413ee843d8191cd53277fb8c0e8adca846a38aae10abe19
Instruction Fuzzy Hash: A4314BB1941349EFDB409FE4EC84ACEBBF5FB1A310F10552AF540AA2A0D3B65541CF91

Function 00623041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00623074
RegisterClassExW.USER32(00000030), ref: 0062309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006230AF
InitCommonControlsEx.COMCTL32(?), ref: 006230CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006230DC
LoadIconW.USER32(000000A9), ref: 006230F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00623101

Strings

+, xrefs: 0062305D
AutoIt v3 GUI, xrefs: 00623090
0, xrefs: 00623056
TaskbarCreated, xrefs: 006230A4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 27aaa417d191d00a83de9183a3baff59e44b01bffcf209e7502378201e5db50e
Instruction ID: 7402043ce9faee4e5514f4f86e27577a875888014036d50a18888e9828a184e4
Opcode Fuzzy Hash: 27aaa417d191d00a83de9183a3baff59e44b01bffcf209e7502378201e5db50e
Instruction Fuzzy Hash: 9321E8B1911358EFDB00EFD4E888B9EBBF6FB09750F00512AF511AA2A0D7B155448FA1

Function 006271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00624864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,006E62F8,?,006237C0,?), ref: 00624882

Part of subcall function 0064074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,006272C5), ref: 00640771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00627308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0065ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0065ED32
RegCloseKey.ADVAPI32(?), ref: 0065ED70
_wcscat.LIBCMT ref: 0065EDC9

Strings

\Include\, xrefs: 006272C5
\, xrefs: 0065EDEC
Include, xrefs: 0065ECE8, 0065ED29
Software\AutoIt v3\AutoIt, xrefs: 006272FE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 57fca0fead37defc6df060c685b3f2e8055618cc053df473f0c8073c035d77d0
Instruction ID: 06acd003aeaba1c8135ab1f5eb0246bc1b9399898dcaa60aa225ce2a9eeb4533
Opcode Fuzzy Hash: 57fca0fead37defc6df060c685b3f2e8055618cc053df473f0c8073c035d77d0
Instruction Fuzzy Hash: B971AF714083519EC754EF65EC818ABBBFAFF59340F40152EF6458B2A0EB309A49CF66

Function 00623633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 006236D2
KillTimer.USER32(?,00000001), ref: 006236FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0062371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0062372A
CreatePopupMenu.USER32 ref: 0062373E
PostQuitMessage.USER32(00000000), ref: 0062375F

Strings

TaskbarCreated, xrefs: 00623725
%k, xrefs: 0065D2D1, 0065D31F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%k
API String ID: 129472671-2455537126
Opcode ID: e659b4ae5d623b4f25bedb2aa7b8528ebd778143dac2bb6ab8a4c4e6b3d35472
Instruction ID: cfe9f21d3dfe07d9dafade70823c35a81dd24b920c6779368dcaa20f5ac0bbd1
Opcode Fuzzy Hash: e659b4ae5d623b4f25bedb2aa7b8528ebd778143dac2bb6ab8a4c4e6b3d35472
Instruction Fuzzy Hash: 43415EB1100A75BBDF206F64FC49BBA375BE711340F000128FA42863E1CB69AE059F7A

Function 00623A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00623A62
LoadCursorW.USER32(00000000,00007F00), ref: 00623A71
LoadIconW.USER32(00000063), ref: 00623A88
LoadIconW.USER32(000000A4), ref: 00623A9A
LoadIconW.USER32(000000A2), ref: 00623AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00623AD2
RegisterClassExW.USER32(?), ref: 00623B28

Part of subcall function 00623041: GetSysColorBrush.USER32(0000000F), ref: 00623074
Part of subcall function 00623041: RegisterClassExW.USER32(00000030), ref: 0062309E
Part of subcall function 00623041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006230AF
Part of subcall function 00623041: InitCommonControlsEx.COMCTL32(?), ref: 006230CC
Part of subcall function 00623041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006230DC
Part of subcall function 00623041: LoadIconW.USER32(000000A9), ref: 006230F2
Part of subcall function 00623041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00623101

Strings

AutoIt v3, xrefs: 00623B17
0, xrefs: 00623B06
#, xrefs: 00623B0D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 554d19adb8733e9ca8b78ec659e43f9008ca069d126e2855d156023a11012560
Instruction ID: bf3fc0d6dfdfe0d1fbb51f5b6e7d2f4cad0f0794ce00de6790675a4bc4a92c91
Opcode Fuzzy Hash: 554d19adb8733e9ca8b78ec659e43f9008ca069d126e2855d156023a11012560
Instruction Fuzzy Hash: AA217E70D00354AFDB109FA4EC89B9D7FB6FB18751F001129F604AE2E0C3BAA6448F84

Function 00623778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINE, xrefs: 00623834
CMDLINERAW, xrefs: 0062380D
/AutoIt3ExecuteLine, xrefs: 006238B9
/AutoIt3ExecuteScript, xrefs: 006238CE
/AutoIt3OutputDebug, xrefs: 006238A4
bn, xrefs: 0065D44E
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 006237C0
/ErrorStdOut, xrefs: 0062388F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$bn
API String ID: 1825951767-3767551264
Opcode ID: 6cf66bf1554dc0f5ef067952d3b22527ee2559056216e0601fa239597644cf6a
Instruction ID: 40e9fcdb388054038c20029dbdcd19c7a56e0ab7fd00720b00342222937a432f
Opcode Fuzzy Hash: 6cf66bf1554dc0f5ef067952d3b22527ee2559056216e0601fa239597644cf6a
Instruction Fuzzy Hash: ADA14D71C106799ACB54EBA0EC91AEEB77ABF14300F10042EF512B7291EF345A09CF65

Function 0062F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006403A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 006403D3
Part of subcall function 006403A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 006403DB
Part of subcall function 006403A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006403E6
Part of subcall function 006403A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006403F1
Part of subcall function 006403A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 006403F9
Part of subcall function 006403A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00640401

Part of subcall function 00636259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0062FA90), ref: 006362B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0062FB2D
OleInitialize.OLE32(00000000), ref: 0062FBAA
CloseHandle.KERNEL32(00000000), ref: 006649F2

Strings

<gn, xrefs: 0062FA90
cn, xrefs: 0062F94B
\dn, xrefs: 0062F957
%k, xrefs: 0062F8F6, 0062F908, 0062FACE, 0062FBB1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <gn$\dn$%k$cn
API String ID: 1986988660-1507471717
Opcode ID: 7996d7bdfed47b884922c221ab3f0457ed09d2403d070d1949e91e8aeab86ca6
Instruction ID: bb3881c844c26755a5e8df7bcc967427e1337f19f702871319b40f72a0bfef4c
Opcode Fuzzy Hash: 7996d7bdfed47b884922c221ab3f0457ed09d2403d070d1949e91e8aeab86ca6
Instruction Fuzzy Hash: EE81ACB09013D0CEC784EF6AE9956557BE7EB78398710A13EB019CF2A1EB3154098F55

Function 01EC25D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01EC26A1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01EC28C7

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: 32c2391c38e65e1f0023f1d1f74039b3016b9eb19b40e14ae0b44ec512b5e305
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: 68A10975E0020AEBDB14CFA4CA94BEEBBB5FF48704F20955DE601BB280D7759A41CB54

Function 006239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00623A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00623A36
ShowWindow.USER32(00000000,?,?), ref: 00623A4A
ShowWindow.USER32(00000000,?,?), ref: 00623A53

Strings

AutoIt v3, xrefs: 00623A0D, 00623A12, 00623A13
edit, xrefs: 00623A30

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: af7e43a1f191a44ef4ea907605917b9b888a80523f46d53cebb713ec4b52fd36
Instruction ID: 3e5530b9a58fc66026365aa8075b7892a3f84c26d67ef5cefb9fe0f720f6ba7b
Opcode Fuzzy Hash: af7e43a1f191a44ef4ea907605917b9b888a80523f46d53cebb713ec4b52fd36
Instruction Fuzzy Hash: 62F030706003D07EEB301753AC88E773E7FD7D7FA0B001029BA00A61B0C1A51840CEB1

Function 01EC23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01EC22A0: Sleep.KERNELBASE(000001F4), ref: 01EC22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01EC24C3

Strings

8VJZB9KR6453XVDEO, xrefs: 01EC2526, 01EC2529

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: CreateFileSleep
String ID: 8VJZB9KR6453XVDEO
API String ID: 2694422964-389435106
Opcode ID: c0fbd86b574590b5ee660a8b9f84d7e863fd93bc44c327029640d5756fbe8cac
Instruction ID: 45b914a7c34155686eb0e3001735f09ce3959d1a5a843ef946eca32fbb3054d7
Opcode Fuzzy Hash: c0fbd86b574590b5ee660a8b9f84d7e863fd93bc44c327029640d5756fbe8cac
Instruction Fuzzy Hash: 31518F30D0424ADBEF15DBA4CD14BEFBB79AF18704F004199E609BB2C0D6B90B49CB66

Function 0062410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0065D5EC

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

_memset.LIBCMT ref: 0062418D
_wcscpy.LIBCMT ref: 006241E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006241F1

Strings

Line: , xrefs: 0065D615

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: f7333f9e64fc6c41b0096b638a2007321aa3f7eabe46fe6f9cde9629d1ad3ae1
Instruction ID: 216e956f36c2b920803b28c7bbff503ca761f44f30d891de5e6ba3ce7a271447
Opcode Fuzzy Hash: f7333f9e64fc6c41b0096b638a2007321aa3f7eabe46fe6f9cde9629d1ad3ae1
Instruction Fuzzy Hash: 8731C1710087649ED761EB60EC86FDB77EAAF54300F10491EB185961A1EF70A748CF97

Function 0064564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 006456AB
_memcpy_s.LIBCMT ref: 0064571D
__read_nolock.LIBCMT ref: 0064577B
__filbuf.LIBCMT ref: 0064579E
_memset.LIBCMT ref: 006457E2

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 796443faea8dc5d7818a43a0fb82a5020b810ca70a887d30a1c7e4ea766f8c87
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 1F519030A01B05DBDB249FA9C8806AE77A7AF41320F258739F826962E2D7709D558B44

Function 006269CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00624F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,006E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00624F6F

_free.LIBCMT ref: 0065E68C
_free.LIBCMT ref: 0065E6D3

Part of subcall function 00626BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00626D0D

Strings

Bad directive syntax error, xrefs: 0065E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0065E462

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 61e648b5c47eaf72ca828923805262633886b44a02c3bfcb7b52babc71f03948
Instruction ID: a5b78750d539d481067f99023741edb735c9470233f4bf9ab122b054ded4dd97
Opcode Fuzzy Hash: 61e648b5c47eaf72ca828923805262633886b44a02c3bfcb7b52babc71f03948
Instruction Fuzzy Hash: A0919F719106299FCF48EFA4D8919EDB7B6FF15300F14442EF815AB291EB319A09CF64

Function 006235B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,006235A1,SwapMouseButtons,00000004,?), ref: 006235D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,006235A1,SwapMouseButtons,00000004,?,?,?,?,00622754), ref: 006235F5
RegCloseKey.KERNELBASE(00000000,?,?,006235A1,SwapMouseButtons,00000004,?,?,?,?,00622754), ref: 00623617

Strings

Control Panel\Mouse, xrefs: 006235D2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: fc5f1fcb132bca16bad12ac881556eb961d392402bf4d1f4ba9d32e19fa31037
Instruction ID: 4b2f9c9a7873933a64a06338a8652e5240d6d838875a4134420fa81ebffb05ff
Opcode Fuzzy Hash: fc5f1fcb132bca16bad12ac881556eb961d392402bf4d1f4ba9d32e19fa31037
Instruction Fuzzy Hash: CC114871610628BFDB209FA4EC40AEEB7BEEF05740F015469E805D7310E371AE409B60

Function 01EC12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01EC1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01EC1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01EC1B13

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: ee81d2ad90b4bed67640dfa756895e1b13e7ba00c701dd9cbc978094fad2b1cb
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 6C621930A14258DBEB24CBA4CD40BDEB772EF58704F1091A9E20DEB391E7759E81CB59

Function 006897E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00625045: _fseek.LIBCMT ref: 0062505D

Part of subcall function 006899BE: _wcscmp.LIBCMT ref: 00689AAE
Part of subcall function 006899BE: _wcscmp.LIBCMT ref: 00689AC1

_free.LIBCMT ref: 0068992C
_free.LIBCMT ref: 00689933
_free.LIBCMT ref: 0068999E

Part of subcall function 00642F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00649C64), ref: 00642FA9
Part of subcall function 00642F95: GetLastError.KERNEL32(00000000,?,00649C64), ref: 00642FBB

_free.LIBCMT ref: 006899A6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction ID: 765537ab0cf664cc5d5216c4460ec2c39e57f3b39ee49d33162431be9f5a6a0c
Opcode Fuzzy Hash: c040f5d591410a8d3afab51092a26b6f5939c84b98243336257d617f1f09bfd3
Instruction Fuzzy Hash: D95172B1D04619AFDF649F64DC41AAEBBBAEF48300F1405AEF209A7241DB315E90CF58

Function 0064493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006449D0
__flush.LIBCMT ref: 006449F0
__write.LIBCMT ref: 00644A23
__flsbuf.LIBCMT ref: 00644A51

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: e46de704283f389da5bdce2e2246ecaf8a5244e27728834553701a2bf92bd016
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: FF41C471A006059BDB28CEA9C882BAF77A7EF80360B24817DE85587784DF70DD819B48

Function 00624DD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00624E1A

Strings

AU3!P/k, xrefs: 00624E14
EA06, xrefs: 0065DCF5

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/k$EA06
API String ID: 4104443479-947634993
Opcode ID: 824e637fedb401d9ad5f9212e54f3b427d516e04c6b7173ce479f7ad1ae462bd
Instruction ID: 894c744ddf08f5096d66fd4f804c31bff25e585811efbdd3e19fda6eff165732
Opcode Fuzzy Hash: 824e637fedb401d9ad5f9212e54f3b427d516e04c6b7173ce479f7ad1ae462bd
Instruction Fuzzy Hash: 81418C21A04E745BEF219B64EC517FE7FA7AF41340F194068ECC29B282DE319D858FA1

Function 006273E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0065EE62
GetOpenFileNameW.COMDLG32(?), ref: 0065EEAC

Part of subcall function 006248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006248A1,?,?,006237C0,?), ref: 006248CE

Part of subcall function 006409D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006409F4

Strings

X, xrefs: 0065EE7A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 24b1c5fd526606bb7fd250991bd4f8ae55ea4162d8ce2a35670f7626b9698aa9
Instruction ID: 50df8c0017672f510f53539e32d15c1b30f7da0dde45549f76a2d98a59e31115
Opcode Fuzzy Hash: 24b1c5fd526606bb7fd250991bd4f8ae55ea4162d8ce2a35670f7626b9698aa9
Instruction Fuzzy Hash: 8E21C671D106689BCF45DF94D845BEE7BFA9F49300F00441AF408E7381DBB45A898FA5

Function 0068901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00689036
__fread_nolock.LIBCMT ref: 0068904B

Strings

EA06, xrefs: 0068907D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: e7d157aa4257261df02cb4515d9789bc05b3e66965ee5343f48f4e693d261333
Instruction ID: 3999354e0636c14ae2ca577c39e323ab3aabff2fe1aebe128fb1869047e9f195
Opcode Fuzzy Hash: e7d157aa4257261df02cb4515d9789bc05b3e66965ee5343f48f4e693d261333
Instruction Fuzzy Hash: CD01F9718042186FDB28C6A8C816EFE7BF89B11301F00429EF553D2181E975A604CB60

Function 00689B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00689B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00689B99

Strings

aut, xrefs: 00689B93

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 687327fc7aeb3794374f96d444e79ab2f91bdcdf3d0dab16a1db6a0751fef771
Instruction ID: f172440a8a0d5deaf7127b854cfd0ffb467cd282095a4691fa92d5fcf8700d17
Opcode Fuzzy Hash: 687327fc7aeb3794374f96d444e79ab2f91bdcdf3d0dab16a1db6a0751fef771
Instruction Fuzzy Hash: F5D05E7994030DABDB10ABD0DC0EFDA776DE704701F0042A1BE94911A1DEB466988F92

Function 0069CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a1d51966e9d5da9aed78bdc8a89459bff246cea4f12666da1cb2f4121610f5
Instruction ID: 5899c4d7603fc0f3161d11427ca960f8647bb88016b6f06634675ea7bf9f5029
Opcode Fuzzy Hash: e0a1d51966e9d5da9aed78bdc8a89459bff246cea4f12666da1cb2f4121610f5
Instruction Fuzzy Hash: 9AF15D719087019FCB54DF28C485A6ABBEAFF88314F14892EF8999B351D731E945CF82

Function 006243DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00624401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 006244A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 006244C3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: b883e19f50dd6e0f39e361a942450e6abf0f4307c13bd35662bce0327e9a2de7
Instruction ID: b078b183ded5e333b1414087801dfd2951bd4c4346cfc6541f8392b8e4242c13
Opcode Fuzzy Hash: b883e19f50dd6e0f39e361a942450e6abf0f4307c13bd35662bce0327e9a2de7
Instruction Fuzzy Hash: 423181705047518FD720EF24E88479BBBE9FB59344F00092EF69A87351DB75AA48CF92

Function 0064594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00645963

Part of subcall function 0064A3AB: __NMSG_WRITE.LIBCMT ref: 0064A3D2
Part of subcall function 0064A3AB: __NMSG_WRITE.LIBCMT ref: 0064A3DC

__NMSG_WRITE.LIBCMT ref: 0064596A

Part of subcall function 0064A408: GetModuleFileNameW.KERNEL32(00000000,006E43BA,00000104,?,00000001,00000000), ref: 0064A49A
Part of subcall function 0064A408: ___crtMessageBoxW.LIBCMT ref: 0064A548

Part of subcall function 006432DF: ___crtCorExitProcess.LIBCMT ref: 006432E5
Part of subcall function 006432DF: ExitProcess.KERNEL32 ref: 006432EE

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

RtlAllocateHeap.NTDLL(011F0000,00000000,00000001,00000000,?,?,?,00641013,?), ref: 0064598F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 5aaef4bb1ad50fae3327757f32b630175e47e8f135bfe0b7532bc315c207d036
Instruction ID: 3e707a415265bbf5a8feb1589b43565354c6c6d0809eabf6c276f24610bd9ad5
Opcode Fuzzy Hash: 5aaef4bb1ad50fae3327757f32b630175e47e8f135bfe0b7532bc315c207d036
Instruction Fuzzy Hash: 3C01DE32241B95EFE7613B75E842AAE738B9F52770F10002EF502AB282DF709D018669

Function 00689B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,006897D2,?,?,?,?,?,00000004), ref: 00689B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,006897D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00689B5B
CloseHandle.KERNEL32(00000000,?,006897D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00689B62

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 984edd8c5cfcb4c7cdee43a64191c4dea6422ca9f85afe1b74265d5536eacb40
Instruction ID: d6e73b8dc1bfe3bb73f162948e4fc33a5b32c478d98d88e0f6827d83df354a12
Opcode Fuzzy Hash: 984edd8c5cfcb4c7cdee43a64191c4dea6422ca9f85afe1b74265d5536eacb40
Instruction Fuzzy Hash: 9AE08632280214BBDB313B94EC09FDA7B5AAB06761F144220FB54690E087B179119B99

Function 00688F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00688FA5

Part of subcall function 00642F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00649C64), ref: 00642FA9
Part of subcall function 00642F95: GetLastError.KERNEL32(00000000,?,00649C64), ref: 00642FBB

_free.LIBCMT ref: 00688FB6
_free.LIBCMT ref: 00688FC8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction ID: 90bd830bd0dceba243c70f9c6b87466d8eed754a851eff3a1fdc75781f92f270
Opcode Fuzzy Hash: 358057a8cee776a4634d1da6a11f7167cf7af4a4bc472a0de26b354d0d310ced
Instruction Fuzzy Hash: 4BE012A16097128ECBA4B978AD50AD35BEF5F483D07E8091DB509DB242DE24F8558628

Function 0062AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0066002B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: c43de786f4880b01d089428729d8058270ec04a50bd8a06d8eee35384bffc67a
Instruction ID: 1c840fe79e919f7eeb286968d62654283f33072c0aae1568cfb13274e9420db3
Opcode Fuzzy Hash: c43de786f4880b01d089428729d8058270ec04a50bd8a06d8eee35384bffc67a
Instruction Fuzzy Hash: 0E223770508661CFD724DF54D494A6ABBE2FF84300F15896DE8868B362D771ED86CF82

Function 0062492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00624992

Part of subcall function 006435AC: __lock.LIBCMT ref: 006435B2
Part of subcall function 006435AC: DecodePointer.KERNEL32(00000001,?,006249A7,006781BC), ref: 006435BE
Part of subcall function 006435AC: EncodePointer.KERNEL32(?,?,006249A7,006781BC), ref: 006435C9

Part of subcall function 00624A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00624A73
Part of subcall function 00624A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00624A88

Part of subcall function 00623B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00623B7A
Part of subcall function 00623B4C: IsDebuggerPresent.KERNEL32 ref: 00623B8C
Part of subcall function 00623B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,006E62F8,006E62E0,?,?), ref: 00623BFD
Part of subcall function 00623B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00623C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 006249D2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ec3491c9b377ced40d971db9b2051c8908d41cbcb8b7572fbd7d29ae1015063a
Instruction ID: 3b9358cf653f9f0df3a262adcb3db7cc8f453fa1559ca9e6d2c1ac6cd3490698
Opcode Fuzzy Hash: ec3491c9b377ced40d971db9b2051c8908d41cbcb8b7572fbd7d29ae1015063a
Instruction Fuzzy Hash: 92118C719083619FC700EF69EC8590ABFEAEB94750F00451EF5458B2B1DB709645CF96

Function 00625DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00625981,?,?,?,?), ref: 00625E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00625981,?,?,?,?), ref: 0065E19C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 82e71a53e4f47eb3ea9148a2d820ca69b74a38bb837536f7c0d87c3d188df6d2
Instruction ID: e9af98fbcd3abd52a97bdb6bc4589b07a278f6b7b320f25f72d926a0cbf10edd
Opcode Fuzzy Hash: 82e71a53e4f47eb3ea9148a2d820ca69b74a38bb837536f7c0d87c3d188df6d2
Instruction Fuzzy Hash: A701B970244B18BEF7341E14DC86FB637DDEB01768F108318BAE65A2E0C6B45E458F50

Function 00640FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0064594C: __FF_MSGBANNER.LIBCMT ref: 00645963
Part of subcall function 0064594C: __NMSG_WRITE.LIBCMT ref: 0064596A
Part of subcall function 0064594C: RtlAllocateHeap.NTDLL(011F0000,00000000,00000001,00000000,?,?,?,00641013,?), ref: 0064598F

std::exception::exception.LIBCMT ref: 0064102C
__CxxThrowException@8.LIBCMT ref: 00641041

Part of subcall function 006487DB: RaiseException.KERNEL32(?,?,?,006DBAF8,00000000,?,?,?,?,00641046,?,006DBAF8,?,00000001), ref: 00648830

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: ad782dfa3edc7df18b1a2d9c1be7c68e1bde08ea8722bbe3b20bbd60feb773a1
Instruction ID: 8a640efbcb1436be535114733047498eb8c6cbe16b2df871646ae4b89d4cce38
Opcode Fuzzy Hash: ad782dfa3edc7df18b1a2d9c1be7c68e1bde08ea8722bbe3b20bbd60feb773a1
Instruction Fuzzy Hash: 12F0A47550025DA6CB60BE58EC259DF7BEF9F02750F10042AF8049A692DFB18AD08298

Function 0064582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0064585C
__lock_file.LIBCMT ref: 0064587D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: f57d7ef24d560aab537a6f3498eac3088a6cb1f3289ed9f815160f726ed0d3a5
Instruction ID: 881636028c4d6ca3f1780ef8472b15208a7debd513359e81d29e7ee33201fc58
Opcode Fuzzy Hash: f57d7ef24d560aab537a6f3498eac3088a6cb1f3289ed9f815160f726ed0d3a5
Instruction Fuzzy Hash: 3601D431C00618EFCF62BF698C014CE7B63AF80360F048219F8141B2A2DF318A11DB95

Function 006455D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

__lock_file.LIBCMT ref: 0064561B

Part of subcall function 00646E4E: __lock.LIBCMT ref: 00646E71

__fclose_nolock.LIBCMT ref: 00645626

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: f21cfc1e9c249882f85c3b1c6eedab7a5256e18935a4df2bce50ef126903bfa4
Instruction ID: b78b62e7f0a2d20cff908d82cf9a3e53ec68d4e53e43f650a28ddc1719cec6ec
Opcode Fuzzy Hash: f21cfc1e9c249882f85c3b1c6eedab7a5256e18935a4df2bce50ef126903bfa4
Instruction Fuzzy Hash: 9FF0B471801B059FDBA0BF75880276E77E36F42734F56820EA416AB1D3CF7C89029B59

Function 01EC129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01EC1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01EC1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01EC1B13

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: ec8bb41ce755603dc681f53efba2b28ca3067dca36004aa1aaa4fbe4cc41b856
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 1612CE24E14658C6EB24DF64D8507DEB232EF68700F10A0ED910DEB7A5E77A4E81CF5A

Function 00632123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cafaf431e8c4d74b30d71c58c901922e8695aac35a8b851b2927c571acc246
Instruction ID: 9d25b3651c4779fc3a2d74d3c7a2ce074da970c21fcdb58ad8c211193b05d54a
Opcode Fuzzy Hash: 97cafaf431e8c4d74b30d71c58c901922e8695aac35a8b851b2927c571acc246
Instruction Fuzzy Hash: 28518234600A15AFCF54EB64D992EAE77A7AF85310F14816CF906AB392CF30ED01CB59

Function 00625C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00625CF6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 4712943b9f8d08d0f1d0b3e895ff27a969d2a52559c3b37364b5a7cb4155d9a7
Instruction ID: 0acf9d7c7b768876264420c2cd34de42401e269a8f17be094d9d7f5cf83846aa
Opcode Fuzzy Hash: 4712943b9f8d08d0f1d0b3e895ff27a969d2a52559c3b37364b5a7cb4155d9a7
Instruction Fuzzy Hash: A7315C71A00F29ABCB28DF29D48469DB7B6FF48310F148629D81A93710E731BD50DF95

Function 006600D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006600E1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 48051a7a38786622095d2fe58375fc718bee07438c9816777599353d91585e4d
Instruction ID: 66f41c52c23191bd635fcdf1239f31de582caee9cf3efdf49cc0a0daf24dc1c0
Opcode Fuzzy Hash: 48051a7a38786622095d2fe58375fc718bee07438c9816777599353d91585e4d
Instruction Fuzzy Hash: 01412474508751CFDB24DF54C484B5ABBE2BF45318F0988ACE8898B362C772E886CF52

Function 006279AB Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006279F9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction ID: 959b92ba410d83200a029b9355afbe01e0575d1431e521df2f05a5cb45022ba6
Opcode Fuzzy Hash: 64602025b210a69d44d795642d596fdfc93abb49ffaa1266944914acc7b2a18e
Instruction Fuzzy Hash: 9511E431209626AFD714DF28E881C6EB3AAEF45360724851EE815DB3A0DB32AC118B94

Function 00624F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00624D13: FreeLibrary.KERNEL32(00000000,?), ref: 00624D4D

Part of subcall function 0064548B: __wfsopen.LIBCMT ref: 00645496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,006E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00624F6F

Part of subcall function 00624CC8: FreeLibrary.KERNEL32(00000000), ref: 00624D02

Part of subcall function 00624DD0: _memmove.LIBCMT ref: 00624E1A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: d6bae24cf44a4519f17293f17586dcc36533b6f3fb913c42afea8aa56c4aca5a
Instruction ID: 78780230c171e067005537197f19b5cdee6f181c6758b176bbe9b519976b749d
Opcode Fuzzy Hash: d6bae24cf44a4519f17293f17586dcc36533b6f3fb913c42afea8aa56c4aca5a
Instruction Fuzzy Hash: CA11EB31600B25ABCB60BF74EC02BAD77A79F80701F10842DF541961C1DE715A059F65

Function 006601AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 006601BB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 484b34e08df7d19a6d67bdff322eae6350baabaa9118161d2f01c6d083b7074c
Instruction ID: 00a90603bb18d4981b2b4efdd18fae8e11c32eba83334bf7e2bb87254a0665f7
Opcode Fuzzy Hash: 484b34e08df7d19a6d67bdff322eae6350baabaa9118161d2f01c6d083b7074c
Instruction Fuzzy Hash: 1E215374508751CFCB24DF50D444A5ABBE2BF89304F05896CE88A4B321C731E886CFA3

Function 00625D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00625807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00625D76

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0b96ee6b16b3ddc425c530ce32f49ab8cafc2d0a9462572b90190c2cdd07081a
Instruction ID: 031fa5152379e7b548f30a11f20502295f4b715a89f05b71d3ea9fe3e5ceeb6b
Opcode Fuzzy Hash: 0b96ee6b16b3ddc425c530ce32f49ab8cafc2d0a9462572b90190c2cdd07081a
Instruction Fuzzy Hash: EB112835200F119FD3308F15E484BA2B7E6EF45750F10C92EE4AB86A50D770E945CF64

Function 00644A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00644AD6

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 927c9d17f70f3bb57bad6ca12b09cb0d10e26f140fd4bdfe49acf69c819f3830
Instruction ID: 7efd6b01dd4c5cf196547782fc979a08d9eb78cdf1fef68684a1b73afb352f1a
Opcode Fuzzy Hash: 927c9d17f70f3bb57bad6ca12b09cb0d10e26f140fd4bdfe49acf69c819f3830
Instruction Fuzzy Hash: 7DF0AF31940209AFDFA1AF64CC073DE36A3AF00325F058519B824AB2D5CF788A91EF59

Function 00624FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,006E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00624FDE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 68f0e42ab24fcb6b5bf4a8309113a0cb0f4a36799444ef4f18f7793598555811
Instruction ID: 8168628c3678dcb48458535c1f12c2369d5b2879ef674b46224e2828d833dbdf
Opcode Fuzzy Hash: 68f0e42ab24fcb6b5bf4a8309113a0cb0f4a36799444ef4f18f7793598555811
Instruction Fuzzy Hash: 07F03971105B22CFCB349F64E594862BBE2BF843293208A3EE1D782A10CB31A844DF40

Function 006409D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006409F4

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 6d127d237a6e34ced6c5044d25e236965cf00fd665eee2d5490e229b6635f73e
Instruction ID: b966aaf48a041ab929c2f961123adefc588f5d931bb0c5af4c093155048d6e31
Opcode Fuzzy Hash: 6d127d237a6e34ced6c5044d25e236965cf00fd665eee2d5490e229b6635f73e
Instruction Fuzzy Hash: E7E0CD3690522857C720E6989C05FFA77EEDFC9791F0401B5FC4CD7205D9A0AD818A95

Function 00689129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0068914B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 1db15d27ee06616c43d422e056546c702c6ea7e03d54480db0ad2c1fec8e6e91
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 9BE092B0118B005FD7349A24D8147E377E1AB06315F04091CF2EB83342EF6378418759

Function 00625DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0065E16B,?,?,00000000), ref: 00625DBF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e54caa023cbc0ffc7a32755d805f31654149e62f8247eb1a57cfe72f523b59ca
Instruction ID: 5aef83233dd8aa2055912dca56f174b9b680b2e171186e3d125df31d9dc81539
Opcode Fuzzy Hash: e54caa023cbc0ffc7a32755d805f31654149e62f8247eb1a57cfe72f523b59ca
Instruction Fuzzy Hash: 3ED0C77464020CBFE710DB80DC46FA977BDD705710F100194FD0456290D6B27D508B95

Function 0064548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00645496

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 126fe1666cbe3c7d14d820acbc5053d3efe81823d136888e512cb336dd9b7f96
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 56B0927684020C77DF412E82EC02A593B5A9B40778F808020FB0C1C162A673AAA09689

Function 0068D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0068D46A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 51d9c464a5c800a18d1e01ecfea588623f5b67f73144440cb41490260a67e4af
Instruction ID: 22f8193e99c128a3a953f1a6e3eccacbee50701aaee82ce5baed274b5d10950b
Opcode Fuzzy Hash: 51d9c464a5c800a18d1e01ecfea588623f5b67f73144440cb41490260a67e4af
Instruction Fuzzy Hash: 7E7153306047128FCB54EF24D491A6EB7E2AF88314F04466DF99697391DB30ED49CF66

Function 00640E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00640EF7

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: c5de99f0ef067f12105bc2f9b9b121b0f05637f8ed4660246ba1f565ec3b2b1c
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: BE31D371A00115EBE718DF58D4809A9F7A7FF99300B648AA5EA0ACB751D731EDD1CB80

Function 01EC229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01EC22B1

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 29a299e31701f28ec0bbc94218a3e1ab47499f60f01d85c3ec12f854aa5ad461
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 48E0BF7494020EEFDB00EFA8DA496DE7BB4EF04711F1005A5FD05D7681DB309E548A62

Function 01EC22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01EC22B1

Memory Dump Source

Source File: 00000000.00000002.2003220455.0000000001EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1ec0000_ss.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 885e0dd8a8d9698c7c6ea1c1ea0d2460f80b62a19a84bc89bf6d76854f9d7a51
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 8FE0E67494020EDFDB00EFB8DA4969E7FB4EF04701F100165FD01D2281D6309D508A72

Non-executed Functions

Function 006ACDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 006ACE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006ACE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 006ACED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006ACF00
SendMessageW.USER32 ref: 006ACF29
_wcsncpy.LIBCMT ref: 006ACFA1
GetKeyState.USER32(00000011), ref: 006ACFC2
GetKeyState.USER32(00000009), ref: 006ACFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006ACFE5
GetKeyState.USER32(00000010), ref: 006ACFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006AD018
SendMessageW.USER32 ref: 006AD03F
SendMessageW.USER32(?,00001030,?,006AB602), ref: 006AD145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 006AD15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 006AD16E
SetCapture.USER32(?), ref: 006AD177
ClientToScreen.USER32(?,?), ref: 006AD1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006AD1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006AD203
ReleaseCapture.USER32 ref: 006AD20E
GetCursorPos.USER32(?), ref: 006AD248
ScreenToClient.USER32(?,?), ref: 006AD255
SendMessageW.USER32(?,00001012,00000000,?), ref: 006AD2B1
SendMessageW.USER32 ref: 006AD2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 006AD31C
SendMessageW.USER32 ref: 006AD34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006AD36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 006AD37B
GetCursorPos.USER32(?), ref: 006AD39B
ScreenToClient.USER32(?,?), ref: 006AD3A8
GetParent.USER32(?), ref: 006AD3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 006AD431
SendMessageW.USER32 ref: 006AD462
ClientToScreen.USER32(?,?), ref: 006AD4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 006AD4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 006AD51A
SendMessageW.USER32 ref: 006AD53D
ClientToScreen.USER32(?,?), ref: 006AD58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 006AD5C3

Part of subcall function 006225DB: GetWindowLongW.USER32(?,000000EB), ref: 006225EC

GetWindowLongW.USER32(?,000000F0), ref: 006AD65F

Strings

F, xrefs: 006AD543
@GUI_DRAGID, xrefs: 006AD1AA
prn, xrefs: 006AD1BD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$prn
API String ID: 3977979337-3802375623
Opcode ID: 8fe9678727aa5ea77bc968d874033c03297f481938289044d99764555a1214ab
Instruction ID: f3be10944a8387a784906cbb591112a5575e41428e905faf9d0ffc03d8b74f22
Opcode Fuzzy Hash: 8fe9678727aa5ea77bc968d874033c03297f481938289044d99764555a1214ab
Instruction Fuzzy Hash: 6E427C30204341EFD725EF68C884AAABBE6FF4A364F14151DF696872A1C731AC51CF92

Function 006A804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 006A873F

Strings

%d/%02d/%02d, xrefs: 006A8478

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: cd8fd49134e183b6a4988207ca0e9b396015021f91114263f5112e8cbb439c15
Instruction ID: e15c69c8c4907ecd63480543ebdc5401e675520bd2265cb1f264693b1439d78d
Opcode Fuzzy Hash: cd8fd49134e183b6a4988207ca0e9b396015021f91114263f5112e8cbb439c15
Instruction Fuzzy Hash: CA12BE71500214AFEB25AF64CC49FAE7BBAEF8A710F244129F915EB2A1DB709D41CF50

Function 0063710E Relevance: 52.3, APIs: 19, Strings: 8, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006375C2
_memset.LIBCMT ref: 006376B1
_memmove.LIBCMT ref: 00637C4B
_memmove.LIBCMT ref: 00637E4F

Strings

\b(?=\w), xrefs: 00673C34
Oac, xrefs: 0067287E
Q\E, xrefs: 006381C1
DEFINE, xrefs: 006725AF
[:>:]], xrefs: 0063760A
[:<:]], xrefs: 006375F1
\b(?<=\w), xrefs: 00673C41
0wm, xrefs: 00671F5B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove$_memset
String ID: 0wm$DEFINE$Oac$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-261310638
Opcode ID: b97c2cbe8ed1e6d2616e6bb923af12f94eef5d5ad65cb5c9d5fc21fe80f44306
Instruction ID: 58caa4d147c838421bce4a33c846d29864c8dd3a9b22f81ca364b57bf3655bcc
Opcode Fuzzy Hash: b97c2cbe8ed1e6d2616e6bb923af12f94eef5d5ad65cb5c9d5fc21fe80f44306
Instruction Fuzzy Hash: 41939471A00216DFDB24CF58C8917EDB7B2FF48710F25816AE959AB381E7709E81DB90

Function 00624A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00624A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0065DA8E
IsIconic.USER32(?), ref: 0065DA97
ShowWindow.USER32(?,00000009), ref: 0065DAA4
SetForegroundWindow.USER32(?), ref: 0065DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0065DAC4
GetCurrentThreadId.KERNEL32 ref: 0065DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0065DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0065DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0065DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0065DAF8
SetForegroundWindow.USER32(?), ref: 0065DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0065DB10
keybd_event.USER32(00000012,00000000), ref: 0065DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0065DB25
keybd_event.USER32(00000012,00000000), ref: 0065DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0065DB33
keybd_event.USER32(00000012,00000000), ref: 0065DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0065DB42
keybd_event.USER32(00000012,00000000), ref: 0065DB47
SetForegroundWindow.USER32(?), ref: 0065DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0065DB71

Strings

Shell_TrayWnd, xrefs: 0065DA89

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5d5c0677efe059cda06f6842e4658f1f582d3dbeb611319de250b036e3afdc7c
Instruction ID: 7ba12d964978c2250ecbc26e0c9e60bd4180cb34944bbcc7d131243da65850e1
Opcode Fuzzy Hash: 5d5c0677efe059cda06f6842e4658f1f582d3dbeb611319de250b036e3afdc7c
Instruction Fuzzy Hash: 75316071A40318BAEB306FA19C49FBF3E6EEB45B51F115025FA04AA1D0D6B06901AFA1

Function 00678858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00678CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00678D0D
Part of subcall function 00678CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00678D3A
Part of subcall function 00678CC3: GetLastError.KERNEL32 ref: 00678D47

_memset.LIBCMT ref: 0067889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 006788ED
CloseHandle.KERNEL32(?), ref: 006788FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00678915
GetProcessWindowStation.USER32 ref: 0067892E
SetProcessWindowStation.USER32(00000000), ref: 00678938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00678952

Part of subcall function 00678713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00678851), ref: 00678728
Part of subcall function 00678713: CloseHandle.KERNEL32(?,?,00678851), ref: 0067873A

Strings

, xrefs: 006788AA
default, xrefs: 0067894D
winsta0, xrefs: 00678910

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 8bb879156da23d13abeb2c299af909166bc8a95f81c4dde6c16539126f8e3c74
Instruction ID: 5f0a9faa552cbb2b1a0cbddf2b60d4d97f8160d67b0d60b941d3e48d41269cec
Opcode Fuzzy Hash: 8bb879156da23d13abeb2c299af909166bc8a95f81c4dde6c16539126f8e3c74
Instruction Fuzzy Hash: 0F816D71940249AFDF11DFA4DC49AEE7BBAEF04304F18812AF918A7261DB319E14DB61

Function 0069425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(006AF910), ref: 00694284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00694292
GetClipboardData.USER32(0000000D), ref: 0069429A
CloseClipboard.USER32 ref: 006942A6
GlobalLock.KERNEL32(00000000), ref: 006942C2
CloseClipboard.USER32 ref: 006942CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 006942E1
IsClipboardFormatAvailable.USER32(00000001), ref: 006942EE
GetClipboardData.USER32(00000001), ref: 006942F6
GlobalLock.KERNEL32(00000000), ref: 00694303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00694337
CloseClipboard.USER32 ref: 00694447

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 4888cfd9302308d9a07c54109206376bb377c711dada9d0565bbb17d63f4f56c
Instruction ID: 15a6889e8802f93a4db3a5c77c66bbfdef52a8d4333aa59670bfcb74e112a979
Opcode Fuzzy Hash: 4888cfd9302308d9a07c54109206376bb377c711dada9d0565bbb17d63f4f56c
Instruction Fuzzy Hash: 84519131204701ABDB10BFA0EC86F6E77AEAF85B01F10552DF556D21A1DF70E9068F66

Function 0068C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0068C9F8
FindClose.KERNEL32(00000000), ref: 0068CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0068CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0068CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0068CAAF
__swprintf.LIBCMT ref: 0068CAFB
__swprintf.LIBCMT ref: 0068CB3E

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

__swprintf.LIBCMT ref: 0068CB92

Part of subcall function 006438D8: __woutput_l.LIBCMT ref: 00643931

__swprintf.LIBCMT ref: 0068CBE0

Part of subcall function 006438D8: __flsbuf.LIBCMT ref: 00643953
Part of subcall function 006438D8: __flsbuf.LIBCMT ref: 0064396B

__swprintf.LIBCMT ref: 0068CC2F
__swprintf.LIBCMT ref: 0068CC7E
__swprintf.LIBCMT ref: 0068CCCD

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0068CAF5
%4d, xrefs: 0068CB38
%02d, xrefs: 0068CB86, 0068CB90, 0068CBDE, 0068CC2D, 0068CC7C, 0068CCCB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: ff60145f985fcc3e2eb15f0ca82594cf8d22f4a6270e2ad8c372097842af9d52
Instruction ID: 916e3079c826c004b1c97d6c21128b305c0d509971a937198ae232be0867d16c
Opcode Fuzzy Hash: ff60145f985fcc3e2eb15f0ca82594cf8d22f4a6270e2ad8c372097842af9d52
Instruction Fuzzy Hash: 6FA15FB1408714ABC750FBA4D986DAFB7EEEF94700F40491EF586D2191EA34DA08CB66

Function 0068F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 0068F221
_wcscmp.LIBCMT ref: 0068F236
_wcscmp.LIBCMT ref: 0068F24D
GetFileAttributesW.KERNEL32(?), ref: 0068F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0068F279
FindNextFileW.KERNEL32(00000000,?), ref: 0068F291
FindClose.KERNEL32(00000000), ref: 0068F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0068F2B8
_wcscmp.LIBCMT ref: 0068F2DF
_wcscmp.LIBCMT ref: 0068F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0068F308
SetCurrentDirectoryW.KERNEL32(006DA5A0), ref: 0068F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0068F330
FindClose.KERNEL32(00000000), ref: 0068F33D
FindClose.KERNEL32(00000000), ref: 0068F34F

Strings

*.*, xrefs: 0068F2B3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 320b031a41f2767d21c2e6d22cfce408b8b6d8125d19d384083b18c09eb0d7ef
Instruction ID: 78ad512f895e6debf78e2450adc64d37b061e95166cc9d01476592b4edc32d57
Opcode Fuzzy Hash: 320b031a41f2767d21c2e6d22cfce408b8b6d8125d19d384083b18c09eb0d7ef
Instruction Fuzzy Hash: 0731B3765002196BDB10FBF4EC58ADE77AEAF09361F100276E840D3290EB71EE458FA5

Function 006A0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006A0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,006AF910,00000000,?,00000000,?,?), ref: 006A0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 006A0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 006A0D1D
RegCloseKey.ADVAPI32(?), ref: 006A103D
RegCloseKey.ADVAPI32(00000000), ref: 006A104A

Strings

REG_BINARY, xrefs: 006A0FD8
REG_EXPAND_SZ, xrefs: 006A0CBA
REG_DWORD, xrefs: 006A0F0E
REG_MULTI_SZ, xrefs: 006A0E05
REG_SZ, xrefs: 006A0D5B
REG_QWORD, xrefs: 006A0F8B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 60e3713c04e5a1c64b3bd8fd7931d8aba5c47541f43e7c285bbe12b04c67d5ac
Instruction ID: 836b21a02dc3fffeb3ba3f40c070a3490b43ed9ad868d588701b01ed36faf047
Opcode Fuzzy Hash: 60e3713c04e5a1c64b3bd8fd7931d8aba5c47541f43e7c285bbe12b04c67d5ac
Instruction Fuzzy Hash: AA0257356006119FDB54EF24D891E2AB7E6EF89724F04885DF88A9B362CB31EC41CF95

Function 0068F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 0068F37E
_wcscmp.LIBCMT ref: 0068F393
_wcscmp.LIBCMT ref: 0068F3AA

Part of subcall function 006845C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006845DC

FindNextFileW.KERNEL32(00000000,?), ref: 0068F3D9
FindClose.KERNEL32(00000000), ref: 0068F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0068F400
_wcscmp.LIBCMT ref: 0068F427
_wcscmp.LIBCMT ref: 0068F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0068F450
SetCurrentDirectoryW.KERNEL32(006DA5A0), ref: 0068F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0068F478
FindClose.KERNEL32(00000000), ref: 0068F485
FindClose.KERNEL32(00000000), ref: 0068F497

Strings

*.*, xrefs: 0068F3FB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 890530b190aaffcef33628512f278b5c6b84f58d90a8d82d069d9bb3e78d0ba4
Instruction ID: fa0f6971e8cf4e9639fea5931bc38c90c38ea5901fd146faa16a9cb6b0e426c2
Opcode Fuzzy Hash: 890530b190aaffcef33628512f278b5c6b84f58d90a8d82d069d9bb3e78d0ba4
Instruction Fuzzy Hash: 0C31B7715011196BCF10BBA4EC84ADE77EE9F49360F100376E850A32A1DB70DE45CFA5

Function 006781F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0067874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00678766
Part of subcall function 0067874A: GetLastError.KERNEL32(?,0067822A,?,?,?), ref: 00678770
Part of subcall function 0067874A: GetProcessHeap.KERNEL32(00000008,?,?,0067822A,?,?,?), ref: 0067877F
Part of subcall function 0067874A: HeapAlloc.KERNEL32(00000000,?,0067822A,?,?,?), ref: 00678786
Part of subcall function 0067874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0067879D

Part of subcall function 006787E7: GetProcessHeap.KERNEL32(00000008,00678240,00000000,00000000,?,00678240,?), ref: 006787F3
Part of subcall function 006787E7: HeapAlloc.KERNEL32(00000000,?,00678240,?), ref: 006787FA
Part of subcall function 006787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00678240,?), ref: 0067880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0067825B
_memset.LIBCMT ref: 00678270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0067828F
GetLengthSid.ADVAPI32(?), ref: 006782A0
GetAce.ADVAPI32(?,00000000,?), ref: 006782DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006782F9
GetLengthSid.ADVAPI32(?), ref: 00678316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00678325
HeapAlloc.KERNEL32(00000000), ref: 0067832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0067834D
CopySid.ADVAPI32(00000000), ref: 00678354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00678385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006783AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006783BF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: acf473918f453581bf34993f6e78a24a753ff784c4f34f70ea8aa9fe9fbf3b0b
Instruction ID: 834e8adb88c9c2e72f321324c60731931e4e5e736525d034ca735e9b028e9b52
Opcode Fuzzy Hash: acf473918f453581bf34993f6e78a24a753ff784c4f34f70ea8aa9fe9fbf3b0b
Instruction Fuzzy Hash: DD612A71940219EFDF109F94DC48AEEBBBAFF05710B148269F819A7291DB359E05CF60

Function 00636843 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

Oac, xrefs: 00671888, 0067192F, 006719DD
CRLF), xrefs: 006716FA
PJl, xrefs: 006368B3
UTF), xrefs: 00671533
CR), xrefs: 006716C0
ANYCRLF), xrefs: 00671734
ANY), xrefs: 00671717
LIMIT_MATCH=, xrefs: 006715A9
LF), xrefs: 006716DD
UCP), xrefs: 00671546
UTF16), xrefs: 00671508
NO_START_OPT), xrefs: 00671588
BSR_ANYCRLF), xrefs: 00671757
LIMIT_RECURSION=, xrefs: 00671635
BSR_UNICODE), xrefs: 00671771
NO_AUTO_POSSESS), xrefs: 00671567

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oac$PJl$UCP)$UTF)$UTF16)
API String ID: 0-3239182561
Opcode ID: a8294f2ab482824a260511882bdaec6f93567423d50acb7071e9519c2d3349ee
Instruction ID: 809d628c56a982d3a5bd69e974260a9a80890f8378f0a7de068c2d99a6a7de30
Opcode Fuzzy Hash: a8294f2ab482824a260511882bdaec6f93567423d50acb7071e9519c2d3349ee
Instruction Fuzzy Hash: 0F725E75E002199BDB24CF59C8907EEB7B6EF49710F14816AE949EB390EB709D81CB90

Function 006A0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006A0038,?,?), ref: 006A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006A0737

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 006A07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006A086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 006A0AAD
RegCloseKey.ADVAPI32(00000000), ref: 006A0ABA

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 19b5f84029391bf449ad65a21a682de57ce45add12b3d4f9505191008336ff0a
Instruction ID: 1d0acd46db280b03178d3a9ec45f9b28e62f3e9e7747073b258d8e8dd1baec8d
Opcode Fuzzy Hash: 19b5f84029391bf449ad65a21a682de57ce45add12b3d4f9505191008336ff0a
Instruction Fuzzy Hash: BDE16F31604310AFDB54EF28C891D6ABBE6EF89714F04856DF54ADB262DA31ED01CF51

Function 00680219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00680241
GetAsyncKeyState.USER32(000000A0), ref: 006802C2
GetKeyState.USER32(000000A0), ref: 006802DD
GetAsyncKeyState.USER32(000000A1), ref: 006802F7
GetKeyState.USER32(000000A1), ref: 0068030C
GetAsyncKeyState.USER32(00000011), ref: 00680324
GetKeyState.USER32(00000011), ref: 00680336
GetAsyncKeyState.USER32(00000012), ref: 0068034E
GetKeyState.USER32(00000012), ref: 00680360
GetAsyncKeyState.USER32(0000005B), ref: 00680378
GetKeyState.USER32(0000005B), ref: 0068038A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 403e061dc7c655cdd2f68f4e8b8326c3025775570df6fa793576fc5171272238
Instruction ID: 73ecea21d654cfc9aa1c0133053d62583b6bc756fdf5959a9d0900b25e7dadcd
Opcode Fuzzy Hash: 403e061dc7c655cdd2f68f4e8b8326c3025775570df6fa793576fc5171272238
Instruction Fuzzy Hash: F64187349047CA6FFFB1BBA488183E5BAA26F22340F184A9DD5C5563C2D7D45ACC8792

Function 00694458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0069447F
EmptyClipboard.USER32 ref: 00694485
GlobalAlloc.KERNEL32(00000002,?), ref: 0069449A
CloseClipboard.USER32 ref: 00694539

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ad70dc84da74f4a29cf199a1fd70bf9cc3a59e8b2c5d4cfef7fde2aff67dddb6
Instruction ID: bd19bf7dcf4b5133dcadfb41f78f1c222db4fd18338cf38df71cd63c734de0a6
Opcode Fuzzy Hash: ad70dc84da74f4a29cf199a1fd70bf9cc3a59e8b2c5d4cfef7fde2aff67dddb6
Instruction Fuzzy Hash: 192180356006209FDB10AFA0EC49F697BAAEF45711F14901AF946DB261DB30BD02CF59

Function 00683A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006248A1,?,?,006237C0,?), ref: 006248CE

Part of subcall function 00684CD3: GetFileAttributesW.KERNEL32(?,00683947), ref: 00684CD4

FindFirstFileW.KERNEL32(?,?), ref: 00683ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00683B87
MoveFileW.KERNEL32(?,?), ref: 00683B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00683BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00683BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00683BF5

Strings

\*.*, xrefs: 00683A8A, 00683A93, 00683AA8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: e181c5f62003bc8ce25011d3599777451ed94dac8cddae5a1cae65c913724330
Instruction ID: aac20ee85e261e0f61f34790dd6e40f0c762a4212fa4010177edb2b6e4cd95bf
Opcode Fuzzy Hash: e181c5f62003bc8ce25011d3599777451ed94dac8cddae5a1cae65c913724330
Instruction Fuzzy Hash: E6517D318016699ACF55FBA0D9929EDB77AAF14300F244269E44277291EF306F09CFA4

Function 00634140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

Oac, xrefs: 00634984, 00668173
VUUU, xrefs: 00634520
VUUU, xrefs: 00667B0C
VUUU, xrefs: 006344DB
ERCP, xrefs: 0063421F
VUUU, xrefs: 006344ED

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: ERCP$Oac$VUUU$VUUU$VUUU$VUUU
API String ID: 0-600082611
Opcode ID: c0026eac12160585abec7710b8de897e42de589557b5c3634ba2dd907aee1b53
Instruction ID: d7c6a79bf2d24ab72a702b93d9db77a4cc872e5e55914618e90162e0ef7d2638
Opcode Fuzzy Hash: c0026eac12160585abec7710b8de897e42de589557b5c3634ba2dd907aee1b53
Instruction Fuzzy Hash: B5A25D70E0421A8BDF24CF58C9907EDF7B2BF55314F1486AAD856A7380DB74AE85CB90

Function 0068F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0068F6AB
Sleep.KERNEL32(0000000A), ref: 0068F6DB
_wcscmp.LIBCMT ref: 0068F6EF
_wcscmp.LIBCMT ref: 0068F70A
FindNextFileW.KERNEL32(?,?), ref: 0068F7A8
FindClose.KERNEL32(00000000), ref: 0068F7BE

Strings

*.*, xrefs: 0068F690

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: db2056181cd549f6dceb8c960c415bafab29ce12a24b2bbda86f245a7a0a239c
Instruction ID: cb19c19b2f258876b876adf854b8049287ece437d78dd2b27357e51e3ff455e6
Opcode Fuzzy Hash: db2056181cd549f6dceb8c960c415bafab29ce12a24b2bbda86f245a7a0a239c
Instruction Fuzzy Hash: 0441917190021A9FDF50EFA4DC45AEEBBB6FF05310F14466AE815A3290EB309E44CFA4

Function 006358C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00635A05
_memmove.LIBCMT ref: 00635A55
_memmove.LIBCMT ref: 00635ABB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 2bd7d1abbeb11a049cf0093ddbfe225a5c1cb999c708d9f01b550fd0f9a2663e
Instruction ID: ed871253ee992cd4c75dcf378d9d2ce6edf9f7dc7cd27d5ae18a2d89dac309ca
Opcode Fuzzy Hash: 2bd7d1abbeb11a049cf0093ddbfe225a5c1cb999c708d9f01b550fd0f9a2663e
Instruction Fuzzy Hash: A0128E70A00A19DFDF14DFA4D985AEEB7F6FF48300F108569E406A7291EB35AD11CBA4

Function 00635680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00640FF6: std::exception::exception.LIBCMT ref: 0064102C
Part of subcall function 00640FF6: __CxxThrowException@8.LIBCMT ref: 00641041

_memmove.LIBCMT ref: 0067062F
_memmove.LIBCMT ref: 00670744
_memmove.LIBCMT ref: 006707EB

Strings

yZc, xrefs: 00670881, 006707FF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZc
API String ID: 1300846289-814616561
Opcode ID: 4b4e7bb613604015fc97cc12bab1ec30dafcd2f9546720d843daec7836d15d36
Instruction ID: cdda8c0e440d41e342a030945dd7e3aab8c6c624d36d1957e84c38c2d27560b2
Opcode Fuzzy Hash: 4b4e7bb613604015fc97cc12bab1ec30dafcd2f9546720d843daec7836d15d36
Instruction Fuzzy Hash: 4A02A0B0E00619DFDF44DF64D981AAEBBB6EF44300F148069E80ADB395EB31D951CBA5

Function 0068545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00678CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00678D0D
Part of subcall function 00678CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00678D3A
Part of subcall function 00678CC3: GetLastError.KERNEL32 ref: 00678D47

ExitWindowsEx.USER32(?,00000000), ref: 0068549B

Strings

@, xrefs: 0068548E
, xrefs: 00685489
SeShutdownPrivilege, xrefs: 0068546B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 4fc6870d78378d751b8a03fbbd99c5ca3cef1b85fe0135353fe3a166110dddf3
Instruction ID: 45d49c4cbf4a1d01962d2ee482498e4ba6705fa52c6c82cae4d7b83100fdd681
Opcode Fuzzy Hash: 4fc6870d78378d751b8a03fbbd99c5ca3cef1b85fe0135353fe3a166110dddf3
Instruction Fuzzy Hash: D6012431A94A112AE76873B89C4ABFA729AAB01742F200335FC07E22C2DA601C848395

Function 00633190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oac, xrefs: 00633482

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oac
API String ID: 674341424-752515563
Opcode ID: 06076a6420138a05d7f1b9572a8f5f42498961572ad58841ea459d9d00115c7e
Instruction ID: 3d5df8df8b223ba4d03d0046d30de0d300722fd09047d248c1538dc5999f0541
Opcode Fuzzy Hash: 06076a6420138a05d7f1b9572a8f5f42498961572ad58841ea459d9d00115c7e
Instruction Fuzzy Hash: B922BC716083119FD760DF24C891BAFB7E6AF84714F00891DF88A97391DB30EA45CB96

Function 00696596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 006965EF
WSAGetLastError.WSOCK32(00000000), ref: 006965FE
bind.WSOCK32(00000000,?,00000010), ref: 0069661A
listen.WSOCK32(00000000,00000005), ref: 00696629
WSAGetLastError.WSOCK32(00000000), ref: 00696643
closesocket.WSOCK32(00000000), ref: 00696657

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 23c51119ef66ca8f6fca4ed61c28c4802b67cdda5b2cf6a46bec3145a32613a8
Instruction ID: ad0da5d92464fce17e173bdedbb9603e737422b70649ffd7c0a79cd033df9356
Opcode Fuzzy Hash: 23c51119ef66ca8f6fca4ed61c28c4802b67cdda5b2cf6a46bec3145a32613a8
Instruction Fuzzy Hash: C5219C306006109FDF10AF64D889A6EB7BAEF49720F14816DF95AE73D1CB70AD01CB66

Function 00621287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

DefDlgProcW.USER32(?,?,?,?,?), ref: 006219FA
GetSysColor.USER32(0000000F), ref: 00621A4E
SetBkColor.GDI32(?,00000000), ref: 00621A61

Part of subcall function 00621290: DefDlgProcW.USER32(?,00000020,?), ref: 006212D8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: c184b44729d9b0bdf301a314e7ce5371cd751a538556758920a082b9111a759a
Instruction ID: 7dd92563720663fef9a0b07e4e4f2ff3d056cc15be84ec3c48ea383d0e882ea3
Opcode Fuzzy Hash: c184b44729d9b0bdf301a314e7ce5371cd751a538556758920a082b9111a759a
Instruction Fuzzy Hash: 47A16A70109DA4BAD738AB28AC55EFF255FDB63392F14010DF802DD291CE129D429EBA

Function 00696A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006980A0: inet_addr.WSOCK32(00000000), ref: 006980CB

socket.WSOCK32(00000002,00000002,00000011), ref: 00696AB1
WSAGetLastError.WSOCK32(00000000), ref: 00696ADA
bind.WSOCK32(00000000,?,00000010), ref: 00696B13
WSAGetLastError.WSOCK32(00000000), ref: 00696B20
closesocket.WSOCK32(00000000), ref: 00696B34

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: d70d0146a00056a365824f144b26e3a8516d3ef56b231e3776103cca862785fa
Instruction ID: 5980af3c8d941c2059e17db81bf4feea3d2d9b5e737826613d07f407673b98af
Opcode Fuzzy Hash: d70d0146a00056a365824f144b26e3a8516d3ef56b231e3776103cca862785fa
Instruction Fuzzy Hash: 1E41B875B007209FEB50BF64EC86F6E77AA9B45720F04805CF95AAB3C2DA705D018B65

Function 006A55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 006A564C
IsWindowEnabled.USER32 ref: 006A565A
GetForegroundWindow.USER32(?,?,00000001), ref: 006A5667
IsIconic.USER32 ref: 006A5675
IsZoomed.USER32 ref: 006A5683

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: be49ddaa520a370df366ab498f7d1e8e12af782e62959ab76cafeee86acf569f
Instruction ID: f6fa8269d32b169700089b781a19857d21ff23694865ad7db616ccb7231a6981
Opcode Fuzzy Hash: be49ddaa520a370df366ab498f7d1e8e12af782e62959ab76cafeee86acf569f
Instruction Fuzzy Hash: 0811C831B00A206FD721BF66DC44A6F779BEF56721B446029F447D7251CB70ED018EA5

Function 0068C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0068C69D
CoCreateInstance.OLE32(006B2D6C,00000000,00000001,006B2BDC,?), ref: 0068C6B5

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

CoUninitialize.OLE32 ref: 0068C922

Strings

.lnk, xrefs: 0068C631, 0068C659, 0068C663

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 910b211b34537b9e7b0fbabbe3285c3c3cf455a9c58952bdceaeb120cff21264
Instruction ID: 6f6b0dd40eb5e89157f376693f4e436f258a4e986420fd01a76c7b2771fe7cb6
Opcode Fuzzy Hash: 910b211b34537b9e7b0fbabbe3285c3c3cf455a9c58952bdceaeb120cff21264
Instruction Fuzzy Hash: F9A16A71108715AFD740EF54D892EABB7E9EF94304F00491CF196971A2EB70EA09CF66

Function 0069C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00661D88,?), ref: 0069C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0069C324

Strings

kernel32.dll, xrefs: 0069C30D
GetSystemWow64DirectoryW, xrefs: 0069C31E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: b153108118aeb41b2419bf1c290f027d7bf2282df3f03ec9e73eaf4b8b220707
Instruction ID: 1c1906e39962db70979077478d31aa10fdb7c396dbc5bf335e9d553c06608ada
Opcode Fuzzy Hash: b153108118aeb41b2419bf1c290f027d7bf2282df3f03ec9e73eaf4b8b220707
Instruction Fuzzy Hash: 2FE08C70600703CFDF206F65C814A8676EAEB09765B809439E895C2710E770E841CBA0

Function 0069F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0069F151
Process32FirstW.KERNEL32(00000000,?), ref: 0069F15F

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Process32NextW.KERNEL32(00000000,?), ref: 0069F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0069F22E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: bfcb48492e25e714991913afca575629317a3c0bca600812b988cfb1264b9388
Instruction ID: 30e9fb436e4fc92022ca2be840f08a67a0c1f7adb77cae54df22344537bbe020
Opcode Fuzzy Hash: bfcb48492e25e714991913afca575629317a3c0bca600812b988cfb1264b9388
Instruction Fuzzy Hash: 89519E715047119FD750EF24EC82E6BB7EAFF88710F14482DF49697291EB70AA08CB96

Function 0067EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0067EB19

Strings

|, xrefs: 0067EB49
(, xrefs: 0067EB5F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 7be84d31c226a25b5bfcdf04f25099c2fe467ce4d7c577fe5ab0bf50e80e2595
Instruction ID: 4604e0eb13f43f38f55815e8b77c954f3a70890e6bc18597f2271e45b89e4890
Opcode Fuzzy Hash: 7be84d31c226a25b5bfcdf04f25099c2fe467ce4d7c577fe5ab0bf50e80e2595
Instruction Fuzzy Hash: F0324775A007059FD728CF29C4819AAB7F2FF48710B15C5AEE89ADB3A1E770E941CB44

Function 006925E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 006926D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0069270C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 7fc0975c788ad4d59cf0b6e3ecde115ad9de189c6b62a058f776d1577cd86a90
Instruction ID: ac8e10845c3bcb82bf5e0fed2558c502fe92c207577597bc9401fccb08a6f92d
Opcode Fuzzy Hash: 7fc0975c788ad4d59cf0b6e3ecde115ad9de189c6b62a058f776d1577cd86a90
Instruction Fuzzy Hash: 8041D67550420ABFEF20DF94DC95EFBB7FEEB40714F10406EF601AAA40EA71AE419664

Function 0068B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0068B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0068B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0068B655

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a8529d01cc9abec94d9327392e4e19c5088aedd60b47c55e0237e704d1cadc3b
Instruction ID: 9ab07dc85f5759b58eb328f0ef2998a67783abbf05d87d0610f675ee1c29bd77
Opcode Fuzzy Hash: a8529d01cc9abec94d9327392e4e19c5088aedd60b47c55e0237e704d1cadc3b
Instruction Fuzzy Hash: AC219035A00618EFCB00EFA5D881EADBBB9FF89310F0480A9E805AB351DB31A945CF55

Function 00678CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00640FF6: std::exception::exception.LIBCMT ref: 0064102C
Part of subcall function 00640FF6: __CxxThrowException@8.LIBCMT ref: 00641041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00678D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00678D3A
GetLastError.KERNEL32 ref: 00678D47

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: b1aadf8570df05041d7b9d946e4c8ea46936eaa06cf4dc329c510dd08394e63c
Instruction ID: ff584e7043d73de80b9ce62746fe858a8a4429202db3d0d1eacceddf20f236ad
Opcode Fuzzy Hash: b1aadf8570df05041d7b9d946e4c8ea46936eaa06cf4dc329c510dd08394e63c
Instruction Fuzzy Hash: 761182B1414209AFE728EF64DC85D6BB7BEEF44711B10852EF45597241DB30BC418A64

Function 00684021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0068404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00684088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00684091

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: a607be82088e7902060537c94925b3cf93544ef3898886d223614c0d0120f051
Instruction ID: 5fe8919d668dc3882b2d696828171f421a7e0f503c24c0c419810f0ae5fe0019
Opcode Fuzzy Hash: a607be82088e7902060537c94925b3cf93544ef3898886d223614c0d0120f051
Instruction Fuzzy Hash: 071186B1D00229BEE710EBE8DC44FAFBBBDEB09710F000656BA04E7190C6745D0547E1

Function 00684C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00684C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00684C43
FreeSid.ADVAPI32(?), ref: 00684C53

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 22efc697dd797eb4ea8c907821d7c49fae9a281ffd72cac6305375a69a442b0d
Instruction ID: 4add5b5fa732cf0c9ec5ec2efc59275e0801fb0bb0b8a977f5a55b3c7da7d24c
Opcode Fuzzy Hash: 22efc697dd797eb4ea8c907821d7c49fae9a281ffd72cac6305375a69a442b0d
Instruction Fuzzy Hash: 1DF04975A1130DBFDF04EFF0DC99AAEBBBDEF08201F0044A9A901E2281E6706A448B51

Function 00688B13 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00688B25

Part of subcall function 0064543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,006891F8,00000000,?,?,?,?,006893A9,00000000,?), ref: 00645443
Part of subcall function 0064543A: __aulldiv.LIBCMT ref: 00645463

Strings

0un, xrefs: 00688B1C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0un
API String ID: 2893107130-594083182
Opcode ID: bbb403f9d7eea51e82d14c86b7a615713157a4f0473f58a45b1e7620928b95d2
Instruction ID: cdd2fe97890f66e66170747fe7e8d54155425eb216bc6b212a4950c81d838f64
Opcode Fuzzy Hash: bbb403f9d7eea51e82d14c86b7a615713157a4f0473f58a45b1e7620928b95d2
Instruction Fuzzy Hash: 4721A2726256108FC729CF25D441A92B3E2EBA5311B688F6CD1E5CF2D0CE74BD45CB94

Function 0062E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd749b3e8d941ceccce55904af52770f5ee7ee051b9b6496028562423a4c5c1
Instruction ID: 4da9631dd5d50af1f18b08d3e50d265e73db9f0eb588438d53fbf4640c2a753d
Opcode Fuzzy Hash: 6cd749b3e8d941ceccce55904af52770f5ee7ee051b9b6496028562423a4c5c1
Instruction Fuzzy Hash: 16229E74A00626CFDB24DF54E485AAEB7F2FF08300F148179E856AB341E736A985CF91

Function 0068C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0068C966
FindClose.KERNEL32(00000000), ref: 0068C996

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e7060d9aaed8ba6c3202e4fc8b1f6a9512079da73110057b39e45af9051cc912
Instruction ID: 91fbac5ae4ce1fa7042d49ad8f9fdfe1e78f6408eaf3efd2d6497f17ae4c3726
Opcode Fuzzy Hash: e7060d9aaed8ba6c3202e4fc8b1f6a9512079da73110057b39e45af9051cc912
Instruction Fuzzy Hash: 0711A5316006109FDB10EF29D845A2AF7E6FF85320F00895EF8A9D7291DB30AC00CF95

Function 0068A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0069977D,?,006AFB84,?), ref: 0068A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0069977D,?,006AFB84,?), ref: 0068A314

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b5f32df9a6804ddef0debd463e352b23329807059f0aad450398843fe04f175a
Instruction ID: cb1fc4407ed84f7748abacfc4b1f8e6e17a1682028b250f9e1cf8d1b91ce8eb7
Opcode Fuzzy Hash: b5f32df9a6804ddef0debd463e352b23329807059f0aad450398843fe04f175a
Instruction Fuzzy Hash: 12F0823554422DBBEB10AFE4CC48FEA776EBF09762F00426ABD08D6181D6309944CFE1

Function 00678713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00678851), ref: 00678728
CloseHandle.KERNEL32(?,?,00678851), ref: 0067873A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 1b7ca7b330187d1fffe695c2b7506b7ff96f351333468d1a17113004be74862f
Instruction ID: c9ffd368d18b2838ae79ae1fa32de02596dd2a2dbd94e4da1cfcfdf28b32015f
Opcode Fuzzy Hash: 1b7ca7b330187d1fffe695c2b7506b7ff96f351333468d1a17113004be74862f
Instruction Fuzzy Hash: 48E0EC76010650EFEB652B60EC09D77BBEAEF05750724993DF49684470DB62ACD0DB50

Function 0064A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00648F97,?,?,?,00000001), ref: 0064A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0064A3A3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b24af25b72076449e2fd8c1f451b728a956d4323268f5cacef8b6b492d247c47
Instruction ID: 5c85b47a9ca5b165b631710f4af02afe2340066ed290384afa5387285e4f0ed4
Opcode Fuzzy Hash: b24af25b72076449e2fd8c1f451b728a956d4323268f5cacef8b6b492d247c47
Instruction Fuzzy Hash: 6FB09231054208ABCF003BD1EC59B883F6AEB46AA2F405020F60D84060CFA264508ED2

Function 0064F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63008b15ba1aecddb184ce8883c4bf4e67c9e11081837e19bffc2b8bab8c42e6
Instruction ID: 527728fb85bc77a6f23567bd6c88dfe5a5ea450d1fc02d2f055a2292363fe23e
Opcode Fuzzy Hash: 63008b15ba1aecddb184ce8883c4bf4e67c9e11081837e19bffc2b8bab8c42e6
Instruction Fuzzy Hash: F0320661D69F414DD7239A34D872336A28AAFB73C4F15E737E819B5AA6EB29C4C34100

Function 0065267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a6796f2c6ef5f5173263e5ef29dbede143c0688f7cb9bd0078eac47621ad5c4
Instruction ID: b2e34f7a5f20aaf746769600f585e87c328fdeff188d8a135365c2b726a399fd
Opcode Fuzzy Hash: 1a6796f2c6ef5f5173263e5ef29dbede143c0688f7cb9bd0078eac47621ad5c4
Instruction Fuzzy Hash: A1B1BA70D2AF414DD72396398831336BA8DAFBB2C5F51E71BFC2674922EB2185C34241

Function 006941FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00694218

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: c6badf24650ca70dfa603b473a27348e3d68b08986ed6cfce47adf7433e660db
Instruction ID: 0b7d1c2335ff90ec607b3491c5e21c9879b06574ee9dceaea8675bae3d4854b3
Opcode Fuzzy Hash: c6badf24650ca70dfa603b473a27348e3d68b08986ed6cfce47adf7433e660db
Instruction Fuzzy Hash: B6E04F312406149FDB10EF5AE845E9AF7EEAF98760F00802AFC49C7752DA71E9418FA1

Function 00684EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00684F18

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 6c68284c96cfff2663245c11875f17d6956d21996fe1f0d06d7e0bda7bd6d249
Instruction ID: 496537a596ebbeb583c6776f7c086ea77f6b917d3216e696247d3eb176461ca2
Opcode Fuzzy Hash: 6c68284c96cfff2663245c11875f17d6956d21996fe1f0d06d7e0bda7bd6d249
Instruction Fuzzy Hash: 0FD05EF016420738FC187B20AC0FFB6110BF3C0781F845B8D3301855C1ADE56801A635

Function 00678C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,006788D1), ref: 00678CB3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: a160111d4390295db2277937de674a0e445223d3a9b6d0c1fa73d2d122585ac6
Instruction ID: 47a9b81596f014605f68be65e8699609b4d55a97aa46cd00c40cc4b43bcce695
Opcode Fuzzy Hash: a160111d4390295db2277937de674a0e445223d3a9b6d0c1fa73d2d122585ac6
Instruction Fuzzy Hash: 73D05E322A050EABEF019FA4DC01EAE3B6AEB04B01F408111FE15C50A1C775E835AF60

Function 00662230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00662242

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d314e144aa22bf2e00de8a2ba1158ad967813c73277a79aea95a2206e93d7c5f
Instruction ID: a369a6b1ed7f8a76e2469b0fee12177ec63058149550e58bae63cb1d80932b75
Opcode Fuzzy Hash: d314e144aa22bf2e00de8a2ba1158ad967813c73277a79aea95a2206e93d7c5f
Instruction Fuzzy Hash: 28C048F1800109DBDB05EBA0DA98DEEB7BDAB09304F2440A6A142F2100E774AB448E72

Function 0064A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0064A36A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6d16c002c506000ceb37ec727f433fe47e4454512ee7840c44290adaaff0518b
Instruction ID: e300dd6a5b13f515c8a84b0e758eabf73ea11fd834e5986c6950148cfd82a771
Opcode Fuzzy Hash: 6d16c002c506000ceb37ec727f433fe47e4454512ee7840c44290adaaff0518b
Instruction Fuzzy Hash: CDA0113000020CAB8F002B82EC08888BFAEEA022A0B008020F80C800228F32A8208AC2

Function 00638A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7836dce13caca725d406847fe388fcfa0babeb9505be0b99f6ec9add04ee4b4e
Instruction ID: c26132b0b9f8676cd38e9bb27132cf4d3b4111e84bc958c273cf5f3e525b3beb
Opcode Fuzzy Hash: 7836dce13caca725d406847fe388fcfa0babeb9505be0b99f6ec9add04ee4b4e
Instruction Fuzzy Hash: 7F22D6309057568FDF288B14C4946FDB7B3FB41304F6484AAE4578B792EB749D82CBA1

Function 00642405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 512080266b007a102f1a7e182d96342824a42534abc291db7d7f38c334ad8934
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: A0C1A4322050530AEB5D4639D4341BEBAE26AA37B13AA075DF4B3CF6C5FF20D569D620

Function 0064283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 711ce4d88399cedcb8ede87d093e93f0ac3c5c7e7ab885a47e8bb418ae45ad84
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 97C1963220519309EB6D463A847407EBBE26B937B13AA075DF4B2DF6C4FF20D569D620

Function 00697B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00697B70
DeleteObject.GDI32(00000000), ref: 00697B82
DestroyWindow.USER32 ref: 00697B90
GetDesktopWindow.USER32 ref: 00697BAA
GetWindowRect.USER32(00000000), ref: 00697BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00697CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00697D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697D4A
GetClientRect.USER32(00000000,?), ref: 00697D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00697D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697DF8
GlobalFree.KERNEL32(00000000), ref: 00697E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,006B2CAC,00000000), ref: 00697E2B
GlobalFree.KERNEL32(00000000), ref: 00697E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00697E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00697E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00697EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0069808F

Strings

AutoIt v3, xrefs: 00697D42
static, xrefs: 00697D8A, 00697EE1
DISPLAY, xrefs: 00697EF2
, xrefs: 00698015

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 46219706f011acd63c08170addc58c98dd463385fa00f7001f856169f6319232
Instruction ID: dc2e98518f9ed3b234006e087de076e1e17f906fa61d97c9bfd48dba7b849340
Opcode Fuzzy Hash: 46219706f011acd63c08170addc58c98dd463385fa00f7001f856169f6319232
Instruction Fuzzy Hash: FB026B71A10215EFDF14DFA4DC89EAE7BBAEB49314F148159F905AB2A1CB70AD01CF60

Function 006A37F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,006AF910), ref: 006A38AF
IsWindowVisible.USER32(?), ref: 006A38D3

Strings

FINDSTRING, xrefs: 006A39FE
GETCURRENTLINE, xrefs: 006A3B75
UNCHECK, xrefs: 006A3B0B
SETCURRENTSELECTION, xrefs: 006A3A3E
TABRIGHT, xrefs: 006A3925
TABLEFT, xrefs: 006A390F
GETLINECOUNT, xrefs: 006A3B4E
GETCURRENTCOL, xrefs: 006A3BB0
ISVISIBLE, xrefs: 006A38BF
CHECK, xrefs: 006A3AF5
EDITPASTE, xrefs: 006A3BE7
DELSTRING, xrefs: 006A39D1
ISENABLED, xrefs: 006A38F3
HIDEDROPDOWN, xrefs: 006A3988
SENDCOMMANDID, xrefs: 006A3C62
ADDSTRING, xrefs: 006A399E
ISCHECKED, xrefs: 006A3AC1
SHOWDROPDOWN, xrefs: 006A3968
GETCURRENTSELECTION, xrefs: 006A3A6B
GETSELECTED, xrefs: 006A3B2B
SELECTSTRING, xrefs: 006A3A8E
GETLINE, xrefs: 006A3C23
CURRENTTAB, xrefs: 006A3945

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 9741a4ce0a487b704e62a45636c0a2b7deab936cea4d129c50aebf9e45296697
Instruction ID: 9f8ab15a91dfd5a31a36ff43b4ea1afe382d5a73eb62f8db09a90f83a8c53add
Opcode Fuzzy Hash: 9741a4ce0a487b704e62a45636c0a2b7deab936cea4d129c50aebf9e45296697
Instruction Fuzzy Hash: 95D19130604325DBCB54FF10C851AAABBE3AF95354F11845DB8865B3A6CB31EE0ACF95

Function 006AA849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 006AA89F
GetSysColorBrush.USER32(0000000F), ref: 006AA8D0
GetSysColor.USER32(0000000F), ref: 006AA8DC
SetBkColor.GDI32(?,000000FF), ref: 006AA8F6
SelectObject.GDI32(?,?), ref: 006AA905
InflateRect.USER32(?,000000FF,000000FF), ref: 006AA930
GetSysColor.USER32(00000010), ref: 006AA938
CreateSolidBrush.GDI32(00000000), ref: 006AA93F
FrameRect.USER32(?,?,00000000), ref: 006AA94E
DeleteObject.GDI32(00000000), ref: 006AA955
InflateRect.USER32(?,000000FE,000000FE), ref: 006AA9A0
FillRect.USER32(?,?,?), ref: 006AA9D2
GetWindowLongW.USER32(?,000000F0), ref: 006AA9FD

Part of subcall function 006AAB60: GetSysColor.USER32(00000012), ref: 006AAB99
Part of subcall function 006AAB60: SetTextColor.GDI32(?,?), ref: 006AAB9D
Part of subcall function 006AAB60: GetSysColorBrush.USER32(0000000F), ref: 006AABB3
Part of subcall function 006AAB60: GetSysColor.USER32(0000000F), ref: 006AABBE
Part of subcall function 006AAB60: GetSysColor.USER32(00000011), ref: 006AABDB
Part of subcall function 006AAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 006AABE9
Part of subcall function 006AAB60: SelectObject.GDI32(?,00000000), ref: 006AABFA
Part of subcall function 006AAB60: SetBkColor.GDI32(?,00000000), ref: 006AAC03
Part of subcall function 006AAB60: SelectObject.GDI32(?,?), ref: 006AAC10
Part of subcall function 006AAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 006AAC2F
Part of subcall function 006AAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006AAC46
Part of subcall function 006AAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 006AAC5B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 61928a215ccf7253179cda63da2b3fc91df0ed44c098c48f5c412b229f6376aa
Instruction ID: 842353946206770ca17c27a5a71eb5cf78cdf3027ef8304b6705f4f62a76db30
Opcode Fuzzy Hash: 61928a215ccf7253179cda63da2b3fc91df0ed44c098c48f5c412b229f6376aa
Instruction Fuzzy Hash: 17A18471408301AFD710AFA4DC08A5B77EAFF4A321F105B2AF562961A1D735E945CF53

Function 00622C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00622CA2
DeleteObject.GDI32(00000000), ref: 00622CE8
DeleteObject.GDI32(00000000), ref: 00622CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00622CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00622D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0065C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0065C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0065CAED

Part of subcall function 00621B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00622036,?,00000000,?,?,?,?,006216CB,00000000,?), ref: 00621B9A

SendMessageW.USER32(?,00001053), ref: 0065CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0065CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0065CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0065CB62

Strings

0, xrefs: 0065C981

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: b92b7fd5f7e025474f1435666be141a897259e9818004cb2c2c3f515b21dd296
Instruction ID: 360daa67cfb97d49bd5351f5c7ebabef1d017a3302914f8b620adf77d0bab56d
Opcode Fuzzy Hash: b92b7fd5f7e025474f1435666be141a897259e9818004cb2c2c3f515b21dd296
Instruction Fuzzy Hash: 2B12AD30604612EFCB60DF24D894BA9BBE2BF49321F544569F885DB662C731E886CF91

Function 006977BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006977F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006978B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 006978EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00697900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00697946
GetClientRect.USER32(00000000,?), ref: 00697952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00697996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006979A5
GetStockObject.GDI32(00000011), ref: 006979B5
SelectObject.GDI32(00000000,00000000), ref: 006979B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 006979C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006979D2
DeleteDC.GDI32(00000000), ref: 006979DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00697A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00697A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00697A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00697A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00697A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00697AAE
GetStockObject.GDI32(00000011), ref: 00697AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00697AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00697ACE

Strings

AutoIt v3, xrefs: 0069793E
static, xrefs: 00697990, 00697AA8
msctls_progress32, xrefs: 00697A4F
DISPLAY, xrefs: 0069799B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 92c3a50c4aa6114d7417c7fa74af44387bc1871a66942d64f553a4f42e5d9b15
Instruction ID: 69f2e7f87fdad2253f56d6c9bdd5d0a2e2bfb6a02cba95339f0514b5d648540a
Opcode Fuzzy Hash: 92c3a50c4aa6114d7417c7fa74af44387bc1871a66942d64f553a4f42e5d9b15
Instruction Fuzzy Hash: BFA17371A40215BFEB14DBA4DD4AFAE7BBAEB45714F008118FA15AB2E0D770AD00CF65

Function 0068AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0068AF89
GetDriveTypeW.KERNEL32(?,006AFAC0,?,\\.\,006AF910), ref: 0068B066
SetErrorMode.KERNEL32(00000000,006AFAC0,?,\\.\,006AF910), ref: 0068B1C4

Strings

PhysicalDrive, xrefs: 0068B012
iSCSI, xrefs: 0068B169
Network, xrefs: 0068B0A4
SATA, xrefs: 0068B177
CDROM, xrefs: 0068B09A
Fibre, xrefs: 0068B154
Unknown, xrefs: 0068B086, 0068B12A
Fixed, xrefs: 0068B0AE
MMC, xrefs: 0068B185
ATAPI, xrefs: 0068B138
Removable, xrefs: 0068B0B8
SAS, xrefs: 0068B170
ATA, xrefs: 0068B13F
Virtual, xrefs: 0068B18C
SSD, xrefs: 0068B0F1
SSA, xrefs: 0068B14D
1394, xrefs: 0068B146
FileBackedVirtual, xrefs: 0068B193
USB, xrefs: 0068B15B
\\.\, xrefs: 0068AFDB
RAMDisk, xrefs: 0068B090
RAID, xrefs: 0068B162
SCSI, xrefs: 0068B131

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ec0333d03c1050a15843f327da1cf685a55fc58fba8a01d48ec6711e43744c46
Instruction ID: 3239e88f90e27fde9e265931444f179318b0e4ad44fae0475b5204b82d8cc225
Opcode Fuzzy Hash: ec0333d03c1050a15843f327da1cf685a55fc58fba8a01d48ec6711e43744c46
Instruction Fuzzy Hash: B051F534B88305EBCB00FB90C996CBD73B3AB54341B61621AF44AAB391CB359D42DF52

Function 00626A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00626A91
__wcsnicmp.LIBCMT ref: 00626AA9
__wcsnicmp.LIBCMT ref: 00626AC1
__wcsnicmp.LIBCMT ref: 00626AD9
__wcsnicmp.LIBCMT ref: 00626AF1
__wcsnicmp.LIBCMT ref: 00626B09
__wcsnicmp.LIBCMT ref: 00626B21
__wcsnicmp.LIBCMT ref: 00626B35
__wcsnicmp.LIBCMT ref: 00626B76
__wcsnicmp.LIBCMT ref: 00626B8A
__wcsnicmp.LIBCMT ref: 00626B9E
__wcsnicmp.LIBCMT ref: 00626BB2

Strings

#include-once, xrefs: 00626AEB
Cannot parse #include, xrefs: 0065E819
#OnAutoItStartRegister, xrefs: 00626AD3
#requireadmin, xrefs: 00626ABB
#pragma compile, xrefs: 00626A8B
#cs, xrefs: 00626B2F, 00626B84
Bad directive syntax error, xrefs: 0065E743
#comments-start, xrefs: 00626B1B, 00626B70
#ce, xrefs: 00626BAC
Unterminated group of comments, xrefs: 0065E82C
#comments-end, xrefs: 00626B98
#include, xrefs: 00626B03
#notrayicon, xrefs: 00626AA3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 8c1ef650af820882bbb5334dc9e0be17362e877b29e4092ea610b7ead663de40
Instruction ID: c465134b10936029e170d259c4e049b566892beedd62371d86f83e0e3b4f9c0c
Opcode Fuzzy Hash: 8c1ef650af820882bbb5334dc9e0be17362e877b29e4092ea610b7ead663de40
Instruction Fuzzy Hash: 9C815A70640626AACF24AF60DC92FEB776BAF15301F044029FD41AA281EB61DB99CB55

Function 006AAB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 006AAB99
SetTextColor.GDI32(?,?), ref: 006AAB9D
GetSysColorBrush.USER32(0000000F), ref: 006AABB3
GetSysColor.USER32(0000000F), ref: 006AABBE
CreateSolidBrush.GDI32(?), ref: 006AABC3
GetSysColor.USER32(00000011), ref: 006AABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 006AABE9
SelectObject.GDI32(?,00000000), ref: 006AABFA
SetBkColor.GDI32(?,00000000), ref: 006AAC03
SelectObject.GDI32(?,?), ref: 006AAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 006AAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006AAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 006AAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006AACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 006AACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 006AACEC
DrawFocusRect.USER32(?,?), ref: 006AACF7
GetSysColor.USER32(00000011), ref: 006AAD05
SetTextColor.GDI32(?,00000000), ref: 006AAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 006AAD21
SelectObject.GDI32(?,006AA869), ref: 006AAD38
DeleteObject.GDI32(?), ref: 006AAD43
SelectObject.GDI32(?,?), ref: 006AAD49
DeleteObject.GDI32(?), ref: 006AAD4E
SetTextColor.GDI32(?,?), ref: 006AAD54
SetBkColor.GDI32(?,?), ref: 006AAD5E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 79e2909fd3f88dbb840a7a1144ed499614ece626d525aa954409da7d3cd00686
Instruction ID: a4586e4d3c10fdda092a7bdcce7f3d3d99b21749f2735c3fd7157506eb8a663a
Opcode Fuzzy Hash: 79e2909fd3f88dbb840a7a1144ed499614ece626d525aa954409da7d3cd00686
Instruction Fuzzy Hash: 51615F71900218EFDB11AFE4DC48EAE7B7AEF0A320F105126F915AB2A1D775AD40DF91

Function 006A8C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 006A8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006A8D45
CharNextW.USER32(0000014E), ref: 006A8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 006A8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 006A8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006A8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 006A8DF9
SetWindowTextW.USER32(?,0000014E), ref: 006A8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 006A8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 006A8E8C
_memset.LIBCMT ref: 006A8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 006A8EFA
_memset.LIBCMT ref: 006A8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 006A8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 006A8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 006A9088
InvalidateRect.USER32(?,00000000,00000001), ref: 006A90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006A90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006A9121
DrawMenuBar.USER32(?), ref: 006A9130
SetWindowTextW.USER32(?,0000014E), ref: 006A9158

Strings

0, xrefs: 006A90C2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: e803801b16a3eb2a2bfca71bf33d1ff3e0d590f876d3288a475a4f61c9580797
Instruction ID: aa49d9751b9f1a71e64cc9a54dbb806a44ee14d4a539b045243e277c31cc3930
Opcode Fuzzy Hash: e803801b16a3eb2a2bfca71bf33d1ff3e0d590f876d3288a475a4f61c9580797
Instruction Fuzzy Hash: 1CE18170900219AEDF20AF60CC84EEE7BBAEF06710F148159F9169B291DB749E85DF61

Function 006A4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006A4C51
GetDesktopWindow.USER32 ref: 006A4C66
GetWindowRect.USER32(00000000), ref: 006A4C6D
GetWindowLongW.USER32(?,000000F0), ref: 006A4CCF
DestroyWindow.USER32(?), ref: 006A4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006A4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006A4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 006A4D68
SendMessageW.USER32(?,00000421,?,?), ref: 006A4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 006A4D90
IsWindowVisible.USER32(?), ref: 006A4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 006A4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 006A4DDF
GetWindowRect.USER32(?,?), ref: 006A4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 006A4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 006A4E37
CopyRect.USER32(?,?), ref: 006A4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 006A4EB9

Strings

tooltips_class32, xrefs: 006A4D1D
0, xrefs: 006A4BFC
(, xrefs: 006A4E2A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6211b787cd656f6c98f390b4a6272c0f05449aa65f1797adf7a0673c6e991ea2
Instruction ID: 1792fdc773441defc97e8b4bad44136b14e3da3f2aab42b997618ff2a85cd2ff
Opcode Fuzzy Hash: 6211b787cd656f6c98f390b4a6272c0f05449aa65f1797adf7a0673c6e991ea2
Instruction Fuzzy Hash: E0B18D71604350AFDB44EF64C844B6ABBE6BF85314F00891CF5899B2A1DBB1EC05CFA6

Function 006846D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 006846E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 0068470E
_wcscpy.LIBCMT ref: 0068473C
_wcscmp.LIBCMT ref: 00684747
_wcscat.LIBCMT ref: 0068475D
_wcsstr.LIBCMT ref: 00684768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00684784
_wcscat.LIBCMT ref: 006847CD
_wcscat.LIBCMT ref: 006847D4
_wcsncpy.LIBCMT ref: 006847FF

Strings

DefaultLangCodepage, xrefs: 006847E7
\VarFileInfo\Translation, xrefs: 0068477C
%u.%u.%u.%u, xrefs: 00684862
04090000, xrefs: 006847BA
StringFileInfo\, xrefs: 00684757

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 1cf643877a87a64c34bf22fb5b93c8785cde5cd31a21c2b60a19184470c2cfc7
Instruction ID: bd35b4b4457015843bf95e934c8eea7b791f7ff084c06b5893e7575d760ea269
Opcode Fuzzy Hash: 1cf643877a87a64c34bf22fb5b93c8785cde5cd31a21c2b60a19184470c2cfc7
Instruction Fuzzy Hash: B2412A71A04215BAE750B7B49C43EBF776EDF02710F14016EF904E6282EF70EA4197A9

Function 006227D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006228BC
GetSystemMetrics.USER32(00000007), ref: 006228C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006228EF
GetSystemMetrics.USER32(00000008), ref: 006228F7
GetSystemMetrics.USER32(00000004), ref: 0062291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00622939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00622949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0062297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00622990
GetClientRect.USER32(00000000,000000FF), ref: 006229AE
GetStockObject.GDI32(00000011), ref: 006229CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 006229D5

Part of subcall function 00622344: GetCursorPos.USER32(?), ref: 00622357
Part of subcall function 00622344: ScreenToClient.USER32(006E67B0,?), ref: 00622374
Part of subcall function 00622344: GetAsyncKeyState.USER32(00000001), ref: 00622399
Part of subcall function 00622344: GetAsyncKeyState.USER32(00000002), ref: 006223A7

SetTimer.USER32(00000000,00000000,00000028,00621256), ref: 006229FC

Strings

AutoIt v3 GUI, xrefs: 00622974

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 57ca5c4079c0cf3807eab59e570fb8f20f8416b4cc384e65c47ec3ac8607eeb6
Instruction ID: 64f9c8706a7f2345c6efa7d1928fa968d3936e255212057e4a208d4007d5a7d0
Opcode Fuzzy Hash: 57ca5c4079c0cf3807eab59e570fb8f20f8416b4cc384e65c47ec3ac8607eeb6
Instruction Fuzzy Hash: 93B1AF70A0021AEFDB14DFA8DC95BEE7BB6FB18311F104229FA15A6290DB34E841CF51

Function 006A4069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006A40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 006A41B6

Strings

GETSUBITEMCOUNT, xrefs: 006A4141
ISSELECTED, xrefs: 006A41C1
SELECT, xrefs: 006A4250
GETSELECTEDCOUNT, xrefs: 006A4199
DESELECT, xrefs: 006A42A4
VIEWCHANGE, xrefs: 006A4375
SELECTALL, xrefs: 006A421D
SELECTINVERT, xrefs: 006A4286
GETTEXT, xrefs: 006A415F
GETITEMCOUNT, xrefs: 006A4128
FINDITEM, xrefs: 006A4329
GETSELECTED, xrefs: 006A42E4
SELECTCLEAR, xrefs: 006A4235

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 75a8bcf63ae57c132d2dc0e0b0fdaca0f730a1e5b4483ffaf77bb33869f6ad88
Instruction ID: a8704863f6fc68362260f4338e404df59ca6e7fae46ce1e2961abb051591d1a1
Opcode Fuzzy Hash: 75a8bcf63ae57c132d2dc0e0b0fdaca0f730a1e5b4483ffaf77bb33869f6ad88
Instruction Fuzzy Hash: 24A1AD306143119BDB54FF20C841AAAB7A7AFC5314F14896CB8969B392DF70ED0ACF55

Function 006952F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00695309
LoadCursorW.USER32(00000000,00007F8A), ref: 00695314
LoadCursorW.USER32(00000000,00007F00), ref: 0069531F
LoadCursorW.USER32(00000000,00007F03), ref: 0069532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00695335
LoadCursorW.USER32(00000000,00007F01), ref: 00695340
LoadCursorW.USER32(00000000,00007F81), ref: 0069534B
LoadCursorW.USER32(00000000,00007F88), ref: 00695356
LoadCursorW.USER32(00000000,00007F80), ref: 00695361
LoadCursorW.USER32(00000000,00007F86), ref: 0069536C
LoadCursorW.USER32(00000000,00007F83), ref: 00695377
LoadCursorW.USER32(00000000,00007F85), ref: 00695382
LoadCursorW.USER32(00000000,00007F82), ref: 0069538D
LoadCursorW.USER32(00000000,00007F84), ref: 00695398
LoadCursorW.USER32(00000000,00007F04), ref: 006953A3
LoadCursorW.USER32(00000000,00007F02), ref: 006953AE
GetCursorInfo.USER32(?), ref: 006953BE
GetLastError.KERNEL32(00000001,00000000), ref: 006953E9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: f9bdd8ad18b577768036b5c032a848c953e77c16edd151380eace73332dad1c0
Instruction ID: 977bde2adf35a0bbf71d33502c49c70fea0c3e9c1ac79a18a7e115649461ed30
Opcode Fuzzy Hash: f9bdd8ad18b577768036b5c032a848c953e77c16edd151380eace73332dad1c0
Instruction Fuzzy Hash: D9417170E043196ADF509FBA8C4986EFFFDEF51B10F10452FA509E7290DAB8A4018FA1

Function 0067AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0067AAA5
__swprintf.LIBCMT ref: 0067AB46
_wcscmp.LIBCMT ref: 0067AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0067ABAE
_wcscmp.LIBCMT ref: 0067ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0067AC21
GetDlgCtrlID.USER32(?), ref: 0067AC73
GetWindowRect.USER32(?,?), ref: 0067ACA9
GetParent.USER32(?), ref: 0067ACC7
ScreenToClient.USER32(00000000), ref: 0067ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0067AD48
_wcscmp.LIBCMT ref: 0067AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0067AD82
_wcscmp.LIBCMT ref: 0067AD96

Part of subcall function 0064386C: _iswctype.LIBCMT ref: 00643874

Strings

%s%u, xrefs: 0067AB40

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: d9d12b4e55209336db5596a8a5dc1d9dbe3864f47ab94ce26aa58e35d7527e46
Instruction ID: 5bedc084c75846d7ce45767ab14bf90cbaa4668cd27981669be003e3c3d4e451
Opcode Fuzzy Hash: d9d12b4e55209336db5596a8a5dc1d9dbe3864f47ab94ce26aa58e35d7527e46
Instruction Fuzzy Hash: 47A1A171204606AFD729DFA4C884BEEB7AAFF84315F10862DF99D92250D730E945CB92

Function 0067B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0067B3DB
_wcscmp.LIBCMT ref: 0067B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0067B414
CharUpperBuffW.USER32(?,00000000), ref: 0067B431
_wcscmp.LIBCMT ref: 0067B44F
_wcsstr.LIBCMT ref: 0067B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0067B498
_wcscmp.LIBCMT ref: 0067B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0067B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0067B518
_wcscmp.LIBCMT ref: 0067B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0067B550
GetWindowRect.USER32(00000004,?), ref: 0067B5B9

Strings

ThumbnailClass, xrefs: 0067B4A3, 0067B523
@, xrefs: 0067B3BC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 768dacb45b3a87d47bd8f6a5a0c793039402a47ae85ecf8ebb11ea023d11fc4b
Instruction ID: f8e4aadbf2fe21abcee52ade861e3325937bfff5de0b75ada1887bd256a6222c
Opcode Fuzzy Hash: 768dacb45b3a87d47bd8f6a5a0c793039402a47ae85ecf8ebb11ea023d11fc4b
Instruction Fuzzy Hash: CF81AE710083059BEB04DF10D885FAA7BEAEF44314F08E56DFD899A296DB30DD49CBA1

Function 006AC8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

DragQueryPoint.SHELL32(?,?), ref: 006AC917

Part of subcall function 006AADF1: ClientToScreen.USER32(?,?), ref: 006AAE1A
Part of subcall function 006AADF1: GetWindowRect.USER32(?,?), ref: 006AAE90
Part of subcall function 006AADF1: PtInRect.USER32(?,?,006AC304), ref: 006AAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 006AC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006AC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006AC9AE
_wcscat.LIBCMT ref: 006AC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 006AC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 006ACA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 006ACA25
SendMessageW.USER32(?,000000B1,?,?), ref: 006ACA47
DragFinish.SHELL32(?), ref: 006ACA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 006ACB41

Strings

@GUI_DROPID, xrefs: 006ACA6E
@GUI_DRAGFILE, xrefs: 006ACAF0
@GUI_DRAGID, xrefs: 006ACAB9
prn, xrefs: 006ACA8B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$prn
API String ID: 169749273-2044922903
Opcode ID: f9e3960e6ac0d495a282e1ce02ba7b613de84795111c1c89b7e7b1feeda8cf31
Instruction ID: 219e94d1c90a9ea495bb92295c0e714489cbaceacf5ed6ff756f89a9c7689b52
Opcode Fuzzy Hash: f9e3960e6ac0d495a282e1ce02ba7b613de84795111c1c89b7e7b1feeda8cf31
Instruction Fuzzy Hash: 15617D71508301AFC711EF64DC85D9BBBEAEF89710F04091EF591962A1DB30AA09CFA6

Function 0067B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0067B23F

Strings

ACTIVE, xrefs: 0067B21A
[REGEXPTITLE:, xrefs: 0067B267
REGEXP=, xrefs: 0067B254
[LAST, xrefs: 0067B2EC
[ALL, xrefs: 0067B2E5
[ACTIVE, xrefs: 0067B22C
CLASSNAME=, xrefs: 0067B27C
[HANDLE:, xrefs: 0067B24B
LAST, xrefs: 0067B204
ALL, xrefs: 0067B2D3
[CLASS:, xrefs: 0067B28F
HANDLE=, xrefs: 0067B238

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 8561ca81a14c69c73ea6de2b93229ca31ca2ce2c638793c13de68aae2b375b9c
Instruction ID: ecd12c60eef1bda8a01373a4425289f61aa46eb34463b0f735b05da88d70212f
Opcode Fuzzy Hash: 8561ca81a14c69c73ea6de2b93229ca31ca2ce2c638793c13de68aae2b375b9c
Instruction Fuzzy Hash: 2931D030A44215A6DB50FA60DD43FFE77B79F10750F20441EB415B22D2EF61AF04CA69

Function 0067C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0067C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0067C4E6
SetWindowTextW.USER32(?,?), ref: 0067C4FD
GetDlgItem.USER32(?,000003EA), ref: 0067C512
SetWindowTextW.USER32(00000000,?), ref: 0067C518
GetDlgItem.USER32(?,000003E9), ref: 0067C528
SetWindowTextW.USER32(00000000,?), ref: 0067C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0067C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0067C569
GetWindowRect.USER32(?,?), ref: 0067C572
SetWindowTextW.USER32(?,?), ref: 0067C5DD
GetDesktopWindow.USER32 ref: 0067C5E3
GetWindowRect.USER32(00000000), ref: 0067C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0067C636
GetClientRect.USER32(?,?), ref: 0067C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0067C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0067C693

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 05e8bf12655409b8011e89f68fbb643f8e87ba77ec7ebdf2aa50b27114bd3e4b
Instruction ID: 276edf7798572778550f43685826d1fc44f3411f47f9d252ec3cca4cfe617079
Opcode Fuzzy Hash: 05e8bf12655409b8011e89f68fbb643f8e87ba77ec7ebdf2aa50b27114bd3e4b
Instruction Fuzzy Hash: 83515D70900709AFDB20AFA8DD85BAEBBF6FB04715F00552CE686A26A0C775B914CF50

Function 006AA428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006AA4C8
DestroyWindow.USER32(?,?), ref: 006AA542

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 006AA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 006AA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006AA5F1
DestroyWindow.USER32(00000000), ref: 006AA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00620000,00000000), ref: 006AA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006AA663
GetDesktopWindow.USER32 ref: 006AA67C
GetWindowRect.USER32(00000000), ref: 006AA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 006AA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 006AA6B3

Part of subcall function 006225DB: GetWindowLongW.USER32(?,000000EB), ref: 006225EC

Strings

tooltips_class32, xrefs: 006AA5B5, 006AA643
0, xrefs: 006AA4DE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: a69dc611e7786126557ecfb66a2e23e803fbf1edf9d913735ae31d1708c8b084
Instruction ID: 3f416e9550266728f9b804a31b32f915b9deb1475c9574d92818df24f55e3875
Opcode Fuzzy Hash: a69dc611e7786126557ecfb66a2e23e803fbf1edf9d913735ae31d1708c8b084
Instruction Fuzzy Hash: D6716A71140245AFD720EF68CC45FA67BE6EB9A300F08552EF985872A1D771ED02CF66

Function 006A4619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006A46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006A46F6

Strings

CHECK, xrefs: 006A4716
GETTEXT, xrefs: 006A4849
EXISTS, xrefs: 006A475F
UNCHECK, xrefs: 006A48D2
SELECT, xrefs: 006A48A7
ISCHECKED, xrefs: 006A4879
GETITEMCOUNT, xrefs: 006A47D8
EXPAND, xrefs: 006A47A8
GETTOTALCOUNT, xrefs: 006A46DD
GETSELECTED, xrefs: 006A4806
COLLAPSE, xrefs: 006A473C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: d37c7f9aea0ce5627660119d282b3eacac0b205b63213b66f6cd8be2a590752b
Instruction ID: febaebdf41fa53cdee8db11a4850fe6246a9887cfc866044f4efa8edc3a97538
Opcode Fuzzy Hash: d37c7f9aea0ce5627660119d282b3eacac0b205b63213b66f6cd8be2a590752b
Instruction Fuzzy Hash: 06918C346047118FCB54EF10D851AAABBA3AF85314F04886DF8965B3A2CF71ED4ACF95

Function 006ABAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006ABB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,006A9431), ref: 006ABBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006ABC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006ABC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006ABC7D
FreeLibrary.KERNEL32(?), ref: 006ABC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006ABC99
DestroyIcon.USER32(?,?,?,?,?,006A9431), ref: 006ABCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 006ABCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 006ABCD1

Part of subcall function 0064313D: __wcsicmp_l.LIBCMT ref: 006431C6

Strings

.dll, xrefs: 006ABB27
.icl, xrefs: 006ABAE4
.exe, xrefs: 006ABB04

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: ccfbf9a3c41e28945a39788906f0965622e5a52af6abc9180fbda5ce446b4299
Instruction ID: f0bc7cb714d145f4899a18f4a142e005b425f926ee88656bab1b888c0cf12166
Opcode Fuzzy Hash: ccfbf9a3c41e28945a39788906f0965622e5a52af6abc9180fbda5ce446b4299
Instruction Fuzzy Hash: 7661EF71900219BAEB14EF64CC41FFA77AAEB09721F105219F816D62D2DB74AD90CFA0

Function 0068A0B5 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,006AFB78), ref: 0068A0FC

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0068A11E
__swprintf.LIBCMT ref: 0068A177
__swprintf.LIBCMT ref: 0068A190
_wprintf.LIBCMT ref: 0068A246
_wprintf.LIBCMT ref: 0068A264

Strings

"%s" (%d) : ==> %s:, xrefs: 0068A25F
^ ERROR, xrefs: 0068A1E8
Error: , xrefs: 0068A20E
Line %d (File "%s"):, xrefs: 0068A171, 0068A18A
"%s" (%d) : ==> %s:%s%s, xrefs: 0068A241
%k, xrefs: 0068A0C9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR$%k
API String ID: 311963372-3215148653
Opcode ID: 02768259816a36af3ffb6f86727f330db08e4f917f11822237c87bf2088b8f7e
Instruction ID: 10d41a3374f5a7411ca524082470b2e49d0b4cf4fc21095c0ef6ef2f05fc5d12
Opcode Fuzzy Hash: 02768259816a36af3ffb6f86727f330db08e4f917f11822237c87bf2088b8f7e
Instruction Fuzzy Hash: EA51BE3180061AAADF65FBE0DD96EEEB77AAF04300F14016AF505721A1EB312F48DF65

Function 0068A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

CharLowerBuffW.USER32(?,?), ref: 0068A636
GetDriveTypeW.KERNEL32 ref: 0068A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0068A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0068A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0068A730

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Strings

close cd wait, xrefs: 0068A71B
set cd door , xrefs: 0068A6D1
close, xrefs: 0068A63C
type cdaudio alias cd wait, xrefs: 0068A6AE
wait, xrefs: 0068A6ED
closed, xrefs: 0068A64A, 0068A653
open, xrefs: 0068A65D
open , xrefs: 0068A692

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 84b26023721b2b811b0b23dd3aa4a5a820bf0838cc2ede3dfc524d42f71471f3
Instruction ID: de9833533744d1f12ada710058387fa098871622c47bc2c2298f8c643ddf5b6c
Opcode Fuzzy Hash: 84b26023721b2b811b0b23dd3aa4a5a820bf0838cc2ede3dfc524d42f71471f3
Instruction Fuzzy Hash: 745168715087149FD740EF20D881C6AB7E6EF84318F04496DF88657261DB31EE0ACF52

Function 0068A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0068A47A
__swprintf.LIBCMT ref: 0068A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0068A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0068A4FE
_memset.LIBCMT ref: 0068A51D
_wcsncpy.LIBCMT ref: 0068A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0068A58E
CloseHandle.KERNEL32(00000000), ref: 0068A599
RemoveDirectoryW.KERNEL32(?), ref: 0068A5A2
CloseHandle.KERNEL32(00000000), ref: 0068A5AC

Strings

\, xrefs: 0068A4B2
:, xrefs: 0068A4BD
\??\%s, xrefs: 0068A496

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 716660d4f794556e11a5ac36cb4b5e8a83f5d05467e79da0f633fbf5b9df63b6
Instruction ID: 0b7721421badbbbef2e7a7e58daaf4ca9545d61da3137f90cbcd14de7f133206
Opcode Fuzzy Hash: 716660d4f794556e11a5ac36cb4b5e8a83f5d05467e79da0f633fbf5b9df63b6
Instruction Fuzzy Hash: 7D31A0B1500119ABEB20AFE0DC49FEB73BEEF89701F1041B6F908D2160E77097858B66

Function 0068DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0068DC7B
_wcscat.LIBCMT ref: 0068DC93
_wcscat.LIBCMT ref: 0068DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0068DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0068DCCE
GetFileAttributesW.KERNEL32(?), ref: 0068DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0068DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0068DD12

Strings

*.*, xrefs: 0068DD51

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: cc329489c7373cbb95affb1651c8efb4f6d3c7e6ca133f3aca6e0b124c7cd6bd
Instruction ID: 7f4006c00aa265b4b88ce210272929f1a160934ae36057bfc8bd6f9555f3089b
Opcode Fuzzy Hash: cc329489c7373cbb95affb1651c8efb4f6d3c7e6ca133f3aca6e0b124c7cd6bd
Instruction Fuzzy Hash: A38190B15042419FCB60FF64C8459AAB7EABF88350F19892EF885C7391E770ED45CB62

Function 006AC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006AC4EC
GetFocus.USER32 ref: 006AC4FC
GetDlgCtrlID.USER32(00000000), ref: 006AC507
_memset.LIBCMT ref: 006AC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 006AC65D
GetMenuItemCount.USER32(?), ref: 006AC67D
GetMenuItemID.USER32(?,00000000), ref: 006AC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 006AC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 006AC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006AC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 006AC779

Strings

0, xrefs: 006AC62A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 49e17c81df8878566aa5c544cffeab5eb9fa7b9152df083eef1767a501d5c131
Instruction ID: 0c0ed937a50be83fd3dd53c6e35f82471e5496dba614028444ebb7a6a101d9be
Opcode Fuzzy Hash: 49e17c81df8878566aa5c544cffeab5eb9fa7b9152df083eef1767a501d5c131
Instruction Fuzzy Hash: 31818E705083119FDB20EF14C984AABBBE6FB9A364F00552DF99597291D730ED05CFA2

Function 006783F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0067874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00678766
Part of subcall function 0067874A: GetLastError.KERNEL32(?,0067822A,?,?,?), ref: 00678770
Part of subcall function 0067874A: GetProcessHeap.KERNEL32(00000008,?,?,0067822A,?,?,?), ref: 0067877F
Part of subcall function 0067874A: HeapAlloc.KERNEL32(00000000,?,0067822A,?,?,?), ref: 00678786
Part of subcall function 0067874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0067879D

Part of subcall function 006787E7: GetProcessHeap.KERNEL32(00000008,00678240,00000000,00000000,?,00678240,?), ref: 006787F3
Part of subcall function 006787E7: HeapAlloc.KERNEL32(00000000,?,00678240,?), ref: 006787FA
Part of subcall function 006787E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00678240,?), ref: 0067880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00678458
_memset.LIBCMT ref: 0067846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0067848C
GetLengthSid.ADVAPI32(?), ref: 0067849D
GetAce.ADVAPI32(?,00000000,?), ref: 006784DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 006784F6
GetLengthSid.ADVAPI32(?), ref: 00678513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00678522
HeapAlloc.KERNEL32(00000000), ref: 00678529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0067854A
CopySid.ADVAPI32(00000000), ref: 00678551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00678582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 006785A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 006785BC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: b5bd96407f32e946e3a01fd03377d214d4fa8e9215bcdb14af72f21f529ec4f2
Instruction ID: 47306bf3de66098c3a21cef6da4607f6be52affe3cee352412fd857396951d3d
Opcode Fuzzy Hash: b5bd96407f32e946e3a01fd03377d214d4fa8e9215bcdb14af72f21f529ec4f2
Instruction Fuzzy Hash: 05611C7194010AAFDF149F94DC49AEEBBBAFF05300F148269F919A7291DB31AE05CF60

Function 0069762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006976A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 006976AE
CreateCompatibleDC.GDI32(?), ref: 006976BA
SelectObject.GDI32(00000000,?), ref: 006976C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0069771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00697757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0069777B
SelectObject.GDI32(00000006,?), ref: 00697783
DeleteObject.GDI32(?), ref: 0069778C
DeleteDC.GDI32(00000006), ref: 00697793
ReleaseDC.USER32(00000000,?), ref: 0069779E

Strings

(, xrefs: 00697723

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 4d381703e2808d7686904090210d21f0e12b7eaf70d9655032353a764ffa0364
Instruction ID: acbc1ef13ea1c723d0d14bfd0da5ed752db6ab0574cc73180c77193a8e2ad15e
Opcode Fuzzy Hash: 4d381703e2808d7686904090210d21f0e12b7eaf70d9655032353a764ffa0364
Instruction Fuzzy Hash: 87513975904209EFCB15DFA8CC85EAEBBBAEF49710F14852DF94997210D731A941CF60

Function 00626BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00640B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00626C6C,?,00008000), ref: 00640BB7

Part of subcall function 006248AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,006248A1,?,?,006237C0,?), ref: 006248CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00626D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00626E5A

Part of subcall function 006259CD: _wcscpy.LIBCMT ref: 00625A05

Part of subcall function 0064387D: _iswctype.LIBCMT ref: 00643885

Strings

EA06, xrefs: 0065E87B
Unterminated string, xrefs: 0065EC0D
Bad directive syntax error, xrefs: 0065EBC6
Error opening the file, xrefs: 0065E866, 0065E8E1
AU3!, xrefs: 00626CC1
>>>AUTOIT SCRIPT<<<, xrefs: 0065E8BF
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0065E84A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 34468c73e7dbc7e001664ce1fc03e118ffd6c1e55ca9ffe6cd3a085ab7beeae0
Instruction ID: 8c10ae9f777c8b6893473f25e3671dfa17e88a63f96e062f48b392e46ca6e131
Opcode Fuzzy Hash: 34468c73e7dbc7e001664ce1fc03e118ffd6c1e55ca9ffe6cd3a085ab7beeae0
Instruction Fuzzy Hash: D302AC311087519FCB64EF24D881AAFBBE6BF89314F04491DF886972A1DB31DA49CF46

Function 006245DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006245F9
GetMenuItemCount.USER32(006E6890), ref: 0065D7CD
GetMenuItemCount.USER32(006E6890), ref: 0065D87D
GetCursorPos.USER32(?), ref: 0065D8C1
SetForegroundWindow.USER32(00000000), ref: 0065D8CA
TrackPopupMenuEx.USER32(006E6890,00000000,?,00000000,00000000,00000000), ref: 0065D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0065D8E9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 1a1dc0218f5ef9eb530b3318b973694328ae577e7cb7d4aca202f2d0afc61422
Instruction ID: b3f9c5bf6c66bce16c74dbea6f05a748d87af599c2d9bd2d24404764906c0221
Opcode Fuzzy Hash: 1a1dc0218f5ef9eb530b3318b973694328ae577e7cb7d4aca202f2d0afc61422
Instruction Fuzzy Hash: 86712430601216BFEB309F54DC85FEABF66FF05365F200216F915A62E1CBB16814DB95

Function 00698BC0 Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00698BEC
CoInitialize.OLE32(00000000), ref: 00698C19
CoUninitialize.OLE32 ref: 00698C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00698D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00698E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,006B2C0C), ref: 00698E84
CoGetObject.OLE32(?,00000000,006B2C0C,?), ref: 00698EA7
SetErrorMode.KERNEL32(00000000), ref: 00698EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00698F3A
VariantClear.OLEAUT32(?), ref: 00698F4A

Strings

,,k, xrefs: 00698BD6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,k
API String ID: 2395222682-759674344
Opcode ID: 2c24d4f3895ac7f0f4b8c85ec28a20fc112861637f037b05e21c9efe47784191
Instruction ID: 837eb80d5f06adf6b9933c36bf8e68c14353ddce52952e365600033b3116ac30
Opcode Fuzzy Hash: 2c24d4f3895ac7f0f4b8c85ec28a20fc112861637f037b05e21c9efe47784191
Instruction Fuzzy Hash: C2C125B1208305AFDB40EF64C88496BB7EAFF8A348F10495DF5899B251DB31ED05CB52

Function 006A10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,006A0038,?,?), ref: 006A10BC

Strings

HKEY_LOCAL_MACHINE, xrefs: 006A1125
HKEY_CURRENT_USER, xrefs: 006A119B
HKEY_CURRENT_CONFIG, xrefs: 006A1179
HKCR, xrefs: 006A1164
HKCU, xrefs: 006A11AC
HKCC, xrefs: 006A118A
HKEY_CLASSES_ROOT, xrefs: 006A114F
HKLM, xrefs: 006A113A
HKEY_USERS, xrefs: 006A11BD
HKU, xrefs: 006A11CE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 37d0da43c88873b12f571fea9f83dc5db37f63a7b577c946c8ea505487e7e783
Instruction ID: cf50ee6a7867a4248aee5b821e461abf5cf865a1c80eed0f7004c8df43148881
Opcode Fuzzy Hash: 37d0da43c88873b12f571fea9f83dc5db37f63a7b577c946c8ea505487e7e783
Instruction Fuzzy Hash: 3541483090026ACBDF10EF90DC91AEA3727AF13340F104469EDA15B396DB31AE5ACF64

Function 00685569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Part of subcall function 00627A84: _memmove.LIBCMT ref: 00627B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006855D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006855E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006855F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0068560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0068561C

Strings

alias PlayMe, xrefs: 006855AB
close PlayMe, xrefs: 006855E3, 00685610
status PlayMe mode, xrefs: 006855CD
play PlayMe wait, xrefs: 00685606
play PlayMe, xrefs: 00685617
open , xrefs: 00685581

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 90956c409bb6ad46b349afec09e8f249d7a99cfddfd6ca70b972ec4236841894
Instruction ID: c08d31c728c7aae8b1f5b64edfb0015d787b67873dcbf6b6947158a243363fee
Opcode Fuzzy Hash: 90956c409bb6ad46b349afec09e8f249d7a99cfddfd6ca70b972ec4236841894
Instruction Fuzzy Hash: DB11E23099456979D720B6A1DC4ACFF7B7FEF91B00F41052AB401E21D1EE601D45CAB2

Function 006848F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0068490E
gethostname.WSOCK32(?,00000100), ref: 00684928
gethostbyname.WSOCK32(?), ref: 00684935
_wcscpy.LIBCMT ref: 0068495D
_memmove.LIBCMT ref: 00684970
inet_ntoa.WSOCK32(?), ref: 0068497B
_strcat.LIBCMT ref: 00684989
_wcscpy.LIBCMT ref: 006849A0
WSACleanup.WSOCK32 ref: 006849AE
_wcscpy.LIBCMT ref: 006849BC

Strings

0.0.0.0, xrefs: 00684957

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 264834c9d9c5158e8f304e26b38c5585a685a7a28c61f9f1837f33fe97b05819
Instruction ID: 817315f2d4feaebba87ce5c6d52f213d4400069fa2b16f8b07fadd364dc8550b
Opcode Fuzzy Hash: 264834c9d9c5158e8f304e26b38c5585a685a7a28c61f9f1837f33fe97b05819
Instruction Fuzzy Hash: 07110531904116ABCB70FB64EC06EDB77BE9F02710F01027AF40996151EF749A81CB66

Function 00685217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0068521C

Part of subcall function 00640719: timeGetTime.WINMM(?,75A8B400,00630FF9), ref: 0064071D

Sleep.KERNEL32(0000000A), ref: 00685248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0068526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0068528E
SetActiveWindow.USER32 ref: 006852AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006852BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 006852DA
Sleep.KERNEL32(000000FA), ref: 006852E5
IsWindow.USER32 ref: 006852F1
EndDialog.USER32(00000000), ref: 00685302

Strings

BUTTON, xrefs: 00685280

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: fa0afd035e82b90a01558ecfb323452aa02453dad061a08d9297551a6cb2e15f
Instruction ID: bda176ce0c2c4ef39b29f114548f167164f99335bd3b68ebcb8c195a539b2f2c
Opcode Fuzzy Hash: fa0afd035e82b90a01558ecfb323452aa02453dad061a08d9297551a6cb2e15f
Instruction Fuzzy Hash: 63218470204B44AFE7007FA0EDC9A753BABEB56396F043529F10285271DF61AD458F62

Function 0068D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

CoInitialize.OLE32(00000000), ref: 0068D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0068D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0068D8FC
CoCreateInstance.OLE32(006B2D7C,00000000,00000001,006DA89C,?), ref: 0068D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0068D9B7
CoTaskMemFree.OLE32(?,?), ref: 0068DA0F
_memset.LIBCMT ref: 0068DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0068DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0068DAAB
CoTaskMemFree.OLE32(00000000), ref: 0068DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0068DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0068DAEB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: e8e311213c740639d4b5a0c4b99c96e7655d211344e510bc566664cf5635090e
Instruction ID: 52e1397a115c29d4dd6a79f32cd0452255133919e3252f532afa17e9d736d611
Opcode Fuzzy Hash: e8e311213c740639d4b5a0c4b99c96e7655d211344e510bc566664cf5635090e
Instruction Fuzzy Hash: 29B1FA75A00119AFDB44EFA4C884DAEBBFAEF49314F148569F809EB251DB30AD41CF64

Function 0068052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 006805A7
SetKeyboardState.USER32(?), ref: 00680612
GetAsyncKeyState.USER32(000000A0), ref: 00680632
GetKeyState.USER32(000000A0), ref: 00680649
GetAsyncKeyState.USER32(000000A1), ref: 00680678
GetKeyState.USER32(000000A1), ref: 00680689
GetAsyncKeyState.USER32(00000011), ref: 006806B5
GetKeyState.USER32(00000011), ref: 006806C3
GetAsyncKeyState.USER32(00000012), ref: 006806EC
GetKeyState.USER32(00000012), ref: 006806FA
GetAsyncKeyState.USER32(0000005B), ref: 00680723
GetKeyState.USER32(0000005B), ref: 00680731

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3cb871cbbe6c2011070fd17f8bd263958b1ab48960c5a49f03cc37800a6d28d7
Instruction ID: acbc9aa18d30084960543314f15a7f7f870752063331dcf3b56d91a4d80efb0d
Opcode Fuzzy Hash: 3cb871cbbe6c2011070fd17f8bd263958b1ab48960c5a49f03cc37800a6d28d7
Instruction Fuzzy Hash: 16512E70A0478419FB74FBB085557EABFB69F02340F084B9DD5C25A2C2D654AB8CCF66

Function 0067C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0067C746
GetWindowRect.USER32(00000000,?), ref: 0067C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0067C7B6
GetDlgItem.USER32(?,00000002), ref: 0067C7C1
GetWindowRect.USER32(00000000,?), ref: 0067C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0067C827
GetDlgItem.USER32(?,000003E9), ref: 0067C835
GetWindowRect.USER32(00000000,?), ref: 0067C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0067C889
GetDlgItem.USER32(?,000003EA), ref: 0067C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0067C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0067C8C1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 327f7aed521c79fa04d3ee8c8460044237c6ef537b2122fe9d81a409252e6934
Instruction ID: 77ff5c52580631bcc440107842ed08e56e8e49e741daa4e3b711d1783c858c13
Opcode Fuzzy Hash: 327f7aed521c79fa04d3ee8c8460044237c6ef537b2122fe9d81a409252e6934
Instruction Fuzzy Hash: 64514371B00205AFDB18DFA9DD95AAEBBB6EB89310F14812DF51AD7290D770AD40CB50

Function 0062201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00621B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00622036,?,00000000,?,?,?,?,006216CB,00000000,?), ref: 00621B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 006220D3
KillTimer.USER32(-00000001,?,?,?,?,006216CB,00000000,?,?,00621AE2,?,?), ref: 0062216E
DestroyAcceleratorTable.USER32(00000000), ref: 0065BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006216CB,00000000,?,?,00621AE2,?,?), ref: 0065BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006216CB,00000000,?,?,00621AE2,?,?), ref: 0065BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006216CB,00000000,?,?,00621AE2,?,?), ref: 0065BF5A
DeleteObject.GDI32(00000000), ref: 0065BF6C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 481596c54a14de722e3122a30671dd1365cc60e43ffd60954ea1fb808521aec9
Instruction ID: fa91d6223c61a66cfba790ea2a61f96bc3a644b55f6c3b528712729ae26019ae
Opcode Fuzzy Hash: 481596c54a14de722e3122a30671dd1365cc60e43ffd60954ea1fb808521aec9
Instruction Fuzzy Hash: E4618E31100B62EFCB35AF14ED98B6AB7F3FB51312F10652CE9824A660C771A895DF91

Function 006221A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 006225DB: GetWindowLongW.USER32(?,000000EB), ref: 006225EC

GetSysColor.USER32(0000000F), ref: 006221D3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 49bf167dd7ddd5ebf515dd3017abc48472d04863c2e6dc1395b3066b1b7a84db
Instruction ID: 87b76028228e84de4c480eb0228e2b9c79b542de9b3b54992cb39d7ad9692867
Opcode Fuzzy Hash: 49bf167dd7ddd5ebf515dd3017abc48472d04863c2e6dc1395b3066b1b7a84db
Instruction Fuzzy Hash: 8F41A131001A51EEDB255F68EC98BB93B67EB06331F144365FD659A2E2C7328D42DF22

Function 0068AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,006AF910), ref: 0068AB76
GetDriveTypeW.KERNEL32(00000061,006DA620,00000061), ref: 0068AC40
_wcscpy.LIBCMT ref: 0068AC6A

Strings

ramdisk, xrefs: 0068ABEA
removable, xrefs: 0068ABA8
cdrom, xrefs: 0068AB92
network, xrefs: 0068ABD4
unknown, xrefs: 0068AC01
all, xrefs: 0068AB7C
fixed, xrefs: 0068ABBE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ee5438ece205991e730e812f18de252db446abb32e0b2948304b631ab13dfdca
Instruction ID: 807f813daefea903b2ef00283d9697fe314b7e6f658628fca47777f4d128845d
Opcode Fuzzy Hash: ee5438ece205991e730e812f18de252db446abb32e0b2948304b631ab13dfdca
Instruction Fuzzy Hash: AD51B0305083119BD750FF94D891EAAB7A7EF84300F14492EF986972A2DB31DD0ACB53

Function 006AC27C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

Part of subcall function 00622344: GetCursorPos.USER32(?), ref: 00622357
Part of subcall function 00622344: ScreenToClient.USER32(006E67B0,?), ref: 00622374
Part of subcall function 00622344: GetAsyncKeyState.USER32(00000001), ref: 00622399
Part of subcall function 00622344: GetAsyncKeyState.USER32(00000002), ref: 006223A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 006AC2E4
ImageList_EndDrag.COMCTL32 ref: 006AC2EA
ReleaseCapture.USER32 ref: 006AC2F0
SetWindowTextW.USER32(?,00000000), ref: 006AC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 006AC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 006AC48F

Strings

@GUI_DROPID, xrefs: 006AC3E1
@GUI_DRAGFILE, xrefs: 006AC424
prn, xrefs: 006AC438
prn, xrefs: 006AC3FD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$prn$prn
API String ID: 1924731296-1112027532
Opcode ID: e23002624684d395d572eec5b5420d9dbfe80aa638e44eabc49924d6b7f122cb
Instruction ID: 25b932ad10b0b7294cf6fe650742a79590f4134801bfe0bdd952afeebec85b3d
Opcode Fuzzy Hash: e23002624684d395d572eec5b5420d9dbfe80aa638e44eabc49924d6b7f122cb
Instruction Fuzzy Hash: 1F51AB70204304AFDB10EF24DC96FAA7BE6EB99310F00452DF5918B2E1CB70A948DF66

Function 00629997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 006299C2
__swprintf.LIBCMT ref: 00629A0C
__i64tow.LIBCMT ref: 0065FA0F

Strings

True, xrefs: 0065F9D0
%.15g, xrefs: 00629A06
0x%p, xrefs: 0065F9F1
False, xrefs: 0065F9D7

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: d41b369dd1917dbd9017019e5aefda0da1f33adf5f7b81b9e3838b2e8c100e05
Instruction ID: 03334493aeaaf74a88d8e5dc76f0963eb600693aec3fe9d5ad9daa934fdbf616
Opcode Fuzzy Hash: d41b369dd1917dbd9017019e5aefda0da1f33adf5f7b81b9e3838b2e8c100e05
Instruction Fuzzy Hash: 70412671904A15AFDB24EB38E842E7673EBEF48310F24446FE949D7381EA319846CB11

Function 006A73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006A73D9
CreateMenu.USER32 ref: 006A73F4
SetMenu.USER32(?,00000000), ref: 006A7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006A7490
IsMenu.USER32(?), ref: 006A74A6
CreatePopupMenu.USER32 ref: 006A74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006A74DD
DrawMenuBar.USER32 ref: 006A74E5

Strings

0, xrefs: 006A73CF
F, xrefs: 006A74D1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 1b06e005db065580d59cb5fd81d3f342b4e55b5f732ade61620cdaaca6a47dc1
Instruction ID: 0e6fdfae757e37fc32ec1fa535b9e02d20b3b1cc37dddf25bc426a8cecba0266
Opcode Fuzzy Hash: 1b06e005db065580d59cb5fd81d3f342b4e55b5f732ade61620cdaaca6a47dc1
Instruction Fuzzy Hash: D7412274A00209EFDB20EFA4D984A9ABBFAFF5A340F144428E95597360D731AD10CF60

Function 006A772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 006A77CD
CreateCompatibleDC.GDI32(00000000), ref: 006A77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 006A77E7
SelectObject.GDI32(00000000,00000000), ref: 006A77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 006A77FA
DeleteDC.GDI32(00000000), ref: 006A7803
GetWindowLongW.USER32(?,000000EC), ref: 006A780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 006A7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 006A782D

Strings

static, xrefs: 006A7765

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: f87e8e44a030b5b8381b7106f2e95a3438b1e757cdd368e1fc7c811094bc1fee
Instruction ID: 6df8800d0d8e67f3ece4a44764a97a4f5d738d3d7796a6c7be8b447524a3b560
Opcode Fuzzy Hash: f87e8e44a030b5b8381b7106f2e95a3438b1e757cdd368e1fc7c811094bc1fee
Instruction Fuzzy Hash: D9316A32105215ABDF11AFA4DC09FDB3B6AEF0A321F111224FA55A61A0C775EC21DFA5

Function 00647040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0064707B

Part of subcall function 00648D68: __getptd_noexit.LIBCMT ref: 00648D68

__gmtime64_s.LIBCMT ref: 00647114
__gmtime64_s.LIBCMT ref: 0064714A
__gmtime64_s.LIBCMT ref: 00647167
__allrem.LIBCMT ref: 006471BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 006471D9
__allrem.LIBCMT ref: 006471F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0064720E
__allrem.LIBCMT ref: 00647225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00647243
__invoke_watson.LIBCMT ref: 006472B4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: ea4b9f906cfef822598968d03410cf81a4b1e6d513d7f793be4e5f4a03023a14
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 977128B1A04717ABD7149E79CC41B9BB3AAAF10764F14423EF814E7381E770EB448794

Function 00682A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00682A31
GetMenuItemInfoW.USER32(006E6890,000000FF,00000000,00000030), ref: 00682A92
SetMenuItemInfoW.USER32(006E6890,00000004,00000000,00000030), ref: 00682AC8
Sleep.KERNEL32(000001F4), ref: 00682ADA
GetMenuItemCount.USER32(?), ref: 00682B1E
GetMenuItemID.USER32(?,00000000), ref: 00682B3A
GetMenuItemID.USER32(?,-00000001), ref: 00682B64
GetMenuItemID.USER32(?,?), ref: 00682BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00682BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00682C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00682C24

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: b6f1f06656b568e85566c97f76b979158991df671111d7c7361f54f9284f4d83
Instruction ID: bf85070a72e671ca34496d3c7dc30640240ccf88183d067760a546211853756c
Opcode Fuzzy Hash: b6f1f06656b568e85566c97f76b979158991df671111d7c7361f54f9284f4d83
Instruction Fuzzy Hash: 3461B0B090124AAFDB21EFA4C8A8DFE7BBAFF11308F140659F84197251D731AD46DB21

Function 006A7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006A7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 006A7217
GetWindowLongW.USER32(?,000000F0), ref: 006A723B
_memset.LIBCMT ref: 006A724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006A725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 006A72D6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 33ab92a2cfd4e7d18ec690bac069db42d38c85e282120792ac9d5e851966978f
Instruction ID: 052f31dba630f21f2260b092cd2482f843c573bac29fc43fdf0740af2aa56635
Opcode Fuzzy Hash: 33ab92a2cfd4e7d18ec690bac069db42d38c85e282120792ac9d5e851966978f
Instruction Fuzzy Hash: 8D616C71900248AFDB10EFA4CC81EEE77FAAB0A710F144159FA15AB3A1D770AD45DF64

Function 0067710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00677135
SafeArrayAllocData.OLEAUT32(?), ref: 0067718E
VariantInit.OLEAUT32(?), ref: 006771A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 006771C0
VariantCopy.OLEAUT32(?,?), ref: 00677213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00677227
VariantClear.OLEAUT32(?), ref: 0067723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00677249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00677252
VariantClear.OLEAUT32(?), ref: 00677264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0067726F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 87f618a1154c17d70b3d864c0f6127e7f3517f96095b5e20b7321fcb6fad43e5
Instruction ID: bce6d2c45ee2cd9d97e074d8366a3dfecc9480d73ef2c874d28d6d4174d79b0c
Opcode Fuzzy Hash: 87f618a1154c17d70b3d864c0f6127e7f3517f96095b5e20b7321fcb6fad43e5
Instruction Fuzzy Hash: A0414235A042199FCB00EFA4D8449AEBBFAFF48354F00C069F955E7262DB30AA45CF91

Function 006986D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

CoInitialize.OLE32 ref: 00698718
CoUninitialize.OLE32 ref: 00698723
CoCreateInstance.OLE32(?,00000000,00000017,006B2BEC,?), ref: 00698783
IIDFromString.OLE32(?,?), ref: 006987F6
VariantInit.OLEAUT32(?), ref: 00698890
VariantClear.OLEAUT32(?), ref: 006988F1

Strings

Invalid parameter, xrefs: 0069880F
NULL Pointer assignment, xrefs: 006987C8
Failed to create object, xrefs: 0069878E, 00698844

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 3e8b091b28f6cac2efd50569d672db840fc14707b8b7ee0c00d961479c45ae44
Instruction ID: 1f79698e57bd013acc81306edb6ce38c8e890a99572c72f37f8a7bc148653a39
Opcode Fuzzy Hash: 3e8b091b28f6cac2efd50569d672db840fc14707b8b7ee0c00d961479c45ae44
Instruction Fuzzy Hash: BC61E1706087119FDB10DF64C944B6EB7EAAF8A714F10481DF8859B791CB30ED44CBA6

Function 00695A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00695AA6
inet_addr.WSOCK32(?), ref: 00695AEB
gethostbyname.WSOCK32(?), ref: 00695AF7
IcmpCreateFile.IPHLPAPI ref: 00695B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00695B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00695B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00695C00
WSACleanup.WSOCK32 ref: 00695C06

Strings

Ping, xrefs: 00695B29

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 8289bcf96f1585da2866e4b37446198339b33eca8a73300c9a847e84f3223dbb
Instruction ID: 8b743bffe6ef708dc5b8d88d3d11e4d4d7ad6695955d00f460fd34d8ce1ae4ca
Opcode Fuzzy Hash: 8289bcf96f1585da2866e4b37446198339b33eca8a73300c9a847e84f3223dbb
Instruction Fuzzy Hash: 3F519E31604B109FDB21AF24DC55B6AB7EAEF48310F04892AF956DB2A1DB70EC01CF56

Function 0068B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0068B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0068B7B1
GetLastError.KERNEL32 ref: 0068B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0068B828

Strings

READY, xrefs: 0068B801
READONLY, xrefs: 0068B7F3
INVALID, xrefs: 0068B7FA
NOTREADY, xrefs: 0068B7E7
UNKNOWN, xrefs: 0068B7E0

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0fc4fc2688605bf60fa37e9d4a4db5a09b67504ee1c7203ec7b347e982e85f6f
Instruction ID: 9f2d78a97057807122563fec88190a8a6ed491dfb008080f176f256bea6e8317
Opcode Fuzzy Hash: 0fc4fc2688605bf60fa37e9d4a4db5a09b67504ee1c7203ec7b347e982e85f6f
Instruction Fuzzy Hash: C6319235A002059FDB10FFA4D885AFE7BBAEF85700F14912AF902D7391DB71A946CB51

Function 00679471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 006794F6
GetDlgCtrlID.USER32 ref: 00679501
GetParent.USER32 ref: 0067951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00679520
GetDlgCtrlID.USER32(?), ref: 00679529
GetParent.USER32(?), ref: 00679545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00679548

Strings

ComboBox, xrefs: 0067947E
ListBox, xrefs: 006794B3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 5704227f27144a0956f2d746a092dfc44f53dee14e81ce874c64b2eb72d2db2a
Instruction ID: 80a7e4a4e5fbfdd12a46673b792b4076928cce70dfe73fa57a433b3a572fcb35
Opcode Fuzzy Hash: 5704227f27144a0956f2d746a092dfc44f53dee14e81ce874c64b2eb72d2db2a
Instruction Fuzzy Hash: AB21F170D00204BBDF00ABA4CC85EFEBBB7EF4A300F105129B922972A2DB755919DF60

Function 0067955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 006795DF
GetDlgCtrlID.USER32 ref: 006795EA
GetParent.USER32 ref: 00679606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00679609
GetDlgCtrlID.USER32(?), ref: 00679612
GetParent.USER32(?), ref: 0067962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00679631

Strings

ComboBox, xrefs: 00679569
ListBox, xrefs: 0067959E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 8ffbb0ca5bb66422df300eb99a9d5a35a6d30e11f677118f5b46053c84bda403
Instruction ID: 0ec001b2e0fbbe1493884ca4349e792461cf91efd14cc5ef2099a88647cf761d
Opcode Fuzzy Hash: 8ffbb0ca5bb66422df300eb99a9d5a35a6d30e11f677118f5b46053c84bda403
Instruction Fuzzy Hash: 9A21B374900204BBDF01ABB4CC85EFEBBBAEF49300F105159B911972A1DB759919DF70

Function 00679645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00679651
GetClassNameW.USER32(00000000,?,00000100), ref: 00679666
_wcscmp.LIBCMT ref: 00679678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006796F3

Strings

list, xrefs: 006796D5
SHELLDLL_DefView, xrefs: 00679672
smallicons, xrefs: 006796BB
details, xrefs: 006796A1
largeicons, xrefs: 00679687

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: c5dbd8fecdbc2e2096567145bd9c7dbabcc999ef8ff6f22add374c9450412f0b
Instruction ID: c3858fd16061e3e49467704adccb02fa397233c74827e1b13b26ee1dbbcaef01
Opcode Fuzzy Hash: c5dbd8fecdbc2e2096567145bd9c7dbabcc999ef8ff6f22add374c9450412f0b
Instruction Fuzzy Hash: 3A112976648317BAFB052620EC07DE677DFDB05364F20422BFA04E56D1FEA269114ABC

Function 00684189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0068419D
__swprintf.LIBCMT ref: 006841AA

Part of subcall function 006438D8: __woutput_l.LIBCMT ref: 00643931

FindResourceW.KERNEL32(?,?,0000000E), ref: 006841D4
LoadResource.KERNEL32(?,00000000), ref: 006841E0
LockResource.KERNEL32(00000000), ref: 006841ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0068420D
LoadResource.KERNEL32(?,00000000), ref: 0068421F
SizeofResource.KERNEL32(?,00000000), ref: 0068422E
LockResource.KERNEL32(?), ref: 0068423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0068429B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 98579bb70e89a1b17d17a1bedf597b2c7e3cc4ddc41b0cd8a17f4f5efb1bc064
Instruction ID: 91c852b48c5f8c4393cff7034de4b97a3bd0cac2f3443490049c5ee78f35c4f9
Opcode Fuzzy Hash: 98579bb70e89a1b17d17a1bedf597b2c7e3cc4ddc41b0cd8a17f4f5efb1bc064
Instruction Fuzzy Hash: 9031927160921BAFDB11AFA0DC58EBF7BAEEF05301F004625F905D6250EB30DA519BA1

Function 006816DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00681700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00680778,?,00000001), ref: 00681714
GetWindowThreadProcessId.USER32(00000000), ref: 0068171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00680778,?,00000001), ref: 0068172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0068173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00680778,?,00000001), ref: 00681755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00680778,?,00000001), ref: 00681767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00680778,?,00000001), ref: 006817AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00680778,?,00000001), ref: 006817C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00680778,?,00000001), ref: 006817CC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 7bea1ecee5a43a616cd04a253fd362dff8e5303163aa88c67593ca9da48e704e
Instruction ID: 9bbfa581dc8510d7067eb6b9b1207f0970c7c0e8d1403938de7ec6e98f741b11
Opcode Fuzzy Hash: 7bea1ecee5a43a616cd04a253fd362dff8e5303163aa88c67593ca9da48e704e
Instruction Fuzzy Hash: 88318E75604304ABEB21AF54DC84FA97BAFAB56711F105129F904CE3A0E7B4AD428F61

Function 00699428 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0069947C
VariantInit.OLEAUT32(?), ref: 0069954D
VariantInit.OLEAUT32(?), ref: 0069964E
VariantClear.OLEAUT32(?), ref: 00699658
VariantClear.OLEAUT32(?), ref: 006996B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00699631
,,k, xrefs: 006994FA
Null Object assignment in FOR..IN loop, xrefs: 006994DD, 0069960B, 006996C3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,k$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-852925445
Opcode ID: d0b9fcdca7a3249ab662e2879a08c9c6c892dfa529393f238df7569e98dc7be1
Instruction ID: 8e23e1ed2da3c1c2d7ee780241ba821b1f5b27891ff87988df73c375c838abb2
Opcode Fuzzy Hash: d0b9fcdca7a3249ab662e2879a08c9c6c892dfa529393f238df7569e98dc7be1
Instruction Fuzzy Hash: 15917B71A00215ABDF24DFA9C844FAEBBBAEF85714F10815EF515AB280D7709945CFB0

Function 0067A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0067AA64), ref: 0067A9A2

Strings

TEXT, xrefs: 0067A8D9
CLASSNN, xrefs: 0067A744
REGEXPCLASS, xrefs: 0067A767
INSTANCE, xrefs: 0067A8B0
CLASS, xrefs: 0067A721
NAME, xrefs: 0067A7D4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: db7779344547295569532599b5ebbb591926dd687aaa9e0265b24d3cc86a606b
Instruction ID: fb354399eede450cba41dfbc520e3d94e91001f1272a052746de2f8f07088e5a
Opcode Fuzzy Hash: db7779344547295569532599b5ebbb591926dd687aaa9e0265b24d3cc86a606b
Instruction Fuzzy Hash: F2918430A006169ADB58DFA0C481BEDFB77BF44314F10C11DE99EA7251DB30A95ACBA5

Function 00622E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00622EAE

Part of subcall function 00621DB3: GetClientRect.USER32(?,?), ref: 00621DDC
Part of subcall function 00621DB3: GetWindowRect.USER32(?,?), ref: 00621E1D
Part of subcall function 00621DB3: ScreenToClient.USER32(?,?), ref: 00621E45

GetDC.USER32 ref: 0065CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0065CF95
SelectObject.GDI32(00000000,00000000), ref: 0065CFA3
SelectObject.GDI32(00000000,00000000), ref: 0065CFB8
ReleaseDC.USER32(?,00000000), ref: 0065CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0065D04B

Strings

U, xrefs: 0065CF20

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: bb89c8b308aa3dae84a2f6ac6bd49b95867f21db56d319f743b5bde2f9c515a1
Instruction ID: 4d7dfcb68492a96a15dfcf67b1f1d0ca7bd4889c393411019a0b685ab4231bcf
Opcode Fuzzy Hash: bb89c8b308aa3dae84a2f6ac6bd49b95867f21db56d319f743b5bde2f9c515a1
Instruction Fuzzy Hash: DB71D030400205EFCF219F64D890AEA3BB7FF49361F14426AFD955A2A6C7319C46EF61

Function 00698F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,006AF910), ref: 0069903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,006AF910), ref: 00699071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006991EB
SysFreeString.OLEAUT32(?), ref: 00699215

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: fe7a46a8510800fade27a7562fc7be525b932cd35e38870500923183aa92226f
Instruction ID: 0c4eedb5af5f779c846c621beaa573ae3a7c6ea5fceaba858bac0afbe2a44a6e
Opcode Fuzzy Hash: fe7a46a8510800fade27a7562fc7be525b932cd35e38870500923183aa92226f
Instruction Fuzzy Hash: 78F1F971A00119EFDF14DF98C888EEEB7BABF49315F108059F915AB251DB31AE46CB60

Function 0069F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0069F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0069FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0069FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0069FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0069FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0069FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0069FD90
CloseHandle.KERNEL32(?), ref: 0069FDBF
CloseHandle.KERNEL32(?), ref: 0069FE36

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 6cd17fc0088d1e9da9567c9f3a2c498fd47c6c439313ea012c49affb8a5eab68
Instruction ID: 21ff445af1221dbbb69cae1d9252d024de0036505016ef2fb734982ae16f9328
Opcode Fuzzy Hash: 6cd17fc0088d1e9da9567c9f3a2c498fd47c6c439313ea012c49affb8a5eab68
Instruction Fuzzy Hash: 58E1C131604301DFCB54EF24C891A6ABBE6AF85314F15896DF8998B3A2CB31EC45CF56

Function 00684F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006838D3,?), ref: 006848C7

Part of subcall function 006848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006838D3,?), ref: 006848E0

Part of subcall function 00684CD3: GetFileAttributesW.KERNEL32(?,00683947), ref: 00684CD4

lstrcmpiW.KERNEL32(?,?), ref: 00684FE2
_wcscmp.LIBCMT ref: 00684FFC
MoveFileW.KERNEL32(?,?), ref: 00685017

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: cfca336190f0b303cb5004ee5bc95784e3910056c4e07d247ae28c8a1880b50f
Instruction ID: 2df1b5b50637a9d0042202d8333cb93c7aecdfc1c891ea62d1da39456429ca3e
Opcode Fuzzy Hash: cfca336190f0b303cb5004ee5bc95784e3910056c4e07d247ae28c8a1880b50f
Instruction Fuzzy Hash: FD5177B20087859BC764EB90D8819DFB3DDAF85340F500A2EB285D3151EF74A58C8B6A

Function 006A88B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006A896E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: fcd8d24d2055d326613bcb5332c0e897395d26d96edcf40d588eb6e05df19170
Instruction ID: 22bf4ade960ceb50c4ea94859a9a8d15fb7f97891a9283fedefbf3ca09d2e825
Opcode Fuzzy Hash: fcd8d24d2055d326613bcb5332c0e897395d26d96edcf40d588eb6e05df19170
Instruction Fuzzy Hash: 9C518330600218BFDF20BF68DC85BAA7BA7BB06350F504116F615E72A1DF75AD909F51

Function 00622B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0065C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0065C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0065C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0065C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0065C5C0
DestroyIcon.USER32(00000000), ref: 0065C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0065C5EC
DestroyIcon.USER32(?), ref: 0065C5FB

Part of subcall function 006AA71E: DeleteObject.GDI32(00000000), ref: 006AA757

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 152ea1db82684a8844247ca3a7f920727e1430d9caba121424dcbd31bc1b80e9
Instruction ID: cab76635ca5ee4dab313f4af0403add69b17721b1d0863eac284a3fecfbedbd1
Opcode Fuzzy Hash: 152ea1db82684a8844247ca3a7f920727e1430d9caba121424dcbd31bc1b80e9
Instruction Fuzzy Hash: B9517A7460070AAFDB20DF64DC95FAA37B6EB59362F104528F902972A0DB70ED91DF60

Function 00679B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0067AE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 0067AE77
Part of subcall function 0067AE57: GetCurrentThreadId.KERNEL32 ref: 0067AE7E
Part of subcall function 0067AE57: AttachThreadInput.USER32(00000000,?,00679B65,?,00000001), ref: 0067AE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00679B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00679B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00679B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00679B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00679BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00679BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00679BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00679BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00679BDD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0a57d4dde1eea92ab340773487e36353bfe16086ae4c2227529620186b2dcf86
Instruction ID: 87b9ddc09569acc75d311263d5a73ac4fb4807be3d76d07381f233e80eb34163
Opcode Fuzzy Hash: 0a57d4dde1eea92ab340773487e36353bfe16086ae4c2227529620186b2dcf86
Instruction Fuzzy Hash: 6911E171550218BEF7106FA0DC89F6A3B2EEB4DB51F201429F248AB0A0C9F26C51DEA5

Function 00678E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00678A84,00000B00,?,?), ref: 00678E0C
HeapAlloc.KERNEL32(00000000,?,00678A84,00000B00,?,?), ref: 00678E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00678A84,00000B00,?,?), ref: 00678E28
GetCurrentProcess.KERNEL32(?,00000000,?,00678A84,00000B00,?,?), ref: 00678E30
DuplicateHandle.KERNEL32(00000000,?,00678A84,00000B00,?,?), ref: 00678E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00678A84,00000B00,?,?), ref: 00678E43
GetCurrentProcess.KERNEL32(00678A84,00000000,?,00678A84,00000B00,?,?), ref: 00678E4B
DuplicateHandle.KERNEL32(00000000,?,00678A84,00000B00,?,?), ref: 00678E4E
CreateThread.KERNEL32(00000000,00000000,00678E74,00000000,00000000,00000000), ref: 00678E68

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 45ccc1db573119201415f9316fd4562c38a3cc34ba169bd0d1490add78a8a153
Instruction ID: 9f99f46660c671eb4257675cb3bb88e45e32aae5e6579e3b381acd928a90b1c2
Opcode Fuzzy Hash: 45ccc1db573119201415f9316fd4562c38a3cc34ba169bd0d1490add78a8a153
Instruction Fuzzy Hash: 8601A8B5240308FFE760ABA5DC4DF6B3BADEB89711F015421FA05DB1A1DA70AC008F21

Function 00699A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00677652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?,?,0067799D), ref: 0067766F
Part of subcall function 00677652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?), ref: 0067768A
Part of subcall function 00677652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?), ref: 00677698
Part of subcall function 00677652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?), ref: 006776A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00699B1B
_memset.LIBCMT ref: 00699B28
_memset.LIBCMT ref: 00699C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00699C97
CoTaskMemFree.OLE32(?), ref: 00699CA2

Strings

NULL Pointer assignment, xrefs: 00699CF0

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 8e285f78874ebfc9917f9084c19e6a0b0d502243b6f878611a76002d22309699
Instruction ID: aee90de3766d9805305769ba121f9acd199edd1276abe7739fabcfd7d377550a
Opcode Fuzzy Hash: 8e285f78874ebfc9917f9084c19e6a0b0d502243b6f878611a76002d22309699
Instruction Fuzzy Hash: 5B913A71D00229EBDF20DFA4DC85EDEBBBAAF08710F20415AF419A7281DB315A45CFA0

Function 006A6FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 006A7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 006A70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 006A70C1
_wcscat.LIBCMT ref: 006A711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 006A7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 006A7161

Strings

SysListView32, xrefs: 006A7065

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 89ae059016c17098f388cd0d431c9f015ea758945707b28f54a6593b40c334ff
Instruction ID: 02e3b2c52613bcdaf32cfc8d5e7e4a96c8f5d227da3f62ffad4fa83595808241
Opcode Fuzzy Hash: 89ae059016c17098f388cd0d431c9f015ea758945707b28f54a6593b40c334ff
Instruction Fuzzy Hash: 6941A371A04308AFDB21AFA4CC85BEE77EAEF09350F10046AF545E7292D7719D848F64

Function 0069EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00683E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00683EB6
Part of subcall function 00683E91: Process32FirstW.KERNEL32(00000000,?), ref: 00683EC4
Part of subcall function 00683E91: CloseHandle.KERNEL32(00000000), ref: 00683F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0069ECB8
GetLastError.KERNEL32 ref: 0069ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0069ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0069ED77
GetLastError.KERNEL32(00000000), ref: 0069ED82
CloseHandle.KERNEL32(00000000), ref: 0069EDB7

Strings

SeDebugPrivilege, xrefs: 0069ECD6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 6b81ad77954a657e24e9e2a55965c250d29b12636ee3c7db9121ff5c70363c08
Instruction ID: a49b60d5067380c1f3473542ba0da328523c8fc9a9ed4bc4a403aa645e7c193d
Opcode Fuzzy Hash: 6b81ad77954a657e24e9e2a55965c250d29b12636ee3c7db9121ff5c70363c08
Instruction Fuzzy Hash: 3241AC706002109FDB14EF24C895F6DB7A6AF81714F08841DF8469B7C2DB76A808CF9A

Function 00683226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 006832C5

Strings

stop, xrefs: 00683296
blank, xrefs: 00683247
info, xrefs: 00683266
warning, xrefs: 006832AE
question, xrefs: 0068327E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1680286a682e0179ee8149f6db1f4ce927c1dabce04c3016ee3504b7b30018fa
Instruction ID: afac9c1fb49a93d1ee90b0d123718ee51a9bf364f8b9bcef28555908b61332a6
Opcode Fuzzy Hash: 1680286a682e0179ee8149f6db1f4ce927c1dabce04c3016ee3504b7b30018fa
Instruction Fuzzy Hash: 5D112B3160C3667AA7017B95DC62CAAB39EDF19B70F10016AF500A63C2E6659B4147A5

Function 00684534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0068454E
LoadStringW.USER32(00000000), ref: 00684555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0068456B
LoadStringW.USER32(00000000), ref: 00684572
_wprintf.LIBCMT ref: 00684598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 006845B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00684593

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: c54428bf0827912c42d80da9fd5feb2323a59749f0cb6c96d94469e78f0a906b
Instruction ID: b128e091240459d60f7ad0f87406def8cf42b8cc819a56914aa2e7ea6b8b3f67
Opcode Fuzzy Hash: c54428bf0827912c42d80da9fd5feb2323a59749f0cb6c96d94469e78f0a906b
Instruction Fuzzy Hash: CB0144F2900208BFE750B7D09D89EEB776DDB09301F0015A5B745D2151EA746E854F76

Function 006AD74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

GetSystemMetrics.USER32(0000000F), ref: 006AD78A
GetSystemMetrics.USER32(0000000F), ref: 006AD7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 006AD9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006ADA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006ADA24
ShowWindow.USER32(00000003,00000000), ref: 006ADA43
InvalidateRect.USER32(?,00000000,00000001), ref: 006ADA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 006ADA8B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 6aed15676538e0c9ad1bbc23b683f782e9444e7e0bc6bd3671572f1def2c3a43
Instruction ID: 2d65a19d7646fcf831b2145dbf2220794515e8825d7d28fd818331544a047f58
Opcode Fuzzy Hash: 6aed15676538e0c9ad1bbc23b683f782e9444e7e0bc6bd3671572f1def2c3a43
Instruction Fuzzy Hash: 1FB17A71600215EBDF14DF68C9857EE7BB2BF06701F088069ED4A9A695DB34AD50CFA0

Function 00622A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0065C417,00000004,00000000,00000000,00000000), ref: 00622ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0065C417,00000004,00000000,00000000,00000000,000000FF), ref: 00622B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0065C417,00000004,00000000,00000000,00000000), ref: 0065C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0065C417,00000004,00000000,00000000,00000000), ref: 0065C4D6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: db2b311f9a385a60e5e534c16dd57ad7f2358cfec8660cd81b6d2adcab487d3e
Instruction ID: 3bca231b8f1c8351753d530b2e362db76deb08f1e7bd7a49be25bb7e686ef8ac
Opcode Fuzzy Hash: db2b311f9a385a60e5e534c16dd57ad7f2358cfec8660cd81b6d2adcab487d3e
Instruction Fuzzy Hash: C7410830204B91BEC7359B28ECB8BBB7BD3AB46315F18842DE44746A61C675A886DF11

Function 00687368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0068737F

Part of subcall function 00640FF6: std::exception::exception.LIBCMT ref: 0064102C
Part of subcall function 00640FF6: __CxxThrowException@8.LIBCMT ref: 00641041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 006873B6
EnterCriticalSection.KERNEL32(?), ref: 006873D2
_memmove.LIBCMT ref: 00687420
_memmove.LIBCMT ref: 0068743D
LeaveCriticalSection.KERNEL32(?), ref: 0068744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00687461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00687480

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: df78dba7196c44ef9b88e2def1f8ee5e1ab3499c9ee25357175d0054a7bb6ce2
Instruction ID: 706533e8c2eba4b9602c0509e715a429955a844d7c7478d724c004ae960b7b3a
Opcode Fuzzy Hash: df78dba7196c44ef9b88e2def1f8ee5e1ab3499c9ee25357175d0054a7bb6ce2
Instruction Fuzzy Hash: 4831C131900205EBDF50EFA4DC85AAE7BBAEF45700B1441B9FD049B246DB30DE54CBA5

Function 006A6442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006A645A
GetDC.USER32(00000000), ref: 006A6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006A646D
ReleaseDC.USER32(00000000,00000000), ref: 006A6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 006A64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 006A64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,006A9299,?,?,000000FF,00000000,?,000000FF,?), ref: 006A6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006A6520

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 30ea4303404f82c335be4d1ae3659dbcee6bd8aebd802efc7d9cc023fa08d7b5
Instruction ID: a34fdfaa0f3b735fe4195ad0f02a2ce801f6232f6ecd989b00610d2aa196633a
Opcode Fuzzy Hash: 30ea4303404f82c335be4d1ae3659dbcee6bd8aebd802efc7d9cc023fa08d7b5
Instruction Fuzzy Hash: BA319F72200210BFEB109F50CC4AFEB3FAAEF0A765F085065FE089A291C675AC41CB75

Function 0067C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0067C087
_memcmp.LIBCMT ref: 0067C0A9
_memcmp.LIBCMT ref: 0067C0C1
_memcmp.LIBCMT ref: 0067C0D4
_memcmp.LIBCMT ref: 0067C0EE
_memcmp.LIBCMT ref: 0067C101
_memcmp.LIBCMT ref: 0067C119
_memcmp.LIBCMT ref: 0067C134

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 759f86f7b186b152ec9303b3726f755bfdf45929267d9d6414aef18e036cd2bf
Instruction ID: 81e805c44590ab9fc7a3528fdf6eb11ef9b52787998cde88d7eecff66e0e5e23
Opcode Fuzzy Hash: 759f86f7b186b152ec9303b3726f755bfdf45929267d9d6414aef18e036cd2bf
Instruction Fuzzy Hash: 8321C5A1600206B7D750A6209C52FFB279FAF113B4B45802CFD0D9A383F752DD5182E9

Function 0068ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

Part of subcall function 0063FEC6: _wcscpy.LIBCMT ref: 0063FEE9

_wcstok.LIBCMT ref: 0068EEFF
_wcscpy.LIBCMT ref: 0068EF8E
_memset.LIBCMT ref: 0068EFC1

Strings

X, xrefs: 0068EFFE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 2ce43b37d7f9e53b9c60b76cb3bd9ba832b80abbc8c10c47ef7c302a50f50a96
Instruction ID: 7d921fa63fe8ce4a81eaaa7c1b518c5ec1153500dbe7a228be9eb57bc7023725
Opcode Fuzzy Hash: 2ce43b37d7f9e53b9c60b76cb3bd9ba832b80abbc8c10c47ef7c302a50f50a96
Instruction Fuzzy Hash: 01C19F316087119FC764EF24D885A9AB7E2BF84310F00496DF8999B3A2DB30EC45CF96

Function 00696E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?), ref: 00696F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00696F35
WSAGetLastError.WSOCK32(00000000), ref: 00696F48
htons.WSOCK32(?), ref: 00696FFE
inet_ntoa.WSOCK32(?), ref: 00696FBB

Part of subcall function 0067AE14: _strlen.LIBCMT ref: 0067AE1E
Part of subcall function 0067AE14: _memmove.LIBCMT ref: 0067AE40

_strlen.LIBCMT ref: 00697058
_memmove.LIBCMT ref: 006970C1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 1285bcc1e065601d5086c84c165088a56a19962a253b150782694e5a7c9418e2
Instruction ID: f7e08e671270452a573456e3f2e436e8d1fe4b2f950d6f2f99aef697e8c02214
Opcode Fuzzy Hash: 1285bcc1e065601d5086c84c165088a56a19962a253b150782694e5a7c9418e2
Instruction Fuzzy Hash: C481E171508710AFDB50EF24DC82E6BB3EFAF84714F10891DF5559B292DA70AD01CBA6

Function 00621424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6522929d4e736f389d12bbb6d793fd1e45759a9ea296ead09cbc5e4408236ef3
Instruction ID: 5305887deaa3a9cb8b9509d5ad074c3055eee0cd9ec9ea14881c2c94386bc8ab
Opcode Fuzzy Hash: 6522929d4e736f389d12bbb6d793fd1e45759a9ea296ead09cbc5e4408236ef3
Instruction Fuzzy Hash: ED71AD30904519EFCB04DF98DC49AFEBBBAFF86310F108159F915AA251C734AA52CFA5

Function 006AB60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(012066A8), ref: 006AB6A5
IsWindowEnabled.USER32(012066A8), ref: 006AB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 006AB795
SendMessageW.USER32(012066A8,000000B0,?,?), ref: 006AB7CC
IsDlgButtonChecked.USER32(?,?), ref: 006AB809
GetWindowLongW.USER32(012066A8,000000EC), ref: 006AB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006AB843

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: e84a163ea0de084822a8c150a5c6ad7bf9ff39b9e99c0dcd6463f235e6faf154
Instruction ID: 6833a94f1dd6905702c8cee84e3c8772c467e796e0002b646a1eafccb0c7a675
Opcode Fuzzy Hash: e84a163ea0de084822a8c150a5c6ad7bf9ff39b9e99c0dcd6463f235e6faf154
Instruction Fuzzy Hash: 2D718A34600204AFDB24AFA4C8A4FEA7BABFB5B340F146069F945973A2C771AD51CF50

Function 0069F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0069F75C
_memset.LIBCMT ref: 0069F825
ShellExecuteExW.SHELL32(?), ref: 0069F86A

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

Part of subcall function 0063FEC6: _wcscpy.LIBCMT ref: 0063FEE9

GetProcessId.KERNEL32(00000000), ref: 0069F8E1
CloseHandle.KERNEL32(00000000), ref: 0069F910

Strings

@, xrefs: 0069F839

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: c5d68d5b34aec0769676d01f83c5a656656e091053a3d8fc20dabfcee5b26af5
Instruction ID: 89ac10ad6c94b03fd164544779698eeb5407c530cf8f789e3eb09561c10de9ca
Opcode Fuzzy Hash: c5d68d5b34aec0769676d01f83c5a656656e091053a3d8fc20dabfcee5b26af5
Instruction Fuzzy Hash: 7E619974A006299FCF04EF94D5819AEBBB6FF48310F15846DE846AB751CB30AD40CF94

Function 0068145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0068149C
GetKeyboardState.USER32(?), ref: 006814B1
SetKeyboardState.USER32(?), ref: 00681512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00681540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0068155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 006815A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 006815C8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cd032e79f00a207564341547131409bdbe979224b271a7e0eba7d305efee16ce
Instruction ID: 88b7cdc531b63f99c2e67246befa9dd3913141859bd73959e0b16a219f26ad53
Opcode Fuzzy Hash: cd032e79f00a207564341547131409bdbe979224b271a7e0eba7d305efee16ce
Instruction Fuzzy Hash: A651F0A0A042D53EFB3263648C45BFA7EAF5B47304F08868DE1D59A9C2D294ACC6D761

Function 00681276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 006812B5
GetKeyboardState.USER32(?), ref: 006812CA
SetKeyboardState.USER32(?), ref: 0068132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00681357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00681374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006813B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006813D9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7444df41fcb8fadcbd0756b928533e0dc6748e998c934902f1481f01fc4ae5b6
Instruction ID: 8393fa6b28ecf57f4b870ed3f581259d272455d97f401cbcd40608aa9a0b606e
Opcode Fuzzy Hash: 7444df41fcb8fadcbd0756b928533e0dc6748e998c934902f1481f01fc4ae5b6
Instruction Fuzzy Hash: 8C51F3A09046D53EFB32A7248C55BBABFAF5B07300F08868DE1D49E9C2D395AC86D751

Function 0068589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 006858AC
_wcsncpy.LIBCMT ref: 006858E1
_wcsncpy.LIBCMT ref: 00685913
_wcsncpy.LIBCMT ref: 00685946
_wcsncpy.LIBCMT ref: 00685988
_wcsncpy.LIBCMT ref: 006859C2
_wcsncpy.LIBCMT ref: 006859F1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: efc83b6fc46739871e646436b6b26dc2832e4ade0c9741e1f2d096f6302d48c7
Instruction ID: ce8991f193e0070bf4e639a9c2335f6d994e0849d78b4415a4247e2022642103
Opcode Fuzzy Hash: efc83b6fc46739871e646436b6b26dc2832e4ade0c9741e1f2d096f6302d48c7
Instruction Fuzzy Hash: 76418465C2052876CB90FBB5C886ACF73AAAF05310F60855AF519E3221FB34E715C7AD

Function 0067DA5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0067DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0067DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0067DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0067DB8E

Strings

,,k, xrefs: 0067DA69
DllGetClassObject, xrefs: 0067DB01

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,k$DllGetClassObject
API String ID: 753597075-913296791
Opcode ID: 1d8bfbd24a7ba504e6871081ac83b99501cab7653230ce1ff27d10d06106bf97
Instruction ID: 2b1d8638c1d8a9604943462cfe2ea5bc5875a587ccbada547dede363979c3f12
Opcode Fuzzy Hash: 1d8bfbd24a7ba504e6871081ac83b99501cab7653230ce1ff27d10d06106bf97
Instruction Fuzzy Hash: 44418FB1600209EFDB15DF54C884A9A7BBAEF48710F15C9AEED099F205D7B1DD44CBA0

Function 006838AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006848AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006838D3,?), ref: 006848C7

Part of subcall function 006848AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006838D3,?), ref: 006848E0

lstrcmpiW.KERNEL32(?,?), ref: 006838F3
_wcscmp.LIBCMT ref: 0068390F
MoveFileW.KERNEL32(?,?), ref: 00683927
_wcscat.LIBCMT ref: 0068396F
SHFileOperationW.SHELL32(?), ref: 006839DB

Strings

\*.*, xrefs: 00683969

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a95d83217fd2ddc8a92bd04b10c1d84e7cb3cf7916aff8eaa3cfcf0098adabae
Instruction ID: 06123211bd8c9b3bfbd60706f1a3cb76c24c9c213f586fa325d63421dddfba2e
Opcode Fuzzy Hash: a95d83217fd2ddc8a92bd04b10c1d84e7cb3cf7916aff8eaa3cfcf0098adabae
Instruction Fuzzy Hash: 034180B140C3459ACB91FF64C481AEFB7EDAF89740F401A2EF48AC3251EA74D648CB56

Function 006A7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006A7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006A75C0
IsMenu.USER32(?), ref: 006A75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006A7620
DrawMenuBar.USER32 ref: 006A7633

Strings

0, xrefs: 006A750D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 345672836e4ad3d1acd077a36892f0e0b1617fa0093ffeb5f4262e6416f5ed76
Instruction ID: 8959b15fa9472278e0c270be0c3777f4559bdb73d897f5d4667075fcd872d63b
Opcode Fuzzy Hash: 345672836e4ad3d1acd077a36892f0e0b1617fa0093ffeb5f4262e6416f5ed76
Instruction Fuzzy Hash: 01411575A04609AFDB20EF94D884ADABBFAFB0A350F049129F9559B350D730ED51CFA0

Function 006A122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 006A125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006A1286
FreeLibrary.KERNEL32(00000000), ref: 006A133D

Part of subcall function 006A122D: RegCloseKey.ADVAPI32(?), ref: 006A12A3
Part of subcall function 006A122D: FreeLibrary.KERNEL32(?), ref: 006A12F5
Part of subcall function 006A122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 006A1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 006A12E0

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d66857ed24df0b4a4089c939feb826e65e59431f862569dcaeb26f10655cadc1
Instruction ID: 8edbabb430940d1b818e585f1da7b585a548c26e3c7825d28fd0fa1047635faa
Opcode Fuzzy Hash: d66857ed24df0b4a4089c939feb826e65e59431f862569dcaeb26f10655cadc1
Instruction Fuzzy Hash: 41311C71901109BFDB14AFD0DC89AFEB7BDEF0A300F0001AAE501E6251DA74AF859EA5

Function 006A653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006A655B
GetWindowLongW.USER32(012066A8,000000F0), ref: 006A658E
GetWindowLongW.USER32(012066A8,000000F0), ref: 006A65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 006A65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006A661F
GetWindowLongW.USER32(00000000,000000F0), ref: 006A6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006A664A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 2e5e6d12374f4c93581d8b6f264a8ec067330731d391ad1039b23e0925f349d0
Instruction ID: dcea8dc9ddda82a0b2fbd12923027b93c8b4ad01454c0e13dee733224df40388
Opcode Fuzzy Hash: 2e5e6d12374f4c93581d8b6f264a8ec067330731d391ad1039b23e0925f349d0
Instruction Fuzzy Hash: A331F330A44250AFDB21EF58DC89F9537E2FB5A750F1921A8F5118F2B6CB61AC40DF62

Function 00696486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006980A0: inet_addr.WSOCK32(00000000), ref: 006980CB

socket.WSOCK32(00000002,00000001,00000006), ref: 006964D9
WSAGetLastError.WSOCK32(00000000), ref: 006964E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00696521
connect.WSOCK32(00000000,?,00000010), ref: 0069652A
WSAGetLastError.WSOCK32 ref: 00696534
closesocket.WSOCK32(00000000), ref: 0069655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00696576

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 3d835ef24499890bd057cbb2c3533d18d3c0b9186c5ecf144feab519c84d7913
Instruction ID: 3aa5c502655c5177a4fdc0b52c05696bcde45333f435ed4b679f951177beca2e
Opcode Fuzzy Hash: 3d835ef24499890bd057cbb2c3533d18d3c0b9186c5ecf144feab519c84d7913
Instruction Fuzzy Hash: 69318131600218AFDF10AF64DC85BBE7BBEEB45724F048069F90997291DB74AD45CF62

Function 0067E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0067E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0067E120
SysAllocString.OLEAUT32(00000000), ref: 0067E123
SysAllocString.OLEAUT32 ref: 0067E144
SysFreeString.OLEAUT32 ref: 0067E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0067E167
SysAllocString.OLEAUT32(?), ref: 0067E175

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b6c9e1e60cd16effe39bc57b3a4ef2380defff7d2b15fbf1fe2f0e798715edac
Instruction ID: 7f627a2bbd774ad760668de65dcd86ba6077292e475e15dc055800b352e62a02
Opcode Fuzzy Hash: b6c9e1e60cd16effe39bc57b3a4ef2380defff7d2b15fbf1fe2f0e798715edac
Instruction Fuzzy Hash: B9217135604108AFDB10AFB8DC89CAB77EEEB0D760B50C175F919CB261DA71EC858B64

Function 0067FB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0067FB81
__wcsnicmp.LIBCMT ref: 0067FBA2
__wcsnicmp.LIBCMT ref: 0067FBBC

Strings

#OnAutoItStartRegister, xrefs: 0067FBB6
#requireadmin, xrefs: 0067FB9C
#notrayicon, xrefs: 0067FB79

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: c2e6445420465491251016808ee98ce6f8d06873d9bf94c9598b36bd047fd6d3
Instruction ID: 0d9e312de0b29a9eba49d5b49f57bebcf554683f62ffa7510109281bcf348e17
Opcode Fuzzy Hash: c2e6445420465491251016808ee98ce6f8d06873d9bf94c9598b36bd047fd6d3
Instruction Fuzzy Hash: 5F213772104565E6D331E734DC22EE773DBEF61740F14C439F88986281EB51A9D2D299

Function 006A783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00621D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00621D73
Part of subcall function 00621D35: GetStockObject.GDI32(00000011), ref: 00621D87
Part of subcall function 00621D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00621D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 006A78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 006A78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 006A78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 006A78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 006A78D4

Strings

Msctls_Progress32, xrefs: 006A7872

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9e25dada237ffbd0c7aa9ab17b5a1c8f2c272753a5eb8673772a2760a6ded2ca
Instruction ID: db0e83b9409401c4026df9cf49635e3b3227478e61427cc27019eb65c8208baf
Opcode Fuzzy Hash: 9e25dada237ffbd0c7aa9ab17b5a1c8f2c272753a5eb8673772a2760a6ded2ca
Instruction Fuzzy Hash: 6C1190B2510219BFEF159F60CC85EE77F6EEF097A8F015125BA04A6190C772AC21DFA4

Function 006441C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00644292,?), ref: 006441E3
GetProcAddress.KERNEL32(00000000), ref: 006441EA
EncodePointer.KERNEL32(00000000), ref: 006441F6
DecodePointer.KERNEL32(00000001,00644292,?), ref: 00644213

Strings

RoInitialize, xrefs: 006441D2
combase.dll, xrefs: 006441DE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 1454817ae456687d1c79af4bc3c35c625d8f96d1184b12dbe1f70ecd506275f3
Instruction ID: 7039b0d520b0cbd0b1fc51b7c5ca2e7faee75508792ed64dead99c0bcdc49e74
Opcode Fuzzy Hash: 1454817ae456687d1c79af4bc3c35c625d8f96d1184b12dbe1f70ecd506275f3
Instruction Fuzzy Hash: 27E01AB0A90341AEEF207BF0EC89BA53AE7BB62703F106824F511D91A0DFB554D59F01

Function 0064429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,006441B8), ref: 006442B8
GetProcAddress.KERNEL32(00000000), ref: 006442BF
EncodePointer.KERNEL32(00000000), ref: 006442CA
DecodePointer.KERNEL32(006441B8), ref: 006442E5

Strings

RoUninitialize, xrefs: 006442A7
combase.dll, xrefs: 006442B3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 6f5ca48d667b281159d43157b09f39274737c48c4b88bff152e42aa3cf1fc390
Instruction ID: a55ced1fb48784c8906d0150d364aaf6e275f12a8a46773170e08b40f6bc02fe
Opcode Fuzzy Hash: 6f5ca48d667b281159d43157b09f39274737c48c4b88bff152e42aa3cf1fc390
Instruction Fuzzy Hash: 97E0B6B8691341AFEF10ABB1EC8DB963AA7BB25742F106428F001E95A0CFB45684DF15

Function 0068675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006868AD
_memmove.LIBCMT ref: 006867E8

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

_memmove.LIBCMT ref: 0068685B
_memmove.LIBCMT ref: 00686942
_memmove.LIBCMT ref: 0068695B
_memmove.LIBCMT ref: 00686977

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 93b3fe1bf09b770244ec23dce923942e0d514e4956ba1ddd2cbb217d59e0d148
Instruction ID: d0b1cb9785fa474571f9191ee5aa3de8d32b6a94bd51737f39667715d59c9254
Opcode Fuzzy Hash: 93b3fe1bf09b770244ec23dce923942e0d514e4956ba1ddd2cbb217d59e0d148
Instruction Fuzzy Hash: 0461BE30500A6A9BDF51FF20DC82EFE37A6AF45708F04461DF95A5B292DB309D85CBA4

Function 006A046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 006A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006A0038,?,?), ref: 006A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006A0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006A0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 006A05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 006A05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 006A0617
RegCloseKey.ADVAPI32(00000000), ref: 006A0624

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: e4548ae1ec93fb0884217c795c7cd16e7efcaccf4840016baba657f8ced11655
Instruction ID: a76d197c19b7c8126afd276d1849dee6fbd612bb126e516e19e2d0a0530ba497
Opcode Fuzzy Hash: e4548ae1ec93fb0884217c795c7cd16e7efcaccf4840016baba657f8ced11655
Instruction Fuzzy Hash: 3C515831508200AFDB54EF64D885E6BBBEAFF8A314F04891DF585872A1DB31E905CF56

Function 006A5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 006A5A82
GetMenuItemCount.USER32(00000000), ref: 006A5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006A5AE1
GetMenuItemID.USER32(?,?), ref: 006A5B50
GetSubMenu.USER32(?,?), ref: 006A5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 006A5BAF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 5e9b1f68909333e475b01a1d3af4dcf2cea5e3c3706d08a13cae816eceea299c
Instruction ID: 9befe1ac38df43ebb7429f8fbe987a2971527de6e307af6497e4dd68a9693761
Opcode Fuzzy Hash: 5e9b1f68909333e475b01a1d3af4dcf2cea5e3c3706d08a13cae816eceea299c
Instruction Fuzzy Hash: F8518F31E00A25EFCB11EFA4C855AAEB7B6EF49310F104469F906B7351CB70AE418F95

Function 0067F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0067F3F7
VariantClear.OLEAUT32(00000013), ref: 0067F469
VariantClear.OLEAUT32(00000000), ref: 0067F4C4
_memmove.LIBCMT ref: 0067F4EE
VariantClear.OLEAUT32(?), ref: 0067F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0067F569

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 5da805b5fd1734d74b65eae3ed7a2e43f72fcf7ddfe3b1662edc14a629fa9785
Instruction ID: 4105179251578f21e1261ec39122c2e0e5c36a08f2814a323fdfc3b13cda906f
Opcode Fuzzy Hash: 5da805b5fd1734d74b65eae3ed7a2e43f72fcf7ddfe3b1662edc14a629fa9785
Instruction Fuzzy Hash: 205146B5A00209AFDB10DF68D880EAAB7F9FF4D354B158569E959DB301D730E912CFA0

Function 006826F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00682747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00682792
IsMenu.USER32(00000000), ref: 006827B2
CreatePopupMenu.USER32 ref: 006827E6
GetMenuItemCount.USER32(000000FF), ref: 00682844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00682875

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 436edc868300fcffcbc328d12de4ec282420a528c7b703c5f126b01b9babbee5
Instruction ID: ca139d1a715e353de4df4d953e8eefeae44dd6c35ee3cefb4136350abe79ab58
Opcode Fuzzy Hash: 436edc868300fcffcbc328d12de4ec282420a528c7b703c5f126b01b9babbee5
Instruction Fuzzy Hash: 115190B0A00207EFDF24EF68D898AEEBBF6EF45314F104369E8119B291D7709949CB51

Function 00621765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0062179A
GetWindowRect.USER32(?,?), ref: 006217FE
ScreenToClient.USER32(?,?), ref: 0062181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0062182C
EndPaint.USER32(?,?), ref: 00621876

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 2630706b3fccf40054639406fa44a0eb0d70952b2703a4b3360f8b9e64ea8edd
Instruction ID: 9e4c26dbb09f0cceb43837e82e3caa6ed4796f84982cbdd8b93fc8afbfa3b67a
Opcode Fuzzy Hash: 2630706b3fccf40054639406fa44a0eb0d70952b2703a4b3360f8b9e64ea8edd
Instruction Fuzzy Hash: 3541B070104751AFC710DF24DCC4BBB7BEAEB66764F140668F9948A2A1C731A845DF62

Function 006AB958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(006E67B0,00000000,012066A8,?,?,006E67B0,?,006AB862,?,?), ref: 006AB9CC
EnableWindow.USER32(00000000,00000000), ref: 006AB9F0
ShowWindow.USER32(006E67B0,00000000,012066A8,?,?,006E67B0,?,006AB862,?,?), ref: 006ABA50
ShowWindow.USER32(00000000,00000004,?,006AB862,?,?), ref: 006ABA62
EnableWindow.USER32(00000000,00000001), ref: 006ABA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 006ABAA9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: efc2247b30c1d91939385ea52aff2f30b0340ab16a482a9fcade70e69ff390f5
Instruction ID: 48d64dd62509912cdb98ea7e7db43f74ce8ae806fae6c8b2fd3954c2ae5c2b5b
Opcode Fuzzy Hash: efc2247b30c1d91939385ea52aff2f30b0340ab16a482a9fcade70e69ff390f5
Instruction Fuzzy Hash: E8412931600241AFDB22EF64D499BD57BA2EF07310F1852A9FA488F6A3C731AC45CF51

Function 006973B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00695134,?,?,00000000,00000001), ref: 006973BF

Part of subcall function 00693C94: GetWindowRect.USER32(?,?), ref: 00693CA7

GetDesktopWindow.USER32 ref: 006973E9
GetWindowRect.USER32(00000000), ref: 006973F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00697422

Part of subcall function 006854E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0068555E

GetCursorPos.USER32(?), ref: 0069744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006974AC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: c8f41aab90215168100cb55d1587d673b22c5c4c8b06c86ade078cf49e74e7b1
Instruction ID: 53147c97dcea37d4b6b59015fbf46866d1aad8ef809a3bb1e66a471a6ff16a3f
Opcode Fuzzy Hash: c8f41aab90215168100cb55d1587d673b22c5c4c8b06c86ade078cf49e74e7b1
Instruction Fuzzy Hash: F331E672508305ABDB24EF54D849F9BBBEEFF89714F000919F58997192DB30E908CB92

Function 00678D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006785F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00678608
Part of subcall function 006785F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00678612
Part of subcall function 006785F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00678621
Part of subcall function 006785F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00678628
Part of subcall function 006785F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0067863E

GetLengthSid.ADVAPI32(?,00000000,00678977), ref: 00678DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00678DB8
HeapAlloc.KERNEL32(00000000), ref: 00678DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00678DD8
GetProcessHeap.KERNEL32(00000000,00000000,00678977), ref: 00678DEC
HeapFree.KERNEL32(00000000), ref: 00678DF3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: d07bd2e23d296dc2c15d0f4796e4a6916e41fc4a79bdad3dff747873567bab8f
Instruction ID: 5dfde0989437ca48ce94fac7e451186b15a177d592f844c0314cd589fcb9f583
Opcode Fuzzy Hash: d07bd2e23d296dc2c15d0f4796e4a6916e41fc4a79bdad3dff747873567bab8f
Instruction Fuzzy Hash: 6E119A31640605EFDB20ABA4CC0DBAEBBAAEF56315F108029E84997250CB32AD00CF60

Function 00678AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00678B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00678B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00678B40
CloseHandle.KERNEL32(00000004), ref: 00678B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00678B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00678B8E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 3b8057cb75608b99c534bb8ef083008e17fe207b56640a301da7e04e80f25262
Instruction ID: 3c18cc337248d3bd9bd9d4fbe85a1d2a5fc63b4857885815b29d0eebbcf64090
Opcode Fuzzy Hash: 3b8057cb75608b99c534bb8ef083008e17fe207b56640a301da7e04e80f25262
Instruction Fuzzy Hash: FD1159B2540209AFDF019FE4ED49FDA7BAAEF09704F049064FE08A2160C7729D60AB61

Function 006AC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 006212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0062134D
Part of subcall function 006212F3: SelectObject.GDI32(?,00000000), ref: 0062135C
Part of subcall function 006212F3: BeginPath.GDI32(?), ref: 00621373
Part of subcall function 006212F3: SelectObject.GDI32(?,00000000), ref: 0062139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 006AC1C4
LineTo.GDI32(00000000,00000003,?), ref: 006AC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 006AC1E6
LineTo.GDI32(00000000,00000000,?), ref: 006AC1F6
EndPath.GDI32(00000000), ref: 006AC206
StrokePath.GDI32(00000000), ref: 006AC216

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c8a9fdc50ab8270637c83e239b5c83a9a881e33b03e2081ea71c3f90c28e981b
Instruction ID: 3739ac017f7fd7ce914bf2f595b666ec74b810902d427d1d3bd2ccc902bb2185
Opcode Fuzzy Hash: c8a9fdc50ab8270637c83e239b5c83a9a881e33b03e2081ea71c3f90c28e981b
Instruction Fuzzy Hash: B0110C7640014CBFDB11AF94DC88FDA7FAEEB05394F048021B9194A161C771AE55DFA0

Function 006403A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 006403D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 006403DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006403E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006403F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 006403F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00640401

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d7d16e1cfe0facd87f7546e9b105cad5cc9d3cc573c800b72ee1b4386cfa2dcb
Instruction ID: 9b170cead01816f48775bddff2091ed510237b8129ec6e92bc15075a8bf64a23
Opcode Fuzzy Hash: d7d16e1cfe0facd87f7546e9b105cad5cc9d3cc573c800b72ee1b4386cfa2dcb
Instruction Fuzzy Hash: 15016CB09017597DE3009F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CFE5

Function 0068568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0068569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006856B1
GetWindowThreadProcessId.USER32(?,?), ref: 006856C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006856CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006856D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006856E0

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 939fd405aa3fe686849e6b71365c9f2e7d73dc10746b32b84c31d1626cd400bb
Instruction ID: f631f163280f8d2c734c56ea97b9753449508b149387fd9a7856c081d06a850b
Opcode Fuzzy Hash: 939fd405aa3fe686849e6b71365c9f2e7d73dc10746b32b84c31d1626cd400bb
Instruction Fuzzy Hash: 22F01D32241158BBE7216BE2DC0DEEB7A7DEBC7B11F001169FA05D10609AA12A018AB6

Function 006874D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 006874E5
EnterCriticalSection.KERNEL32(?,?,00631044,?,?), ref: 006874F6
TerminateThread.KERNEL32(00000000,000001F6,?,00631044,?,?), ref: 00687503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00631044,?,?), ref: 00687510

Part of subcall function 00686ED7: CloseHandle.KERNEL32(00000000,?,0068751D,?,00631044,?,?), ref: 00686EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00687523
LeaveCriticalSection.KERNEL32(?,?,00631044,?,?), ref: 0068752A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 82efacc6de67814584512cc27de4b84f8d9db9da01fe4d8b1d5eefa2f78200c7
Instruction ID: c9d1e2b8f7b8b6c373021606b5c7d1d6d404052c17e4a3011edf10725a1718c2
Opcode Fuzzy Hash: 82efacc6de67814584512cc27de4b84f8d9db9da01fe4d8b1d5eefa2f78200c7
Instruction Fuzzy Hash: 03F05E3A144612EBDB613BE4FC8CAEB772BEF46302B101631F202910B0DB756A01CF52

Function 00678E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00678E7F
UnloadUserProfile.USERENV(?,?), ref: 00678E8B
CloseHandle.KERNEL32(?), ref: 00678E94
CloseHandle.KERNEL32(?), ref: 00678E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00678EA5
HeapFree.KERNEL32(00000000), ref: 00678EAC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: c05b8c43f7f1217fb6d225d4daa9ea8026ff6902dc885d6fe52d05196a9ade90
Instruction ID: ff11aa5dace3475f7f71ecd2301c3ce310222860071742df050faab2bb6fd243
Opcode Fuzzy Hash: c05b8c43f7f1217fb6d225d4daa9ea8026ff6902dc885d6fe52d05196a9ade90
Instruction Fuzzy Hash: 9AE05276104505FFDB012FE5EC0C95ABB6AFB8A762B509631F21981470CB32A861DF92

Function 00677A78 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,006B2C7C,?), ref: 00677C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,006B2C7C,?), ref: 00677C4A
CLSIDFromProgID.OLE32(?,?,00000000,006AFB80,000000FF,?,00000000,00000800,00000000,?,006B2C7C,?), ref: 00677C6F
_memcmp.LIBCMT ref: 00677C90

Strings

,,k, xrefs: 00677A85

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,k
API String ID: 314563124-759674344
Opcode ID: 0b897102bf7b59b801b3bd78249e00269e3f2c4cd4bb5c90ce092925b9ce4cd8
Instruction ID: e70d52fef702a94f8f56b98616a8165eac6db28a23e8f57dfa8294394ef005cf
Opcode Fuzzy Hash: 0b897102bf7b59b801b3bd78249e00269e3f2c4cd4bb5c90ce092925b9ce4cd8
Instruction Fuzzy Hash: 59811B75A00109EFCB04DF94C984DEEB7BAFF89715F208198E516AB250DB71AE06CB61

Function 00698902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00698928
CharUpperBuffW.USER32(?,?), ref: 00698A37
VariantClear.OLEAUT32(?), ref: 00698BAF

Part of subcall function 00687804: VariantInit.OLEAUT32(00000000), ref: 00687844
Part of subcall function 00687804: VariantCopy.OLEAUT32(00000000,?), ref: 0068784D
Part of subcall function 00687804: VariantClear.OLEAUT32(00000000), ref: 00687859

Strings

Incorrect Parameter format, xrefs: 00698960, 00698B22
AUTOIT.ERROR, xrefs: 00698A3D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: c06a19a9c45a03d106468f230b05d00612bad830a84f0d3573f174f3b97eb845
Instruction ID: d600c82bf67cd1c5c47d5b6d45f3a0d91eff7e1a93ffd7f42431f7f4ce1c755b
Opcode Fuzzy Hash: c06a19a9c45a03d106468f230b05d00612bad830a84f0d3573f174f3b97eb845
Instruction Fuzzy Hash: AC9180716087019FCB50DF28C48195ABBEAEFC9314F14896EF89A8B361DB31E945CB52

Function 00682F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0063FEC6: _wcscpy.LIBCMT ref: 0063FEE9

_memset.LIBCMT ref: 00683077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006830A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00683159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00683187

Strings

0, xrefs: 00683063

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 113a5393569fe9c0d37a4395adb34eb23de135bd34039ffbb6c4b5ea21795295
Instruction ID: 275e7ac173122368abaa191a1262557114efd0591c4c7f8b5341fa7d21a1fb40
Opcode Fuzzy Hash: 113a5393569fe9c0d37a4395adb34eb23de135bd34039ffbb6c4b5ea21795295
Instruction Fuzzy Hash: B951EF316083209AD765BF28C849AABBBE6AF55F50F040B2DF8C5D7390DB70CA448B56

Function 00682C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00682CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00682CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00682D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,006E6890,00000000), ref: 00682D5A

Strings

0, xrefs: 00682CA4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6981966ae49cb01b37e546307ea74b85ad297bd88c3c96a40fb4e1fd10b49234
Instruction ID: 2c9cc931f827a3fd3ff9dde97e76860d50aee89981416e68d370b7cb5d54480d
Opcode Fuzzy Hash: 6981966ae49cb01b37e546307ea74b85ad297bd88c3c96a40fb4e1fd10b49234
Instruction Fuzzy Hash: D941A0702053029FD720EF24C855B5ABBEAFF85320F144A1DF965973A1D770E905CBA6

Function 0069DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0069DAD9

Part of subcall function 006279AB: _memmove.LIBCMT ref: 006279F9

Strings

none, xrefs: 0069DBB4
cdecl, xrefs: 0069DB30
stdcall, xrefs: 0069DB5B
winapi, xrefs: 0069DB4A

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 12b5e6712010baf69ace5c0d92e8d5a9641e928d9d574e3fb50aa0a9c1530e29
Instruction ID: cab9ba2f61e32651b49d59a3f1057e48428daaeceaf90f336370f0acfef7cec1
Opcode Fuzzy Hash: 12b5e6712010baf69ace5c0d92e8d5a9641e928d9d574e3fb50aa0a9c1530e29
Instruction Fuzzy Hash: 9531967190061AAFCF10EF94CC819EEB7BAFF05310B10862EE86597BD5DB71A905CB94

Function 00679372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 006793F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00679409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00679439

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Strings

ComboBox, xrefs: 00679380
ListBox, xrefs: 006793B5

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 6c8e70735c04a55275087f987548875c0c2134bfa472f1fa1994cdc5dd9358c0
Instruction ID: fbaa21454e52dc2292e5ac371c1b0f2042d53ccb3b5e097b581cf930571bd008
Opcode Fuzzy Hash: 6c8e70735c04a55275087f987548875c0c2134bfa472f1fa1994cdc5dd9358c0
Instruction Fuzzy Hash: A9210471900104BADB14ABB4DC86CFFB7BBDF06320B14812DF929972E1DB340D4ADA20

Function 00691B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00691B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00691B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00691B96
InternetCloseHandle.WININET(00000000), ref: 00691BDD

Part of subcall function 00692777: GetLastError.KERNEL32(?,?,00691B0B,00000000,00000000,00000001), ref: 0069278C
Part of subcall function 00692777: SetEvent.KERNEL32(?,?,00691B0B,00000000,00000000,00000001), ref: 006927A1

Strings

, xrefs: 00691B87

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: d764a1a0a1009bc89af790590f7f52918db10d96da0caeec730e7d7b2e4d2d53
Instruction ID: c26ebccf7657998e01f52c9fbcdd6c706c31ca1b94b9ea87eef02384228187b8
Opcode Fuzzy Hash: d764a1a0a1009bc89af790590f7f52918db10d96da0caeec730e7d7b2e4d2d53
Instruction Fuzzy Hash: EE21C2B1500209BFEF119F64DCC5EBF76EFEB4A744F20012EF405AA640EA309D059B65

Function 006A6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00621D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00621D73
Part of subcall function 00621D35: GetStockObject.GDI32(00000011), ref: 00621D87
Part of subcall function 00621D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00621D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 006A66D0
LoadLibraryW.KERNEL32(?), ref: 006A66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 006A66EC
DestroyWindow.USER32(?), ref: 006A66F4

Strings

SysAnimate32, xrefs: 006A66AB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 4b6dda74b612bf2fff4f9e7c6e7b58cd25226d3997f3b4a74a3182ba35ea6022
Instruction ID: 5464bc62420d5c10ea08b73615e9c79bc2430ed5e04db141823dde7a557a54dc
Opcode Fuzzy Hash: 4b6dda74b612bf2fff4f9e7c6e7b58cd25226d3997f3b4a74a3182ba35ea6022
Instruction Fuzzy Hash: 5621C271100205ABEF106F64DC80EFB77AFEF1A368F182629F91092290D771DC419F61

Function 0068703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0068705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00687091
GetStdHandle.KERNEL32(0000000C), ref: 006870A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 006870DD

Strings

nul, xrefs: 006870D8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 5ea3471754d2c3f13ea9fc24173e20b2cb51ad9ae8de254b161b7d4655a1174b
Instruction ID: a9960267f215ef975d221352b6082c5a055abe3d5693e783f3489ed087a1d7a4
Opcode Fuzzy Hash: 5ea3471754d2c3f13ea9fc24173e20b2cb51ad9ae8de254b161b7d4655a1174b
Instruction Fuzzy Hash: 2B217FB4504209ABDB20AF68D805A9A77FAAF95720F304719F9A0D72D0D771E940CB61

Function 0068710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0068712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0068715D
GetStdHandle.KERNEL32(000000F6), ref: 0068716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 006871A8

Strings

nul, xrefs: 006871A3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 441a145b94c93b3457ad1b4aaae9d8ba7099299a5135af87eb8ff1ceb88fc552
Instruction ID: cdc5e49e2fd8e65a27f0c38612cc51eda70f81f3213fcb0d75dd6467cedb05ae
Opcode Fuzzy Hash: 441a145b94c93b3457ad1b4aaae9d8ba7099299a5135af87eb8ff1ceb88fc552
Instruction Fuzzy Hash: 8B2190756082059BDB20AF689C08A9AB7EAAF55724F340719F9E0D73D0D770E941CB51

Function 0068AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0068AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0068AF13
__swprintf.LIBCMT ref: 0068AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,006AF910), ref: 0068AF6A

Strings

%lu, xrefs: 0068AF26

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 7a0a3d29e8a652a2399a8cdf49a7f4600c690a1248e5ad137dc565eeed20027b
Instruction ID: 3aaed30ec3a0c252880393a0b56ab33d6999a4b0fa712bff5db96a741c2f0e08
Opcode Fuzzy Hash: 7a0a3d29e8a652a2399a8cdf49a7f4600c690a1248e5ad137dc565eeed20027b
Instruction Fuzzy Hash: AC217434A00109AFDB50EF94D985DAE77B9EF89704B104069F909DB351DB31EE45CF25

Function 0067A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

Part of subcall function 0067A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0067A399
Part of subcall function 0067A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0067A3AC
Part of subcall function 0067A37C: GetCurrentThreadId.KERNEL32 ref: 0067A3B3
Part of subcall function 0067A37C: AttachThreadInput.USER32(00000000), ref: 0067A3BA

GetFocus.USER32 ref: 0067A554

Part of subcall function 0067A3C5: GetParent.USER32(?), ref: 0067A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0067A59D
EnumChildWindows.USER32(?,0067A615), ref: 0067A5C5
__swprintf.LIBCMT ref: 0067A5DF

Strings

%s%d, xrefs: 0067A5D9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: e8e69906e939dea8319d1fa561912997d15318bf14892a8ecf983988c10e0706
Instruction ID: e2f3c72db81a4328d7ac43d6946adb5e931db5631a24029049573e0c5e645139
Opcode Fuzzy Hash: e8e69906e939dea8319d1fa561912997d15318bf14892a8ecf983988c10e0706
Instruction Fuzzy Hash: AE11B471600208BBDF507FA4EC85FEE777E9F89710F048079B90CAA192CA7059458B7A

Function 00682017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00682048

Strings

APPEND, xrefs: 00682081
EXISTS, xrefs: 00682070
REMOVE, xrefs: 0068204E
KEYS, xrefs: 0068205F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 2d4cffe051fafae30cc830d667bd381ea2f9aa453c148aeecf8ac949ad707c88
Instruction ID: dca717edb713ab4506fe47ac858a8e518c8e7da4cf423d4ccda3efa32f1a836f
Opcode Fuzzy Hash: 2d4cffe051fafae30cc830d667bd381ea2f9aa453c148aeecf8ac949ad707c88
Instruction Fuzzy Hash: 6A115B30D0411A8FCF40EFA4D9518EEB7B6FF16304F10856DD855A7352EB32691ACB51

Function 0069EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0069EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0069EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0069F07E
CloseHandle.KERNEL32(?), ref: 0069F0FF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 3f17af1d768a1972aeba47c2bf3e55a6cafb86ff041d424ccb4c2bd234abe71d
Instruction ID: 4a4a8c3ba2244899357247eec115bb76601ea9cacf152779f7b5ecf66855a75f
Opcode Fuzzy Hash: 3f17af1d768a1972aeba47c2bf3e55a6cafb86ff041d424ccb4c2bd234abe71d
Instruction Fuzzy Hash: 528182716007109FDB60EF24DC46B6AB7EAAF88720F04881DF595DB792DB71AC408F96

Function 006A02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 006A10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006A0038,?,?), ref: 006A10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006A0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006A03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 006A040E
RegCloseKey.ADVAPI32(?,?), ref: 006A043A
RegCloseKey.ADVAPI32(00000000), ref: 006A0447

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: f4e8aa970ec4a3d25d967b34da4b9a56ad83506aa6390c097a06f5b79847894f
Instruction ID: a872cf3b05d6b7f8343387ee97df18f22361ac392e296c22721ba8ef54419bb3
Opcode Fuzzy Hash: f4e8aa970ec4a3d25d967b34da4b9a56ad83506aa6390c097a06f5b79847894f
Instruction Fuzzy Hash: A0515A31208205AFDB44EF64D891E6EB7EAFF89304F04892DB596872A1DB31ED05CF56

Function 0068E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0068E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0068E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0068E8F2

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0068E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0068E91F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: d9387aee7cffb5194ac9ed1327d819af81dc8402fec7a80339d0b3a13a34ffc4
Instruction ID: 25bac0eaf7ec536341f1ed57462a97c592b1890d4204025aadaed9058e72c98b
Opcode Fuzzy Hash: d9387aee7cffb5194ac9ed1327d819af81dc8402fec7a80339d0b3a13a34ffc4
Instruction Fuzzy Hash: A4513B35A00615DFDF40EFA4C981AADBBF6EF49310B148099E849AB361CB32ED41CF65

Function 006AA2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68bc1ea14f6828fc7a0f447c47e8f3d66a1783155e707fdb0f8035e97df55fc
Instruction ID: c8afc316ec46127bd50aa5e024e850bd0022fdeed9a0282346ccc7acd6fc7b19
Opcode Fuzzy Hash: e68bc1ea14f6828fc7a0f447c47e8f3d66a1783155e707fdb0f8035e97df55fc
Instruction Fuzzy Hash: 25419035900214ABDB20FFA8CC44BE9BBA6EB0B310F144166F955E72A1D770AD41DE62

Function 00622344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00622357
ScreenToClient.USER32(006E67B0,?), ref: 00622374
GetAsyncKeyState.USER32(00000001), ref: 00622399
GetAsyncKeyState.USER32(00000002), ref: 006223A7

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: cd31f26e537a76b26d29caac153ca8ee787263e6785caa9d9e33160172e0eef2
Instruction ID: a05ddd6b653a08bdffcc4e4248d921856556f77863c85b3830cc4849066b6a3c
Opcode Fuzzy Hash: cd31f26e537a76b26d29caac153ca8ee787263e6785caa9d9e33160172e0eef2
Instruction Fuzzy Hash: D2416F31504626FFDF159FA4D844AE9BBB6FB05321F204319F82496290C7746E54DF91

Function 00676920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0067695D
TranslateAcceleratorW.USER32(?,?,?), ref: 006769A9
TranslateMessage.USER32(?), ref: 006769D2
DispatchMessageW.USER32(?), ref: 006769DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006769EB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 8504a22ee739316315f26cc0d3ee219433765f743d294645a792ba4e1c1b8e17
Instruction ID: 7393674eacf7a7e607e99a0d97652d1fe5b9a8f8692e371da10e6be699b1345d
Opcode Fuzzy Hash: 8504a22ee739316315f26cc0d3ee219433765f743d294645a792ba4e1c1b8e17
Instruction Fuzzy Hash: 7831F831900B47AEDB20CF74CC84FF67BAFAB12340F109169F529C62A1E7749885DB90

Function 00678F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00678F12
PostMessageW.USER32(?,00000201,00000001), ref: 00678FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00678FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00678FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00678FDA

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 17a293e38fd30ac223c6a6362da36a2aa3a8e96900f1689e4a1fdd364143848a
Instruction ID: 53e12700a4ac5298fc03abd0981ca69d44a289dfc1246e4859ba8e4f0b4ab220
Opcode Fuzzy Hash: 17a293e38fd30ac223c6a6362da36a2aa3a8e96900f1689e4a1fdd364143848a
Instruction Fuzzy Hash: 0A31CD71500219EFDB10CFA8D94CADE7BB6EB05315F108229F928E72D0CBB49D10CB91

Function 0067B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0067B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0067B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0067B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0067B742
_wcsstr.LIBCMT ref: 0067B74C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 83f0d4d12310c1510fb44f44139cfb0178ef0b4a1cbe1cbd9b3739168327c31f
Instruction ID: aa1d5f57fd5ad26174877ef3452cd7700b49ef20929b68bb0dd5986c4131e0a8
Opcode Fuzzy Hash: 83f0d4d12310c1510fb44f44139cfb0178ef0b4a1cbe1cbd9b3739168327c31f
Instruction Fuzzy Hash: CB21D731204244BAEB295B799C49F7B7B9ADF4A720F10903DFD09CA2A1EF61DC4197A1

Function 006AB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

GetWindowLongW.USER32(?,000000F0), ref: 006AB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 006AB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 006AB489
GetSystemMetrics.USER32(00000004), ref: 006AB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00691184,00000000), ref: 006AB4D0

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: c4e110bd0230e06be9b42587b44f5847c15eb29c0459a0a497cf26ae5a88f01d
Instruction ID: 839b4904dffebc5f5da06424363184f51719e4f2926487b7a648526592ddd349
Opcode Fuzzy Hash: c4e110bd0230e06be9b42587b44f5847c15eb29c0459a0a497cf26ae5a88f01d
Instruction Fuzzy Hash: 80218231910265AFCB10AF78DC44AA63BE6EB1A720F105728F925C62E7E7309C11DF50

Function 006797E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00679802

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00679834
__itow.LIBCMT ref: 0067984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00679874
__itow.LIBCMT ref: 00679885

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 6a0c282b6725c54164dfba97ddaf3b03c81b5db587a54de729d9a56f064d6ae8
Instruction ID: 5af47d1574233f60b92119ea1b40d11c65e4b335d4c5e56cf3517f548df0780e
Opcode Fuzzy Hash: 6a0c282b6725c54164dfba97ddaf3b03c81b5db587a54de729d9a56f064d6ae8
Instruction Fuzzy Hash: EC21B831600214ABDB10AB659C86EEE7BFADF4A710F084429F90897351D6709D418BE6

Function 006212F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0062134D
SelectObject.GDI32(?,00000000), ref: 0062135C
BeginPath.GDI32(?), ref: 00621373
SelectObject.GDI32(?,00000000), ref: 0062139C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: c4a3d6ac9b80cd59b702eb96233a1b43c8448d055739128947067fa63b035eb3
Instruction ID: fdd5fc9133ab3a86141efaad8b3931c2b6f0e7e6b006e9883f421d16f7098aa5
Opcode Fuzzy Hash: c4a3d6ac9b80cd59b702eb96233a1b43c8448d055739128947067fa63b035eb3
Instruction Fuzzy Hash: DE219270914754EFDB10DF65EC447AE3BBBFB223A1F145225F8109A2A0D371A895CFA1

Function 0067C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0067C176
_memcmp.LIBCMT ref: 0067C194
_memcmp.LIBCMT ref: 0067C1A7
_memcmp.LIBCMT ref: 0067C1BF
_memcmp.LIBCMT ref: 0067C1D7

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9f03bee70e9744d0f445d08dd6ef3562c72f35333905c8cc43e072d7c024e06a
Instruction ID: 829c46f05f72cce28126b14ac829471c6d45085b433251fdf3a34ca9e6945484
Opcode Fuzzy Hash: 9f03bee70e9744d0f445d08dd6ef3562c72f35333905c8cc43e072d7c024e06a
Instruction Fuzzy Hash: 1E0192A16041067BE604A6209C52EEB67DF9B223B4B85813DFD089A383FB50DE5183A4

Function 00684D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00684D5C
__beginthreadex.LIBCMT ref: 00684D7A
MessageBoxW.USER32(?,?,?,?), ref: 00684D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00684DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00684DAC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 733efb23067e2cd772aff96af623a510f0eed786cf46d956f206bf31718b013a
Instruction ID: c70a85762ae1226e229930eb0c1e979c43ae8b79ec178dee6f9536f36424d369
Opcode Fuzzy Hash: 733efb23067e2cd772aff96af623a510f0eed786cf46d956f206bf31718b013a
Instruction Fuzzy Hash: 36110872904245BFCB01ABA8DC44ADA7FAEEB45320F144365F914D7351DA719D048BA1

Function 0067874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00678766
GetLastError.KERNEL32(?,0067822A,?,?,?), ref: 00678770
GetProcessHeap.KERNEL32(00000008,?,?,0067822A,?,?,?), ref: 0067877F
HeapAlloc.KERNEL32(00000000,?,0067822A,?,?,?), ref: 00678786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0067879D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 31808fea3b78362568ac7b059de5521957c93b88936778102e073ebb0362e9bc
Instruction ID: 9223df865bccf2f27ef51b5fb088b9cedad43861f10bd797c0576a5293c748c6
Opcode Fuzzy Hash: 31808fea3b78362568ac7b059de5521957c93b88936778102e073ebb0362e9bc
Instruction Fuzzy Hash: 34014F71240204EFDB245FAADC4CDAB7B6EEF863557204429F84AC3260DA31DC00CEA1

Function 006854E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00685502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00685510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00685518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00685522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0068555E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 530b6509b0628d62e5734b6fe2e8eee0644dc76fdea662f5e7e929626095bbcb
Instruction ID: 54303e06c4f88ab7d6b53bbc80bd29787b044e94ef5b5ba25f83cf827786c10d
Opcode Fuzzy Hash: 530b6509b0628d62e5734b6fe2e8eee0644dc76fdea662f5e7e929626095bbcb
Instruction Fuzzy Hash: 82012135D00A1DDBCF00FFE5E8495EDBB7AFB09711F400596E942B2240DB305A55CBA2

Function 00677652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?,?,0067799D), ref: 0067766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?), ref: 0067768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?), ref: 00677698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?), ref: 006776A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0067758C,80070057,?,?), ref: 006776B4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: cc4c0562b9586d1c964ae1b56e87bdb6aba9b853e925eff5326da773e24f5c80
Instruction ID: 4ead645a5596e807462867a8b59ad4f9e3cee1670d05add9dcc2ba52ae5b3c48
Opcode Fuzzy Hash: cc4c0562b9586d1c964ae1b56e87bdb6aba9b853e925eff5326da773e24f5c80
Instruction Fuzzy Hash: E901D476600604FBDB106F58DC04BAABBBEEB45751F204128FD08D2225E735EE008BA0

Function 006785F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00678608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00678612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00678621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00678628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0067863E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 0a4d714d98111095989e475b630a1c351074ec31852dc77e19cf99b9786094bf
Instruction ID: cb7b283c840fff3b7739493594f3b34f3fb27e72fbfa2dd1ac6048c9e80a6241
Opcode Fuzzy Hash: 0a4d714d98111095989e475b630a1c351074ec31852dc77e19cf99b9786094bf
Instruction Fuzzy Hash: A1F04F31241204BFEB101FE5DC9DEAB3BAEEF8A755B004425F94DC7250CBA1AD41DE61

Function 00678652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00678669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00678673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00678682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00678689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0067869F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 1311948796382c99daebec635f2b2eb278ceea4c7b9aa43289895e135ca3f999
Instruction ID: bf37762ba86a9b73aafe8b80663c3330a6bbacadf7ae8accc2b7393cc113ce0b
Opcode Fuzzy Hash: 1311948796382c99daebec635f2b2eb278ceea4c7b9aa43289895e135ca3f999
Instruction Fuzzy Hash: CAF04471240214BFDB112FA5DC8CEA73BAEEF46755B100025F549C7250DB61AD41DE62

Function 0067C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0067C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0067C6D1
MessageBeep.USER32(00000000), ref: 0067C6E9
KillTimer.USER32(?,0000040A), ref: 0067C705
EndDialog.USER32(?,00000001), ref: 0067C71F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 897c9abfd1412139dab84a25ba7e2e95cec7801f60fba90523687c7e9bb284e3
Instruction ID: c3225701957b4ae5ba0a837fddc39bdf99e8aa93fa5ffa7b86eab8756ad20a16
Opcode Fuzzy Hash: 897c9abfd1412139dab84a25ba7e2e95cec7801f60fba90523687c7e9bb284e3
Instruction Fuzzy Hash: F401A230400704ABEB24AF60EC8EF9677BAFF01701F00566DF586A14E1DBE0A9548F91

Function 006213B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006213BF
StrokeAndFillPath.GDI32(?,?,0065BAD8,00000000,?), ref: 006213DB
SelectObject.GDI32(?,00000000), ref: 006213EE
DeleteObject.GDI32 ref: 00621401
StrokePath.GDI32(?), ref: 0062141C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 27470ae03fe91ab82aadab38dc203df77460206c513cf32db7594e2e94a01fe6
Instruction ID: b76607bef88cd3aefcf17c1a17adb11b3d54bce4284ee6c0d70eb92c9aab70e0
Opcode Fuzzy Hash: 27470ae03fe91ab82aadab38dc203df77460206c513cf32db7594e2e94a01fe6
Instruction Fuzzy Hash: F2F01D30024748DBDB156F56EC4C7593BA7AB22366F04A224F4694C1F1C73159A5DF21

Function 00632E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00640FF6: std::exception::exception.LIBCMT ref: 0064102C
Part of subcall function 00640FF6: __CxxThrowException@8.LIBCMT ref: 00641041

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 00627BB1: _memmove.LIBCMT ref: 00627C0B

__swprintf.LIBCMT ref: 0063302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00632EC6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: b4d1bf774bde50a54594cff225b01c0d68d3fcef24630ea3d2292448f67eea4a
Instruction ID: 104a6c344b3462095c67a848db9af60b83255ab775f9b50b59df329d21a4646c
Opcode Fuzzy Hash: b4d1bf774bde50a54594cff225b01c0d68d3fcef24630ea3d2292448f67eea4a
Instruction Fuzzy Hash: F1918D71108721AFC768EF24E885CAFB7A6EF85750F00491DF4429B2A1DB30EE44CB96

Function 0067B7B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0067B981

Strings

Container, xrefs: 0067B8FE
AutoIt3GUI, xrefs: 0067B8F9
%k, xrefs: 0067BA24

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%k
API String ID: 3565006973-671182982
Opcode ID: 5a02d9230dea435bef12e31a87429e665f6bf27cb6562d2e87545783f2d180de
Instruction ID: f59cb6cfc6a86f009ab36f9c9eac74112fab3feddd0ff1e96d15f2f7c9d5bcfc
Opcode Fuzzy Hash: 5a02d9230dea435bef12e31a87429e665f6bf27cb6562d2e87545783f2d180de
Instruction Fuzzy Hash: 86913A706006019FDB64DF64C884BAABBFAFF49710F14956EE949CB791DB70E841CB60

Function 0064524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006452DD

Part of subcall function 00650340: __87except.LIBCMT ref: 0065037B

Strings

pow, xrefs: 006452B5, 006452D2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 6fc491e90d28f24ac1c6242890a7d3244ceb60f9e9d5f39dc9902ae81b18bb7a
Instruction ID: c40364e4cc3a80d9dffdb64bffca4338110927bbb9192b5343c0ad6742971439
Opcode Fuzzy Hash: 6fc491e90d28f24ac1c6242890a7d3244ceb60f9e9d5f39dc9902ae81b18bb7a
Instruction Fuzzy Hash: 15515A61A0D602C7EB126B24C9413FE2BD39B40751F20895DE896863E7EF74CDDC9A46

Function 0064023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00640280
+, xrefs: 00640277

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 57b6780227f3cdd532fbdaca9a56abf60a80b56d0b18fe4aabf0efacda039930
Instruction ID: 92e34a07a04d948e9136ea495a5ec54abdd34ee5ed12c07391d8f66c76519484
Opcode Fuzzy Hash: 57b6780227f3cdd532fbdaca9a56abf60a80b56d0b18fe4aabf0efacda039930
Instruction Fuzzy Hash: 40515735504656DFDF25DF28C488AFA7BA6EF1A310F148099FC969B3A0D7B09C42CB64

Function 00633297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006333D7
_memmove.LIBCMT ref: 00633470
_free.LIBCMT ref: 00633496
_memmove.LIBCMT ref: 00633549

Strings

Oac, xrefs: 00633482

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove$_free
String ID: Oac
API String ID: 2620147621-752515563
Opcode ID: a6d51b5f05cd1505be735699eefa0328394512011fa593cb590bc913a70fee1e
Instruction ID: 8aa7564288e0c0e382cc11168094ceb5d0d100e3d52b27914e0f3c18f7cf1649
Opcode Fuzzy Hash: a6d51b5f05cd1505be735699eefa0328394512011fa593cb590bc913a70fee1e
Instruction Fuzzy Hash: C5515A71A083519FDB64CF28C891B6BBBE6BF85314F04492DE989C7351DB31EA41CB92

Function 006362F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006363A8
_memmove.LIBCMT ref: 00636446
_memset.LIBCMT ref: 0063646A

Strings

ERCP, xrefs: 00636313

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 981d4e2e997f1b81b6f954fc3e80f10b5c81d8d9af810993e1444560540156a1
Instruction ID: 5d54b0ce08c3aef74b617b636084185bdc84df39b5b7617738d3074f257da368
Opcode Fuzzy Hash: 981d4e2e997f1b81b6f954fc3e80f10b5c81d8d9af810993e1444560540156a1
Instruction Fuzzy Hash: C1519E71900319EBDB24CF65C881BEABBF6EF04714F20C56EE64ACA341E7719585CB84

Function 006A7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 006A76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 006A76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 006A7708

Strings

SysMonthCal32, xrefs: 006A769B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 42223f82a27a3128eb1bb228dafae16afde976230236f35fef155ca7d3dfb134
Instruction ID: d875d1d18da2c57982a42b1054777f9ec921948c30e52f73483793fd5c9a435d
Opcode Fuzzy Hash: 42223f82a27a3128eb1bb228dafae16afde976230236f35fef155ca7d3dfb134
Instruction Fuzzy Hash: 4521D332500218BBDF11DF94CC42FEA3B6AEF49714F111214FE156B1D0D6B1AC518FA0

Function 006A6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 006A6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 006A6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 006A6FDF

Strings

Listbox, xrefs: 006A6F77

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9f96ffb5b596894394bd26627b6e49efa1bdcbca3e08733232b93170026e3a64
Instruction ID: 733c3dfcd5635093ef3c241447764abd7b329acfda0fb5e519e8a397dcb9886f
Opcode Fuzzy Hash: 9f96ffb5b596894394bd26627b6e49efa1bdcbca3e08733232b93170026e3a64
Instruction Fuzzy Hash: A6216232610118BFDF11AF54EC85EFB37ABEF8A764F158128F9159B290C671AC518FA0

Function 006A797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 006A79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 006A79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 006A7A03

Strings

msctls_trackbar32, xrefs: 006A79B8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: bdd89fcad17f50b2c064134b3bb4845567a711e2f9594da2241bb69602e14130
Instruction ID: cd83a99445b81b35309e63678f836804cee8c1c2ce5c001f8bcf6fee52ad991c
Opcode Fuzzy Hash: bdd89fcad17f50b2c064134b3bb4845567a711e2f9594da2241bb69602e14130
Instruction Fuzzy Hash: 2511C132244208BAEF10AF64CC05FEB77AAEF8A764F020529FA41A6191D271A811CF60

Function 00624C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00624C2E), ref: 00624CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00624CB5

Strings

GetNativeSystemInfo, xrefs: 00624CAF
kernel32.dll, xrefs: 00624C9E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 507309feb58cc85d65f1614859f6098a098d94e013c9649f78789e26ace82255
Instruction ID: 036a1a6e7a8d5df0a7509f2037b53fca6b7fe573698dbba228911cdd578dacb9
Opcode Fuzzy Hash: 507309feb58cc85d65f1614859f6098a098d94e013c9649f78789e26ace82255
Instruction Fuzzy Hash: 0ED01270610723CFD7206FB5DA58646B6E7AF06751B118839D886D6250DA70DC80CE61

Function 00624D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00624D2E,?,00624F4F,?,006E62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00624D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00624D81

Strings

kernel32.dll, xrefs: 00624D6A
Wow64DisableWow64FsRedirection, xrefs: 00624D7B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 759da8abdfcca06438a02f04b2822610b8e62fc8ff8c67beed15debae626de3a
Instruction ID: 9c3e0df2402d4bf54f13a1c9689b30989ebbef1943ba93f56c1f7a442b177091
Opcode Fuzzy Hash: 759da8abdfcca06438a02f04b2822610b8e62fc8ff8c67beed15debae626de3a
Instruction Fuzzy Hash: D1D01270510723CFD7206F71D84865676EAAF16391B11DC3AD486D6350EA70D880CE61

Function 00624D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00624CE1,?), ref: 00624DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00624DB4

Strings

kernel32.dll, xrefs: 00624D9D
Wow64RevertWow64FsRedirection, xrefs: 00624DAE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 5762a3b56abe619b611d1cf063ee8d384e1c201dddb6427ab20a58d00f9fcc24
Instruction ID: 967aca19f3765d82ec1037469b22d1828f81fc4e7c96a11cafb3c229f92fad34
Opcode Fuzzy Hash: 5762a3b56abe619b611d1cf063ee8d384e1c201dddb6427ab20a58d00f9fcc24
Instruction Fuzzy Hash: 5ED01271550723CFD7306F71D84868676E6AF06355B11CC3AD8C5D6250EB70D880CE61

Function 006A1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,006A12C1), ref: 006A1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006A1092

Strings

RegDeleteKeyExW, xrefs: 006A108C
advapi32.dll, xrefs: 006A107B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d9a4bff79280023152304a6b17cd4c069f5093bb8e3a183e6068a5119176a6c5
Instruction ID: b864369abc370ff02e4f45efd2cf951612ea78f0af0d9a55437250754e29dd7a
Opcode Fuzzy Hash: d9a4bff79280023152304a6b17cd4c069f5093bb8e3a183e6068a5119176a6c5
Instruction Fuzzy Hash: 06D0EC31910712CFD7206B75D96856A76E6AF06351B129C2AA4C5DA250DB70D8808A51

Function 006993F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00699009,?,006AF910), ref: 00699403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00699415

Strings

kernel32.dll, xrefs: 006993FE
GetModuleHandleExW, xrefs: 0069940F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: a1dda171b4b13f891372c024076208e7b9bc569f238d5ee85fefdbb12fafa37b
Instruction ID: 477feada0314e17f04c34af51768cc23373a6528397fbffcba720f51605d2761
Opcode Fuzzy Hash: a1dda171b4b13f891372c024076208e7b9bc569f238d5ee85fefdbb12fafa37b
Instruction Fuzzy Hash: A5D01234514713CFDB306FB5D94854676EBAF26751B11C83ED485D6A50D670D880CB61

Function 00661B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00661B42
__swprintf.LIBCMT ref: 00661B73

Strings

%.3d, xrefs: 00661B4D
WIN_XPe, xrefs: 00661BB2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 26128cce35bd17bc56c1367ed955ef08aacb0d8a18932b0d0b899d75a952558d
Instruction ID: aa7a2594e731fc3aacab195335ea842bf31335514be0cbb072eebc472ed03a73
Opcode Fuzzy Hash: 26128cce35bd17bc56c1367ed955ef08aacb0d8a18932b0d0b899d75a952558d
Instruction Fuzzy Hash: 39D01271C0411CEACB449BE0DC449F9737FAB0A311F180593B50295000F2349B86DF25

Function 006776C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddc295d04edc00465aad524984119eca507cecd738de7c2aa9c8277b3c5e1d1
Instruction ID: a4fc8eaaa4c46c73d0365caaf851a8c74bf2b73d9d11cc28f78c2a010dc579df
Opcode Fuzzy Hash: 7ddc295d04edc00465aad524984119eca507cecd738de7c2aa9c8277b3c5e1d1
Instruction Fuzzy Hash: 4CC16E75A04216EFDB14CFA4C884EAEB7B6FF48714B1185A9E909EB351D730ED81CB90

Function 0069E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0069E3D2
CharLowerBuffW.USER32(?,?), ref: 0069E415

Part of subcall function 0069DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0069DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0069E615
_memmove.LIBCMT ref: 0069E628

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 76a222f0c6cc4e2af40766396faccba3a3fe541522413bec65b78186dd2dbe90
Instruction ID: b097295a26e853b58eaa8e1e9530256ff7866e5045f9f69dfed93818e03a6060
Opcode Fuzzy Hash: 76a222f0c6cc4e2af40766396faccba3a3fe541522413bec65b78186dd2dbe90
Instruction Fuzzy Hash: 78C18E71A083118FCB54DF28C48095ABBE6FF88714F14896EF8999B751D732E946CF82

Function 006983A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006983D8
CoUninitialize.OLE32 ref: 006983E3

Part of subcall function 0067DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0067DAC5

VariantInit.OLEAUT32(?), ref: 006983EE
VariantClear.OLEAUT32(?), ref: 006986BF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: ed8dc226591f7daa3b3a762abb4e81db0d9c5e04af35167151542b42f5d5fdb3
Instruction ID: 37350d2769d0a60d61a1a9163388cc968a6160c2cc414d7ec2cc760e499e8214
Opcode Fuzzy Hash: ed8dc226591f7daa3b3a762abb4e81db0d9c5e04af35167151542b42f5d5fdb3
Instruction Fuzzy Hash: 75A16B75604B119FDB50DF14C481A2AB7EABF89324F08884DF99A9B7A1CB30EC44CF56

Function 00676DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00676E04
SysAllocString.OLEAUT32(00000000), ref: 00676EAD
VariantCopy.OLEAUT32 ref: 00676EDC
VariantClear.OLEAUT32(?), ref: 00676F03

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 2e30312899f9ccac44d863f70d037bfea5439acfcc4d68902ef930cd659ab4a5
Instruction ID: 6c216d8c7302e9e6fb39d5248d276d6b4cdce77eef8e167b3a5053edef2657f5
Opcode Fuzzy Hash: 2e30312899f9ccac44d863f70d037bfea5439acfcc4d68902ef930cd659ab4a5
Instruction Fuzzy Hash: DD51C8706087019ADB70AF75D891A6EB3E7AF49310F20D81FF59ECB292DB749880DB15

Function 006A9A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0120EDF0,?), ref: 006A9AD2
ScreenToClient.USER32(00000002,00000002), ref: 006A9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 006A9B72

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 2ecd416cb72034e2b1e6f580af8d5b5ff62bab3619cb8fdf2198fc4bb06e27f5
Instruction ID: d4aedc0e8d8409c035a863306756ec34341bd4c57dedfd9860edf1de5d945436
Opcode Fuzzy Hash: 2ecd416cb72034e2b1e6f580af8d5b5ff62bab3619cb8fdf2198fc4bb06e27f5
Instruction Fuzzy Hash: D351FB34A00649AFCF14EF58D8819EE7BB7EB56360F248559F9159B3A0D730AD41CFA0

Function 00696CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00696CE4
WSAGetLastError.WSOCK32(00000000), ref: 00696CF4

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00696D58
WSAGetLastError.WSOCK32(00000000), ref: 00696D64

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 932d3564bb92f67bcc4f3bf8532b15661b28e9d2d4695d7bc24a93d23d0f0a7a
Instruction ID: d2fa416fb39036a206056c8c06a84a8055f3ba63618914f0f1acac02efc4d38d
Opcode Fuzzy Hash: 932d3564bb92f67bcc4f3bf8532b15661b28e9d2d4695d7bc24a93d23d0f0a7a
Instruction Fuzzy Hash: 1841A574740710AFEB60AF24EC86F7A77EA9F48B10F44841CFA599B2D2DA719C018F55

Function 0069672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,006AF910), ref: 006967BA
_strlen.LIBCMT ref: 006967EC

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: fa620fa70de28ef34c6d3845e74e1ba3f31a7b58aadeb165c9ce3515a6576329
Instruction ID: 14488602eb2f9ee2a6c9fe15077bfa8b9e50176bf8ee17f6adc9331c50e62795
Opcode Fuzzy Hash: fa620fa70de28ef34c6d3845e74e1ba3f31a7b58aadeb165c9ce3515a6576329
Instruction Fuzzy Hash: 6341B531A00614ABCF54EBA4DDC5EBEB3AFAF44314F148169F81A9B291DB30AD01CB65

Function 0068BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0068BB09
GetLastError.KERNEL32(?,00000000), ref: 0068BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0068BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0068BB80

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 712f6fe2acf00d363a065d1a805c62dc246ca27ff4ea6aa61df6e9123ec18309
Instruction ID: 82f08568a7c939f296be7ff8d4d7fdf459354ad35d19ed819ae3e499ff46f093
Opcode Fuzzy Hash: 712f6fe2acf00d363a065d1a805c62dc246ca27ff4ea6aa61df6e9123ec18309
Instruction Fuzzy Hash: 63412B35600A20DFDB10EF15D585A59BBE2EF89320F09C488E84A9B762CB31FD41CFA5

Function 006A8AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006A8B4D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 5ace80a9a586b18c99fc8ef3996eb1af19776d56a959b1d42a9cf3dd506abf2b
Instruction ID: ede7c012b079e4358d14ba940e5e57a31a875e0e462de7e7e392a3bdd703ddd5
Opcode Fuzzy Hash: 5ace80a9a586b18c99fc8ef3996eb1af19776d56a959b1d42a9cf3dd506abf2b
Instruction Fuzzy Hash: D031ADB4600214BEEB24BE58CC85BE937A7EB17310F244916FA51D73A1DF30AD408F61

Function 006AADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 006AAE1A
GetWindowRect.USER32(?,?), ref: 006AAE90
PtInRect.USER32(?,?,006AC304), ref: 006AAEA0
MessageBeep.USER32(00000000), ref: 006AAF11

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4be7d7e8288940f754526821b563de76ea5234be82112842c01b81acad368f4d
Instruction ID: dffb5a15512ae02fd936a39f52f12c17c123b8460b93c8a096f0e840d10e7649
Opcode Fuzzy Hash: 4be7d7e8288940f754526821b563de76ea5234be82112842c01b81acad368f4d
Instruction Fuzzy Hash: 3A418070600215DFCB11EF98C884AA9BBF7FB8A340F1481AAE4148B351D731AC02DF62

Function 00680FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00681037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00681053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 006810B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0068110B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d35ef69e6d9b873211720b2d399e57e51e95bc0ed4139fd0f01043d5ea0837eb
Instruction ID: 1c03d8ea19fc99cba6dd95861883cc15e0ee8bf8566133d83b5a49857ea6a80a
Opcode Fuzzy Hash: d35ef69e6d9b873211720b2d399e57e51e95bc0ed4139fd0f01043d5ea0837eb
Instruction Fuzzy Hash: 93315E30E40688AEFF30AB658C05BF9BBAFAF47310F04431AE5845A2D1CB7549C79765

Function 00681121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00681176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00681192
PostMessageW.USER32(00000000,00000101,00000000), ref: 006811F1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00681243

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 82280112bbcd50b9b61a3cdfc4e0c505c7f54c82ddb0a02b42ab5f679a62c1ae
Instruction ID: 92faf007fa7fc917c839955b6d6f57f39ee8fce2469739da2b6aeaa019f4ab6f
Opcode Fuzzy Hash: 82280112bbcd50b9b61a3cdfc4e0c505c7f54c82ddb0a02b42ab5f679a62c1ae
Instruction Fuzzy Hash: C3314870D402089AFF30ABA58C187FA7BAFAB4B310F04431EE5D09A6D1C3755A868751

Function 00656415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0065644B
__isleadbyte_l.LIBCMT ref: 00656479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006564A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 006564DD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 87f3898fd5a902eddace41062cbf5f1e29fa7defa3d3275de0ef06de65df38c2
Instruction ID: fb0761a4bb430b6307bf01819bfea225728339cec3aededf24c1913b8fcf876e
Opcode Fuzzy Hash: 87f3898fd5a902eddace41062cbf5f1e29fa7defa3d3275de0ef06de65df38c2
Instruction Fuzzy Hash: 8C31D031600246AFDB218F74C844BAA7BE7FF41312F558129FC54872A0E731EC99DB90

Function 006A5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006A5189

Part of subcall function 0068387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00683897
Part of subcall function 0068387D: GetCurrentThreadId.KERNEL32 ref: 0068389E
Part of subcall function 0068387D: AttachThreadInput.USER32(00000000,?,006852A7), ref: 006838A5

GetCaretPos.USER32(?), ref: 006A519A
ClientToScreen.USER32(00000000,?), ref: 006A51D5
GetForegroundWindow.USER32 ref: 006A51DB

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 069aab16567c087a0a53b46120172a4e8c90a7fa8168075ef9e0b9879b2df045
Instruction ID: 7f4b307768031b5562030ac1a3bcafa29e158da21400b116b8ce4b9a732f0710
Opcode Fuzzy Hash: 069aab16567c087a0a53b46120172a4e8c90a7fa8168075ef9e0b9879b2df045
Instruction Fuzzy Hash: CA314C71D00218AFCB40EFA5D8859EFB7FAEF98300F10406AE405E7201EA75AE01CFA4

Function 006AC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

GetCursorPos.USER32(?), ref: 006AC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0065BBFB,?,?,?,?,?), ref: 006AC7D7
GetCursorPos.USER32(?), ref: 006AC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0065BBFB,?,?,?), ref: 006AC85E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 27dbed04f96ac29366413c853c9e084061cb33e6f42c5f9e34551fdd18fc4f9a
Instruction ID: 0146f77baef73142ca382f0ff72ae4fa91ac148408e21a489bd1d737cf2153c3
Opcode Fuzzy Hash: 27dbed04f96ac29366413c853c9e084061cb33e6f42c5f9e34551fdd18fc4f9a
Instruction Fuzzy Hash: 84317335500118AFCB15DF58C898EEA7FBBFB4A720F044069F9058B261D7359D51DF60

Function 00640BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00640BF2

Part of subcall function 00625B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00687B20,?,?,00000000), ref: 00625B8C
Part of subcall function 00625B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00687B20,?,?,00000000,?,?), ref: 00625BB0

_fprintf.LIBCMT ref: 00640C29
OutputDebugStringW.KERNEL32(?), ref: 00676331

Part of subcall function 00644CDA: _flsall.LIBCMT ref: 00644CF3

__setmode.LIBCMT ref: 00640C5E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 54c08c2c2704a24f1a6343ba353ab67e16cddc92d22aed27ae06ec50fb912533
Instruction ID: 864caf31ed017a411041d2e8d84255fa1243e1c6f270b5b4f1f604e2a57b724c
Opcode Fuzzy Hash: 54c08c2c2704a24f1a6343ba353ab67e16cddc92d22aed27ae06ec50fb912533
Instruction Fuzzy Hash: 73113632A04614BEEB44B3B4AC83AFE7B6B9F41320F14411EF20457192DE315D8297A9

Function 00678B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00678652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00678669
Part of subcall function 00678652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00678673
Part of subcall function 00678652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00678682
Part of subcall function 00678652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00678689
Part of subcall function 00678652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0067869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00678BEB
_memcmp.LIBCMT ref: 00678C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00678C44
HeapFree.KERNEL32(00000000), ref: 00678C4B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 4ebf5dc70de62a0e60365196ef555fc1c246b0ac8ecbfd4c0ea01ade1e1daa93
Instruction ID: a17f5b103341faca6717fb756171c59c48e2a760143937bb50b3bba4bc2c481c
Opcode Fuzzy Hash: 4ebf5dc70de62a0e60365196ef555fc1c246b0ac8ecbfd4c0ea01ade1e1daa93
Instruction Fuzzy Hash: D1219071E81208EFDB10DFA4C949BEEB7BAEF44354F158099E458A7240DB31AE46CF61

Function 00691A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00691A97

Part of subcall function 00691B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00691B40
Part of subcall function 00691B21: InternetCloseHandle.WININET(00000000), ref: 00691BDD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: a2e8b67f0ac1252791dd254a04fe36224603c993fe1627e133e63c66c56381e3
Instruction ID: 5822ac217d6c1971665624877c0f31be43c916fdc219ef5a962f1419bcaf4593
Opcode Fuzzy Hash: a2e8b67f0ac1252791dd254a04fe36224603c993fe1627e133e63c66c56381e3
Instruction Fuzzy Hash: EA21A435200606BFDF119FA0DC01FBAB7AFFF46701F20401AF9119AA55E771E8119B94

Function 0067E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0067F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0067E1C4,?,?,?,0067EFB7,00000000,000000EF,00000119,?,?), ref: 0067F5BC
Part of subcall function 0067F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0067F5E2
Part of subcall function 0067F5AD: lstrcmpiW.KERNEL32(00000000,?,0067E1C4,?,?,?,0067EFB7,00000000,000000EF,00000119,?,?), ref: 0067F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0067EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0067E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0067E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0067EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0067E237

Strings

cdecl, xrefs: 0067E22E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f9717a7bbd114c8e31d18c174d869877a59352c1df65a419afe94bf83823b2e0
Instruction ID: ad3d7be27a1f815bcb8f68b0fa5cc2649ad23048c0c9ce3d7f6afba41b8f0025
Opcode Fuzzy Hash: f9717a7bbd114c8e31d18c174d869877a59352c1df65a419afe94bf83823b2e0
Instruction Fuzzy Hash: 72110336200301EFCB24AF74DC05D7A77AAFF49310B40806AF81ACB251EB72A954C7A1

Function 00655332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00655351

Part of subcall function 0064594C: __FF_MSGBANNER.LIBCMT ref: 00645963
Part of subcall function 0064594C: __NMSG_WRITE.LIBCMT ref: 0064596A
Part of subcall function 0064594C: RtlAllocateHeap.NTDLL(011F0000,00000000,00000001,00000000,?,?,?,00641013,?), ref: 0064598F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: d18c45af114609219458a5276d54bbdb6946093e6181dd852e7cc859a9abe3bb
Instruction ID: 0acdd2b7644313420c53923fcf384620ecb8031a725e153a6455407125ff8fb3
Opcode Fuzzy Hash: d18c45af114609219458a5276d54bbdb6946093e6181dd852e7cc859a9abe3bb
Instruction Fuzzy Hash: 7F110432805B15AFCF203F70E86969D37975F013E2F10042DFD0A9A291EE7189459694

Function 00624531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00624560

Part of subcall function 0062410D: _memset.LIBCMT ref: 0062418D
Part of subcall function 0062410D: _wcscpy.LIBCMT ref: 006241E1
Part of subcall function 0062410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 006241F1

KillTimer.USER32(?,00000001,?,?), ref: 006245B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 006245C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0065D6CE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 971bb85744f873078909ba79025d06c78eb5e6416dee3cbf43252733ecfda3bc
Instruction ID: 326e0e20724f3ce98e5fc227e296a185d6ca2a8d07e832e381db4c5840f6180f
Opcode Fuzzy Hash: 971bb85744f873078909ba79025d06c78eb5e6416dee3cbf43252733ecfda3bc
Instruction Fuzzy Hash: C5212970904794AFEB328B24DC45BE7BBEE9F01305F00009DE6DE66291C7B45A89CF51

Function 006840B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 006840D1
_memset.LIBCMT ref: 006840F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00684144
CloseHandle.KERNEL32(00000000), ref: 0068414D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 75e32246b09361c2af7867710aa6ed59c7fbe4bcd5961043b1d62e3abe6d7e1b
Instruction ID: 699e8da8a94ddedb1d08d23ba9227935619d2b7c6b3865821660db9edb14834c
Opcode Fuzzy Hash: 75e32246b09361c2af7867710aa6ed59c7fbe4bcd5961043b1d62e3abe6d7e1b
Instruction Fuzzy Hash: 85110D759012287AD7306BA59C4DFEBBB7DEF45760F10429AF908D7280D6744F80CBA4

Function 0069667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00625B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00687B20,?,?,00000000), ref: 00625B8C
Part of subcall function 00625B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00687B20,?,?,00000000,?,?), ref: 00625BB0

gethostbyname.WSOCK32(?), ref: 006966AC
WSAGetLastError.WSOCK32(00000000), ref: 006966B7
_memmove.LIBCMT ref: 006966E4
inet_ntoa.WSOCK32(?), ref: 006966EF

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 594db7521bc34ae83a2e7496e8eda0f9ed7e5a07537cd9461919206ba4ba1f4a
Instruction ID: 01124a8545b04b42100e989801820a682705ee267660b5dd575d545c063769de
Opcode Fuzzy Hash: 594db7521bc34ae83a2e7496e8eda0f9ed7e5a07537cd9461919206ba4ba1f4a
Instruction Fuzzy Hash: B9115135500505AFCF40FBA4ED96DEEB7BAAF45311B144069F506A7161DF30AE04CF65

Function 00679023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00679043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00679055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0067906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00679086

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 4ab21975033981825207686894a728092c408b234f743c87b844e45771c01233
Instruction ID: 1706a5f795ff0c07b093743bb1edd3ec63129a0afc46aed3dcab940213cf933b
Opcode Fuzzy Hash: 4ab21975033981825207686894a728092c408b234f743c87b844e45771c01233
Instruction Fuzzy Hash: ED115E79900218FFDB10DFA5CC85EDDBBB9FB48310F204095E904B7250D6716E10DBA4

Function 00621290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00622612: GetWindowLongW.USER32(?,000000EB), ref: 00622623

DefDlgProcW.USER32(?,00000020,?), ref: 006212D8
GetClientRect.USER32(?,?), ref: 0065B84B
GetCursorPos.USER32(?), ref: 0065B855
ScreenToClient.USER32(?,?), ref: 0065B860

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 8e51bd4cc5522cfee8d5d3a26685e2b52caada002ce431f5957fd3b46a8d156b
Instruction ID: 1332c17e4bcb6b64e9c8bd1b44f565744b6d9ed152ff8acbbcc929eb795199b0
Opcode Fuzzy Hash: 8e51bd4cc5522cfee8d5d3a26685e2b52caada002ce431f5957fd3b46a8d156b
Instruction Fuzzy Hash: DD116A35905429EFCB10EFA4E8859EE77BAEB16300F000456F901EB241C730BA918FAA

Function 00681652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006801FD,?,00681250,?,00008000), ref: 0068166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,006801FD,?,00681250,?,00008000), ref: 00681694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006801FD,?,00681250,?,00008000), ref: 0068169E
Sleep.KERNEL32(?,?,?,?,?,?,?,006801FD,?,00681250,?,00008000), ref: 006816D1

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 655e36c6e5b244a1cdd8497cf2000e4f867185068e99ea3afc9a4c48aa662e2b
Instruction ID: eaf35876294f091c5a51978bcd761afa5aea70da90c6d8a38e952af35a57bc32
Opcode Fuzzy Hash: 655e36c6e5b244a1cdd8497cf2000e4f867185068e99ea3afc9a4c48aa662e2b
Instruction Fuzzy Hash: EE118E31C0052CD7CF00AFE5D848AEEBB7EFF0A711F154159E980BA240DB3169A28B96

Function 00657207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0065722B

Part of subcall function 00657912: __fltout2.LIBCMT ref: 0065793B

__cftog_l.LIBCMT ref: 00657251
__cftoe_l.LIBCMT ref: 00657283

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 302a784b98241f02aed2a0fe89107141c5ba1a2f1e6b7ebd87b4d150909a83da
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 7D01803204414ABBCF525E84EC01CEE3F23BF19342F088515FE1858131C237CAB9AB81

Function 006AB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006AB59E
ScreenToClient.USER32(?,?), ref: 006AB5B6
ScreenToClient.USER32(?,?), ref: 006AB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006AB5F5

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 377ae6a9cd6164012e9225653ef7b8da3f302aea6ca82c2d5c2d033628dcdce8
Instruction ID: cac8ec3ad3c7753f55ef0923589985c990d86fc7ee1ca3b705f31ddd924023ca
Opcode Fuzzy Hash: 377ae6a9cd6164012e9225653ef7b8da3f302aea6ca82c2d5c2d033628dcdce8
Instruction Fuzzy Hash: 821143B9D00209EFDB41DFA9C8849EEFBB9FF09310F109166E914E3220D735AA558F91

Function 006AB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006AB8FE
_memset.LIBCMT ref: 006AB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,006E7F20,006E7F64), ref: 006AB93C
CloseHandle.KERNEL32 ref: 006AB94E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 07457b1e8d205de205993c3c663b6cb2b938b322c5dcb4cc67d2ba4dcd039f21
Instruction ID: 809195307a431a75c64112ca344fc0b36d161dbe92eaf8888e1924de25553eca
Opcode Fuzzy Hash: 07457b1e8d205de205993c3c663b6cb2b938b322c5dcb4cc67d2ba4dcd039f21
Instruction Fuzzy Hash: C5F05EB25443907BE7102BA1AC45FBB3A5EEB09754F006020BA08DA292D7715D008BA9

Function 00686E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00686E88

Part of subcall function 0068794E: _memset.LIBCMT ref: 00687983

_memmove.LIBCMT ref: 00686EAB
_memset.LIBCMT ref: 00686EB8
LeaveCriticalSection.KERNEL32(?), ref: 00686EC8

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 46405992f5784488ae63f365d759d781fb5c6ec20802cf392a64b7dea0342c52
Instruction ID: bf447460e7ab74d6fd53df3e8ceb13e7c7b0e2b34e2518b6206a69fdc64d397b
Opcode Fuzzy Hash: 46405992f5784488ae63f365d759d781fb5c6ec20802cf392a64b7dea0342c52
Instruction Fuzzy Hash: FAF0543A100210ABCF517F95DC85B89BB2BEF45320B048165FE085F226C731E951DBB5

Function 006AC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 006212F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0062134D
Part of subcall function 006212F3: SelectObject.GDI32(?,00000000), ref: 0062135C
Part of subcall function 006212F3: BeginPath.GDI32(?), ref: 00621373
Part of subcall function 006212F3: SelectObject.GDI32(?,00000000), ref: 0062139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 006AC030
LineTo.GDI32(00000000,?,?), ref: 006AC03D
EndPath.GDI32(00000000), ref: 006AC04D
StrokePath.GDI32(00000000), ref: 006AC05B

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 658d52f9987636d031b168cf7cbc930042e26ffd06a85dab85851e78c899c216
Instruction ID: 01c240460ac288ce74352cef50c5ec0a27b7a166f2f8eb39a675125dc5623ba7
Opcode Fuzzy Hash: 658d52f9987636d031b168cf7cbc930042e26ffd06a85dab85851e78c899c216
Instruction Fuzzy Hash: FAF03A31005659BADB226F94AC09FCE3B9AAF16321F044000FA11651E287A56A61CFAA

Function 0067A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0067A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0067A3AC
GetCurrentThreadId.KERNEL32 ref: 0067A3B3
AttachThreadInput.USER32(00000000), ref: 0067A3BA

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: d25a1f70bd8462a6dc5a27365134b68e3022f2ca0070e27cd824a3763fcc6c42
Instruction ID: adb5c4bd7943dbf9f0297533f764b0668149523ff7cb94be4289d3f1afe278e4
Opcode Fuzzy Hash: d25a1f70bd8462a6dc5a27365134b68e3022f2ca0070e27cd824a3763fcc6c42
Instruction Fuzzy Hash: DEE0C931545228BADB206FE2DC0DEDB7F5EEF167A2F009025F509D50A0C6719941DBA2

Function 00622218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00622231
SetTextColor.GDI32(?,000000FF), ref: 0062223B
SetBkMode.GDI32(?,00000001), ref: 00622250
GetStockObject.GDI32(00000005), ref: 00622258
GetWindowDC.USER32(?,00000000), ref: 0065C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0065C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0065C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0065C112
GetPixel.GDI32(00000000,?,?), ref: 0065C132
ReleaseDC.USER32(?,00000000), ref: 0065C13D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 66adb9021bda08a95de25b2a6e7f92d3b9ea7bbdecc4ba7db1583ef78306338f
Instruction ID: 13a27fad79b204a8258249d911650b339c04d6ec3270033407eb517f3f72bc6f
Opcode Fuzzy Hash: 66adb9021bda08a95de25b2a6e7f92d3b9ea7bbdecc4ba7db1583ef78306338f
Instruction Fuzzy Hash: 21E06D32600244EEDB216FA4FC0D7D87B12EB16332F0083B6FA69480E1C7724984DF22

Function 00678C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00678C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0067882E), ref: 00678C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0067882E), ref: 00678C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0067882E), ref: 00678C7E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 599a1aa206e2877b6037641aae3f964d641e13cb3709255089491b179a54bb0c
Instruction ID: 178f6e439774b97e511e9118b5ba7de829e0134bfb976f277101de4bf0c9e435
Opcode Fuzzy Hash: 599a1aa206e2877b6037641aae3f964d641e13cb3709255089491b179a54bb0c
Instruction Fuzzy Hash: 96E08636642211DFD7206FF16D0CF977BAEEF52792F089828B245CA040DA349841CF62

Function 00662187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00662187
GetDC.USER32(00000000), ref: 00662191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 006621B1
ReleaseDC.USER32(?), ref: 006621D2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 887c410e605a6b00e5389a9ed37f08bcc670214824c49b1eae8e9166d3badec6
Instruction ID: fb15ce37bb346f20c0c07abf9c36f52699f3e24fef7d337cb577a2afb511482c
Opcode Fuzzy Hash: 887c410e605a6b00e5389a9ed37f08bcc670214824c49b1eae8e9166d3badec6
Instruction Fuzzy Hash: 72E01A75800614EFDB11AFA0D808A9D7BF3EB4D351F109429FD5A97220CB39A1429F41

Function 0066219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0066219B
GetDC.USER32(00000000), ref: 006621A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 006621B1
ReleaseDC.USER32(?), ref: 006621D2

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: da11444b882f8c5af480efb3250e73150b8ed80173e6e588279b86cb3464e5fd
Instruction ID: 7e0f188788198677d11365366ed846d01b7318dfa3bf28374623bafcfd7ac8d6
Opcode Fuzzy Hash: da11444b882f8c5af480efb3250e73150b8ed80173e6e588279b86cb3464e5fd
Instruction Fuzzy Hash: 90E01A75C00614AFCB11AFB0D80869D7BF2EB4D311F109029F95A97220CB39A1419F41

Function 006263A0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%k, xrefs: 006263AE

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID:
String ID: %k
API String ID: 0-3601005739
Opcode ID: f3f86727d95771bf9a923ee5ac8f74f12963b9ed1034d39dde34a92729345fa2
Instruction ID: 6da8a1d4ac3de5a4fd98a6a03ee79ed2a4268b73f7116b6ea1e9b16e36443add
Opcode Fuzzy Hash: f3f86727d95771bf9a923ee5ac8f74f12963b9ed1034d39dde34a92729345fa2
Instruction Fuzzy Hash: ACB1B27180092A9BCF24EF94E4819FDB7B6FF04310F50812AF942A7295DB349E86CF65

Function 0069B1B7 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0069B2C3

Strings

xrn, xrefs: 0069B325
xrn, xrefs: 0069B2F9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __itow_s
String ID: xrn$xrn
API String ID: 3653519197-3769791102
Opcode ID: ebd166328db3868b131c77359b307938b8286fa39036ad756cdb93f8a7528262
Instruction ID: 1f181e99ffbc4de068c55fd43ded68fb9bfd421e7f5a554b3157d44fe28c68e1
Opcode Fuzzy Hash: ebd166328db3868b131c77359b307938b8286fa39036ad756cdb93f8a7528262
Instruction Fuzzy Hash: 6DB17C70A00209AFDF14DF54E990EBEB7BAEF58300F149159F9459B292DB70EA41CB64

Function 0068B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0063FEC6: _wcscpy.LIBCMT ref: 0063FEE9

Part of subcall function 00629997: __itow.LIBCMT ref: 006299C2
Part of subcall function 00629997: __swprintf.LIBCMT ref: 00629A0C

__wcsnicmp.LIBCMT ref: 0068B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0068B361

Strings

LPT, xrefs: 0068B292

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 7a0de78f72cee9b829ce7b8321b84e70b49b0778321db35c76c41c286e4e3c32
Instruction ID: 18dfe33db56ca644d23aa05027dfe221b2ef9d7a809e66d3f96204d6fb7f27eb
Opcode Fuzzy Hash: 7a0de78f72cee9b829ce7b8321b84e70b49b0778321db35c76c41c286e4e3c32
Instruction Fuzzy Hash: 0A61A275E00215AFCB14EF94D891EEEB7B6AF08310F15915DF506AB351DB70AE80CB94

Function 00668A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00668B1E
_memmove.LIBCMT ref: 00668B78

Strings

Oac, xrefs: 00668BF2, 0066E39A, 0066E3B6

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _memmove
String ID: Oac
API String ID: 4104443479-752515563
Opcode ID: 4ff7708eaa290a61569ff269f946033c7988c456347a61d48ae920c10b2a3504
Instruction ID: 01aa788b4907fd3fb88a0e2583c1a7687164a21ba5b9c07121daf9123ba57662
Opcode Fuzzy Hash: 4ff7708eaa290a61569ff269f946033c7988c456347a61d48ae920c10b2a3504
Instruction Fuzzy Hash: 205120749006099FCF64CFA8C884AAEB7B2FF44314F14455AE85AD7350DB31A995CB51

Function 00632AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00632AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00632AE1

Strings

@, xrefs: 00632AD5

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 4ece3ce8ce129f2286f2213516cfbc6d29cbf4cafca8cbc93423224e75914c85
Instruction ID: 28d8021b566ed1961685997d469f8357f7f8230436e23bfe95738d978ec3c6da
Opcode Fuzzy Hash: 4ece3ce8ce129f2286f2213516cfbc6d29cbf4cafca8cbc93423224e75914c85
Instruction Fuzzy Hash: 03514871418B549BD360AF10E886BABBBE8FFC4314F42485DF1D9411A5DB309929CB6A

Function 006899BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0062506B: __fread_nolock.LIBCMT ref: 00625089

_wcscmp.LIBCMT ref: 00689AAE
_wcscmp.LIBCMT ref: 00689AC1

Strings

FILE, xrefs: 006899FA

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 82a1c39cd0337545f19ee48860c09506e8502bf6455eb9604b9842e3dc0f143a
Instruction ID: 4c3fa4543b21a351c3798e657b383dd758c08271cecba6a051be839d3209eab6
Opcode Fuzzy Hash: 82a1c39cd0337545f19ee48860c09506e8502bf6455eb9604b9842e3dc0f143a
Instruction Fuzzy Hash: 0141D671A0061ABADF20AAA0DC45FEFBBBEDF45710F04006DF901A7281DA759A048BB5

Function 0066099E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 006609A9

Strings

Dtn, xrefs: 0062A2B1
Dtn, xrefs: 0062A477

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClearVariant
String ID: Dtn$Dtn
API String ID: 1473721057-570680631
Opcode ID: 978813565cbd15c74b638ef9fb6964213b9e1030bff12de1662504827b4c8411
Instruction ID: 96346b28f33d02202041bc27e4660aaa83b4336bab918051cf38a1412e6903f3
Opcode Fuzzy Hash: 978813565cbd15c74b638ef9fb6964213b9e1030bff12de1662504827b4c8411
Instruction Fuzzy Hash: 90510278608752CFD754CF59D480A6ABBE2BB99344F54885CE9818B361E372EC81CF82

Function 00692882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00692892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006928C8

Strings

|, xrefs: 00692899

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 77d91c5660e88e2a30ba0671e7a06a3e0630456430dc6a335d19d7d3e75ce0e2
Instruction ID: 31efa768d7c38be9ce24ee9bf7eaa9709e71421c72249b35972c5e2d8000c632
Opcode Fuzzy Hash: 77d91c5660e88e2a30ba0671e7a06a3e0630456430dc6a335d19d7d3e75ce0e2
Instruction Fuzzy Hash: D8311C7180011AAFCF41DFA1DC85EEEBFBAFF08300F104029F815A6265EA355956DB61

Function 006A6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 006A6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 006A6DC2

Strings

static, xrefs: 006A6D22

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c44edaddbfba3398d2e5ebd2715c0933b154f6155e4b1e9c8b1663fc38b1090f
Instruction ID: 3b4775a907744276cf47c0a31490230f7c0536a1e7299d1eddd9a39bcafb3bd0
Opcode Fuzzy Hash: c44edaddbfba3398d2e5ebd2715c0933b154f6155e4b1e9c8b1663fc38b1090f
Instruction Fuzzy Hash: 2431A171200604AEDB10AF74DC81AFB77BAFF49760F14961DF99697190CA31AC51CF64

Function 00682D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00682E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00682E3B

Strings

0, xrefs: 00682DF9

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 566a89e7aa4dd59a74965064ae730cb7419b14f0dbaa35c7a05e9590de85564b
Instruction ID: a0de3f89ceb5b585f1cb24337e91f6227e79fe2eafb495264a7bae53159f80d0
Opcode Fuzzy Hash: 566a89e7aa4dd59a74965064ae730cb7419b14f0dbaa35c7a05e9590de85564b
Instruction Fuzzy Hash: E731E931A0030AABEB24EF58C9897DEBBFBFF05350F14022DED85962A1D7709944CB58

Function 006A6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 006A69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006A69DB

Strings

Combobox, xrefs: 006A699D

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 4d4f303e4f1c1850efd60a0bdfa5876b7d089073cdb9c596f2b330f55eaa9c26
Instruction ID: f8129e200220669c9230d23aa746a7bdc5678dc4c89c0348f0781c1ac0159f5b
Opcode Fuzzy Hash: 4d4f303e4f1c1850efd60a0bdfa5876b7d089073cdb9c596f2b330f55eaa9c26
Instruction Fuzzy Hash: 3A11B27160020AAFEF11AF14CC80EEB376FEB9A3A4F150129F9589B391D6719C518FA0

Function 006A6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00621D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00621D73
Part of subcall function 00621D35: GetStockObject.GDI32(00000011), ref: 00621D87
Part of subcall function 00621D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00621D91

GetWindowRect.USER32(00000000,?), ref: 006A6EE0
GetSysColor.USER32(00000012), ref: 006A6EFA

Strings

static, xrefs: 006A6EBD

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 463c1e92f7c9cbae4ffe1a9defa44a763e5abea9aac1c81ab52ac30233b9e674
Instruction ID: 0f3c3df6511ca592e44fe6f16ef431c03f6779d6d11fb2b3d18f49a97f491f47
Opcode Fuzzy Hash: 463c1e92f7c9cbae4ffe1a9defa44a763e5abea9aac1c81ab52ac30233b9e674
Instruction Fuzzy Hash: 73215972610209AFDF04EFA8DC45AEA7BBAFB09314F045628FA55D3250D634E8619F60

Function 006A6B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006A6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006A6C20

Strings

edit, xrefs: 006A6BF5

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9b718eef7169bd0588549ede74f8807d4bdbd09a88363033f2693ed297772e09
Instruction ID: 98bebeba47fd117476cfc6e97c9476b22acce9c2d6ba449ca303256e197d90fe
Opcode Fuzzy Hash: 9b718eef7169bd0588549ede74f8807d4bdbd09a88363033f2693ed297772e09
Instruction Fuzzy Hash: FF116D71500208ABEB106F64DC41AEA376BEB16378F144724F961D72E0C775ECA19F60

Function 00682E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00682F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00682F30

Strings

0, xrefs: 00682F07

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 23724a5fbc143dddd1c4cbb1f88148aaedf201ad76c3308ae2b02fc2d38b625a
Instruction ID: 84c64a857e4ba09ee159348fe3c82041cf69e93c3038f7855c0539685589a1ce
Opcode Fuzzy Hash: 23724a5fbc143dddd1c4cbb1f88148aaedf201ad76c3308ae2b02fc2d38b625a
Instruction Fuzzy Hash: 5911D031901216ABCB30FB58DD58BDA77BBEB11350F0402B6F944A73A0D7B0AD05C795

Function 006924CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00692520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00692549

Strings

<local>, xrefs: 00692511

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: fb69392b2e6201e0685e6374fee28d5b6d5f68961aee9e0e86ee66c98086fbb6
Instruction ID: ef4c0ca1367912e094ec4babd23bb96a897cadb3528e1b5032dad545361cdfc0
Opcode Fuzzy Hash: fb69392b2e6201e0685e6374fee28d5b6d5f68961aee9e0e86ee66c98086fbb6
Instruction Fuzzy Hash: 01110670500226BADF248F51CCA4EFBFFAEFF06751F10812AF90582540D270A981DAF0

Function 006980A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0069830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,006980C8,?,00000000,?,?), ref: 00698322

inet_addr.WSOCK32(00000000), ref: 006980CB
htons.WSOCK32(00000000), ref: 00698108

Strings

255.255.255.255, xrefs: 006980E3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 21d864e78ac17c8dfd8c7ddaab3f01ccb00a0315304dd41f848c62d60f5c084f
Instruction ID: c621ea7dbd90d0c4639318380f3345e2321d60cb2e53870975ae41acac4c1860
Opcode Fuzzy Hash: 21d864e78ac17c8dfd8c7ddaab3f01ccb00a0315304dd41f848c62d60f5c084f
Instruction Fuzzy Hash: 8D11E534600205AFCF20AFA4DC46FFDB32AFF16320F10851BF91297791DA31A811CA59

Function 00630A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00623C26,006E62F8,?,?,?), ref: 00630ACE

Part of subcall function 00627D2C: _memmove.LIBCMT ref: 00627D66

_wcscat.LIBCMT ref: 006650E1

Strings

cn, xrefs: 00630B0E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: cn
API String ID: 257928180-15458471
Opcode ID: c8d59bfcc21607afbf917c94513c9c5a20dfa95f6832072e4bbcce1a68313d96
Instruction ID: efa514d7dfcdbf1ad7e5a8ef1d7067b35589702e0fdf450253140452c4aa2290
Opcode Fuzzy Hash: c8d59bfcc21607afbf917c94513c9c5a20dfa95f6832072e4bbcce1a68313d96
Instruction Fuzzy Hash: BB11A534A052189B8B80EBA4DC11ED9B7BFEF08350F0004A9B949D7241EA70EB888B65

Function 006792E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00679355

Strings

ComboBox, xrefs: 006792F4
ListBox, xrefs: 0067931F

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 71938d5377f55abe8301d12a7f774f7f72e124e63fd5813ae42bb40044f9630d
Instruction ID: 878e9193ffefbd6092803286b79c87e7ae52a50bfe6c6b6a2c339269a52594de
Opcode Fuzzy Hash: 71938d5377f55abe8301d12a7f774f7f72e124e63fd5813ae42bb40044f9630d
Instruction Fuzzy Hash: 9001F171A05224ABCB04EBA4CC92CFE73ABBF06320B14461DF936673D1EB315808CA60

Function 006791DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0067924D

Strings

ComboBox, xrefs: 006791EC
ListBox, xrefs: 00679217

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f86482486824569cba101f63cbdfb549bd9d868a3096341f38aece7532bc10a2
Instruction ID: 53052079aa67f9bba4e355733f89e6e195ec92a302bac275f08cf81c1c6eeda0
Opcode Fuzzy Hash: f86482486824569cba101f63cbdfb549bd9d868a3096341f38aece7532bc10a2
Instruction Fuzzy Hash: 2D01D471E452047BCB14FBA0D992EFF73AA9F05300F144169B91663292EA216F089AB5

Function 00679264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00627F41: _memmove.LIBCMT ref: 00627F82

Part of subcall function 0067B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0067B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 006792D0

Strings

ComboBox, xrefs: 00679271
ListBox, xrefs: 0067929C

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 282d161bf0bbe8606265603f752c669569e9f6b34b9044bc817af0a26168e168
Instruction ID: 286c3041ba3fd766219329b1465866df4b919a4a4ae2c4e2eea7fb012c41c117
Opcode Fuzzy Hash: 282d161bf0bbe8606265603f752c669569e9f6b34b9044bc817af0a26168e168
Instruction Fuzzy Hash: 2301F271E4121877CF00FBA4D982EFF73AE9F01300F244129B91673282DA215F089AB5

Function 00646DAE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00646DD0
__calloc_crt.LIBCMT ref: 00646DE9

Strings

@Rn, xrefs: 00646E00

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: __calloc_crt
String ID: @Rn
API String ID: 3494438863-2908497755
Opcode ID: c2423edff8039807a386f5a2e84c0a68739c2ddc10c09bfb294542689cdd94d6
Instruction ID: 2ee1def983d388ab60a4ea0eea586093b02874484657838661131fea926d02c1
Opcode Fuzzy Hash: c2423edff8039807a386f5a2e84c0a68739c2ddc10c09bfb294542689cdd94d6
Instruction Fuzzy Hash: F0F04471B087169FF7648F14FD516952B97EB12760B14442BF201CF290EBB089824685

Function 006851CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006851E8
_wcscmp.LIBCMT ref: 006851FA

Strings

#32770, xrefs: 006851F4

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: c1d761e8e13d49403701023759e7bb9abd315207e1d06ca571cce66f9931d434
Instruction ID: bc51ba605c3df9ccbd571e062235070bcbfa1f5240f262a67f02fc26d6364f26
Opcode Fuzzy Hash: c1d761e8e13d49403701023759e7bb9abd315207e1d06ca571cce66f9931d434
Instruction Fuzzy Hash: DCE0613290432C17D310ABD5AC45FA7F7ADEB41731F00015BFD10D3140D5609A058BD1

Function 006781BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 006781CA

Part of subcall function 00643598: _doexit.LIBCMT ref: 006435A2

Strings

AutoIt, xrefs: 006781BE
Error allocating memory., xrefs: 006781C3

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 6d8496b5a654ec909e6fd2e2784fa93790148b5e895bb4196f733050a9d4cef5
Instruction ID: ebf968ae41a45a6630adf87748f8e6ab84845966768ad836944335ae87a8b2f9
Opcode Fuzzy Hash: 6d8496b5a654ec909e6fd2e2784fa93790148b5e895bb4196f733050a9d4cef5
Instruction Fuzzy Hash: 1DD012322C532836D35433A46C0ABC56A8A4B16B51F44441ABB08596D38ED559C146AD

Function 0065B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0065B564: _memset.LIBCMT ref: 0065B571

Part of subcall function 00640B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0065B540,?,?,?,0062100A), ref: 00640B89

IsDebuggerPresent.KERNEL32(?,?,?,0062100A), ref: 0065B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0062100A), ref: 0065B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0065B54E

Memory Dump Source

Source File: 00000000.00000002.2002722252.0000000000621000.00000020.00000001.01000000.00000003.sdmp, Offset: 00620000, based on PE: true

Associated: 00000000.00000002.2002709168.0000000000620000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002790246.00000000006D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002827023.00000000006DF000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2002839398.00000000006E8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_620000_ss.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: b12423e2e1e7069373a479546714f367d8dfd7134ba0998c0809b78ce7ef1126
Instruction ID: 04ec2422c40944d96c4a666b6c2b74b1dff8d34cc453ef286fabc9e0aeff7606
Opcode Fuzzy Hash: b12423e2e1e7069373a479546714f367d8dfd7134ba0998c0809b78ce7ef1126
Instruction Fuzzy Hash: 89E092B02007128FE765EF68E4047427BE2EF04745F00992CE846C7351E7B4E548CFA1

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ss.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Clinton

C:\Users\user\AppData\Local\Temp\autC4B.tmp

C:\Users\user\AppData\Local\Temp\autCAA.tmp

C:\Users\user\AppData\Local\Temp\cacostomia

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
ss.exe

Function 00623B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 00624FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 00624AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 006893DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00623015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 74
windowregistryCOMMON

Function 00623041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 006271EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00623633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00623A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00623778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 0062F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 01EC25D0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 006239E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01EC23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 141
fileCOMMON

Function 0062410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre